Sqlmap Cheat Sheet

Sqlmap automates what manual SQL injection testing does by hand: finding an injectable parameter, identifying the database backend, and extracting data through it.

Red Team / Offensive Use

Sqlmap earns its place once you already suspect a parameter is injectable — from an error message, unusual response timing, or a manual test in Burp Repeater — and want to confirm and exploit it without hand-crafting every payload. It's not a substitute for understanding SQL injection; running it blind against every parameter on a site is noisy, slow, and a good way to trip a WAF for no reason. Use it to go deep once you have a real lead, not as a first-pass scanner.

Established Cheatsheet

Official sqlmap Usage wiki — the exhaustive, maintained reference for every switch and option, from the project itself.

PWNMI's Top 5 Use Cases

• sqlmap -u "https://target.com/page?id=1" --batch — basic test against a URL parameter; --batch accepts sqlmap's default answers instead of prompting interactively
• sqlmap -u "https://target.com/page?id=1" --dbs — enumerate available databases once injection is confirmed
• sqlmap -u "https://target.com/page?id=1" -D dbname --tables — list tables in a specific database
• sqlmap -u "https://target.com/page?id=1" -D dbname -T users --dump — dump the contents of a specific table
• sqlmap -r request.txt --batch — feed sqlmap a raw HTTP request captured from Burp instead of building the URL by hand; the right approach for anything involving cookies, headers, or POST bodies

Next step

Confirming the injection point manually in Burp Suite first, before handing it to sqlmap, keeps you from running an automated tool against a lead that was never real to begin with.