ngerprint: -f, --fingerprint Perform an extensive DBMS version fingerprint
Enumeration: These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements
-a, --all Retrieve everything -b, --banner Retrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database --hostname Retrieve DBMS server hostname --is-dba Detect if the DBMS current user is DBA --users Enumerate DBMS users --passwords Enumerate DBMS users password hashes --privileges Enumerate DBMS users privileges --roles Enumerate DBMS users roles --dbs Enumerate DBMS databases --tables Enumerate DBMS database tables --columns Enumerate DBMS database table columns --schema Enumerate DBMS schema --count Retrieve number of entries for table(s) --dump Dump DBMS database table entries --dump-all Dump all DBMS databases tables entries --search Search column(s), table(s) and/or database name(s) --comments Check for DBMS comments during enumeration --statements Retrieve SQL statements being run on DBMS -D DB DBMS database to enumerate -T TBL DBMS database table(s) to enumerate -C COL DBMS database table column(s) to enumerate -X EXCLUDE DBMS database identifier(s) to not enumerate -U USER DBMS user to enumerate --exclude-sysdbs Exclude DBMS system databases when enumerating tables --pivot-column=P.. Pivot column name --where=DUMPWHERE Use WHERE condition while table dumping --start=LIMITSTART First dump table entry to retrieve --stop=LIMITSTOP Last dump table entry to retrieve --first=FIRSTCHAR First query output word character to retrieve --last=LASTCHAR Last query output word character to retrieve --sql-query=SQLQ.. SQL statement to be executed --sql-shell Prompt for an interactive SQL shell --sql-file=SQLFILE Execute SQL statements from given file(s)
File system access: These options can be used to access the back-end database management system underlying file system
--file-read=RFILE Read a file from the back-end DBMS file system --file-write=WFILE Write a local file on the back-end DBMS file system --file-dest=DFILE Back-end DBMS absolute filepath to write to
进行目标服务器系统读，写操作
读参数
1
--file-read="/etc/passwd" 读取的是/etc/passwd的文件
12.rating system access: These options can be used to access the back-end database management system underlying operating system
–os-cmd=OSCMD Execute an operating system command –os-shell Prompt for an interactive operating system shell –os-pwn Prompt for an OOB shell, Meterpreter or VNC –os-smbrelay One click prompt for an OOB shell, Meterpreter or VNC –os-bof Stored procedure buffer overflow exploitation –priv-esc Database process user privilege escalation –msf-path=MSFPATH Local path where Metasploit Framework is installed –tmp-path=TMPPATH Remote absolute path of temporary files directory
rating system access: These options can be used to access the back-end database management system underlying operating system
--os-cmd=OSCMD Execute an operating system command --os-shell Prompt for an interactive operating system shell --os-pwn Prompt for an OOB shell, Meterpreter or VNC --os-smbrelay One click prompt for an OOB shell, Meterpreter or VNC --os-bof Stored procedure buffer overflow exploitation --priv-esc Database process user privilege escalation --msf-path=MSFPATH Local path where Metasploit Framework is installed --tmp-path=TMPPATH Remote absolute path of temporary files directory
Windows registry access: These options can be used to access the back-end database management system Windows registry
--reg-read Read a Windows registry key value --reg-add Write a Windows registry key value data --reg-del Delete a Windows registry key value --reg-key=REGKEY Windows registry key --reg-value=REGVAL Windows registry key value --reg-data=REGDATA Windows registry key value data --reg-type=REGTYPE Windows registry key value type
General: These options can be used to set some general working parameters
-s SESSIONFILE Load session from a stored (.sqlite) file -t TRAFFICFILE Log all HTTP traffic into a textual file --batch Never ask for user input, use the default behavior --binary-fields=.. Result fields having binary values (e.g. "digest") --check-internet Check Internet connection before assessing the target --crawl=CRAWLDEPTH Crawl the website starting from the target URL --crawl-exclude=.. Regexp to exclude pages from crawling (e.g. "logout") --csv-del=CSVDEL Delimiting character used in CSV output (default ",") --charset=CHARSET Blind SQL injection charset (e.g. "0123456789abcdef") --dump-format=DU.. Format of dumped data (CSV (default), HTML or SQLITE) --encoding=ENCOD.. Character encoding used for data retrieval (e.g. GBK) --eta Display for each output the estimated time of arrival --flush-session Flush session files for current target --forms Parse and test forms on target URL --fresh-queries Ignore query results stored in session file --har=HARFILE Log all HTTP traffic into a HAR file --hex Use DBMS hex function(s) for data retrieval --output-dir=OUT.. Custom output directory path --parse-errors Parse and display DBMS error messages from responses --save=SAVECONFIG Save options to a configuration INI file --scope=SCOPE Regexp to filter targets from provided proxy log --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW) --test-skip=TEST.. Skip tests by payloads and/or titles (e.g. BENCHMARK) --update Update sqlmap
Miscellaneous: -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") --alert=ALERT Run host OS command(s) when SQL injection is found --answers=ANSWERS Set question answers (e.g. "quit=N,follow=N") --beep Beep on question and/or when SQL injection is found --cleanup Clean up the DBMS from sqlmap specific UDF and tables --dependencies Check for missing (non-core) sqlmap dependencies --disable-coloring Disable console output coloring --gpage=GOOGLEPAGE Use Google dork results from specified page number --identify-waf Make a thorough testing for a WAF/IPS/IDS protection --mobile Imitate smartphone through HTTP User-Agent header --offline Work in offline mode (only use session data) --purge-output Safely remove all content from output directory --skip-waf Skip heuristic detection of WAF/IPS/IDS protection --smart Conduct thorough tests only if positive heuristic(s) --sqlmap-shell Prompt for an interactive sqlmap shell --tmp-dir=TMPDIR Local directory for storing temporary files --web-root=WEBROOT Web server document root directory (e.g. "/var/www") --wizard Simple wizard interface for beginner users
