Repository navigation
Expand file tree
/
Copy pathsql-command-builder.html
More file actions
1851 lines (1611 loc) · 143 KB
/
Copy pathsql-command-builder.html
File metadata and controls
1851 lines (1611 loc) · 143 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SQLMap Command Generator</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="container">
<header class="header">
<h1><a href="?">SQLMap Command Builder</a></h1>
<p>
<em>Interactive command line generator for conducting advanced SQLMap pentests.<br />
This builder works locally with pure HTML/JS/CSS (no data exchanged to any server).</em>
</p>
<p>
<strong><a href="https://github.com/vizzdoom/sqlmap-command-builder" target="_blank">SQLMap Command Builder <span id="tool-version"></span></a></strong> | Compatible with <strong><a target="_blank" href="https://github.com/sqlmapproject/sqlmap/releases">SQLMap 1.9.6.10</a></strong> | vizzdoom/at/gmail/dot/com
</p>
</header>
<!-- Command Output Area -->
<div class="command-header">
<button id="copyBtn" class="btn btn--primary">
<svg clip-rule="evenodd" fill-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="m6 19v2c0 .621.52 1 1 1h2v-1.5h-1.5v-1.5zm7.5 3h-3.5v-1.5h3.5zm4.5 0h-3.5v-1.5h3.5zm4-3h-1.5v1.5h-1.5v1.5h2c.478 0 1-.379 1-1zm-1.5-1v-3.363h1.5v3.363zm0-4.363v-3.637h1.5v3.637zm-13-3.637v3.637h-1.5v-3.637zm11.5-4v1.5h1.5v1.5h1.5v-2c0-.478-.379-1-1-1zm-10 0h-2c-.62 0-1 .519-1 1v2h1.5v-1.5h1.5zm4.5 1.5h-3.5v-1.5h3.5zm3-1.5v-2.5h-13v13h2.5v-1.863h1.5v3.363h-4.5c-.48 0-1-.379-1-1v-14c0-.481.38-1 1-1h14c.621 0 1 .522 1 1v4.5h-3.5v-1.5z" fill-rule="nonzero"/></svg>
COPY TO A CLIPBOARD
</button>
<button id="copyUrlBtn" class="btn btn--primary">
<svg viewBox="0 0 24 24" id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg"><defs><style>.cls-1{fill:none;stroke:#020202;stroke-miterlimit:10;stroke-width:1.92px;}</style></defs><path class="cls-1" d="M10.56,5.77l2.72-2.72a5.43,5.43,0,0,1,3.84-1.59,5.43,5.43,0,0,1,5.42,5.42A5.43,5.43,0,0,1,21,10.72l-2.72,2.72"/><path class="cls-1" d="M5.77,10.56,3.05,13.28A5.42,5.42,0,1,0,10.72,21l2.72-2.72"/><line class="cls-1" x1="16.79" y1="7.21" x2="7.21" y2="16.79"/><line class="cls-1" x1="20.63" y1="15.83" x2="23.5" y2="15.83"/><line class="cls-1" x1="15.83" y1="20.63" x2="15.83" y2="23.5"/><line class="cls-1" x1="19.19" y1="19.19" x2="21.1" y2="21.1"/><line class="cls-1" x1="3.38" y1="8.17" x2="0.5" y2="8.17"/><line class="cls-1" x1="8.17" y1="3.38" x2="8.17" y2="0.5"/><line class="cls-1" x1="4.81" y1="4.81" x2="2.9" y2="2.9"/></svg>
COPY CONFIG URL
</button>
</div>
<section class="command-section">
<div class="command-output">
<pre id="commandOutput" spellcheck="false" contenteditable="true">sqlmap</pre>
</div>
</section>
<!-- Options Tabs -->
<section class="options-section">
<div class="tabs">
<button class="tab-btn active" data-tab="target">TARGET</button>
<button class="tab-btn" data-tab="connection">CONNECTION</button>
<button class="tab-btn" data-tab="request">REQUEST</button>
<button class="tab-btn" data-tab="injection">INJECTION</button>
<button class="tab-btn" data-tab="exploitation">EXPLOITATION</button>
<button class="tab-btn" data-tab="tampering">TAMPERING</button>
<button class="tab-btn" data-tab="sqlmap">SQLMAP</button>
<button class="tab-btn" data-tab="config">CONFIG</button>
</div>
<!-- TARGET Tab -->
<div class="tab-content active" id="target">
<div class="card">
<div class="card__body">
<div class="form-grid">
<!-- -u -->
<label class="form-group" for="url">
<div class="form-label">TARGET URL<i tooltip="Specify the target URL to scan for SQL injection vulnerabilities, including any query parameters.">ⁱ</i></div>
<div class="form-label"><u>-u</u></div>
<input type="url" id="url" class="form-control" placeholder="https://127.0.0.1/page?id=1">
</label>
<!-- -d -->
<label class="form-group" for="directDb">
<div class="form-label">DATABASE CONNECTION STRING<i tooltip="Connection string for direct database connection.">ⁱ</i></div>
<div class="form-label"><u>-d</u></div>
<input type="text" id="directDb" class="form-control" placeholder="mysql://user:pass@host/db">
</label>
<!-- -g -->
<label class="form-group" for="googleDork">
<div class="form-label">GOOGLE DORK FOR TARGETS<i tooltip="Process Google dork results as target URLs.">ⁱ</i></div>
<div class="form-label"><u>-g</u></div>
<input type="text" id="googleDork" class="form-control" placeholder="inurl:php?id=">
</label>
<!-- -m -->
<label class="form-group" for="targetsFile">
<div class="form-label">FILE WITH TARGETS<i tooltip="Scan multiple targets given in a textual file.">ⁱ</i></div>
<div class="form-label"><u>-m</u></div>
<input type="text" id="targetsFile" class="form-control" placeholder="targets.txt">
</label>
<!-- -l -->
<label class="form-group" for="burpFile">
<div class="form-label">BURP FILE WITH HTTP REQUESTS<i tooltip="Rather than providing a single target URL, it is possible to test and inject against HTTP requests proxied through Burp proxy.">ⁱ</i></div>
<div class="form-label"><u>-l</u></div>
<input type="text" id="burpFile" class="form-control" placeholder="burp.txt">
</label>
<!-- --scope -->
<label class="form-group" for="burpFileScope">
<div class="form-label">SCOPE FOR BURP PROXY FILE<i tooltip="Rather than using all hosts parsed from provided logs with option -l, you can specify valid Python regular expression to be used for filtering desired ones.">ⁱ</i></div>
<div class="form-label"><u>--scope</u></div>
<input type="text" id="burpFileScope" class="form-control" placeholder="(www)?\.target\.(com|net|org)">
</label>
</div>
</div>
</div>
</div>
<!-- CONNECTION Tab -->
<div class="tab-content" id="connection">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Connection Control</h3>
<!-- --timeout -->
<label class="form-group" for="timeout">
<div class="form-label">REQUEST TIMEOUT<i tooltip="Seconds to wait before timeout connection.
Default: 30 seconds">ⁱ</i></div>
<div class="form-label"><u>--timeout</u></div>
<input type="number" id="timeout" class="form-control" min="1" max="300" placeholder="10 (seconds)">
</label>
<!-- --delay -->
<label class="form-group" for="delay">
<div class="form-label">DELAY BETWEEN REQUEST<i tooltip="Delay (in seconds) between each HTTP request">ⁱ</i></div>
<div class="form-label"><u>--delay</u></div>
<input type="number" id="delay" class="form-control" min="0.01" step="0.01" placeholder="2.25 (seconds)">
</label>
<!-- --threads -->
<label class="form-group" for="threads">
<div class="form-label">NUMBER OF CONCURRENT REQUESTS<i tooltip="Max number of concurrent HTTP(s) requests.
Default: 1 | Maximum: 10"> ⁱ </i></div>
<div class="form-label"><u>--threads</u></div>
<input type="number" id="threads" class="form-control" min="1" max="10" placeholder="1">
</label>
<!-- SPACER -->
<div></div>
<!-- force-ssl -->
<label class="form-group" for="forceSsl">
<div class="checkbox-label" >
<input type="checkbox" id="forceSsl">
<b>FORCE USAGE OF HTTPS REQUESTS</b>
<u>--force-ssl</u><i tooltip="In case that user wants to force usage of SSL/HTTPS requests toward the target, he can use this switch.
This can be alse useful in cases when urls are being collected by --crawl or when Burp log is being provided with option -l.">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<!-- --keep-alive -->
<label class="form-group" for="keepAlive">
<div class="checkbox-label">
<input type="checkbox" id="keepAlive">
<b>PERSISTENT CONNECTIONS OPTIMIZATION</b>
<u>--keep-alive</u><i tooltip="Connection optimization - using persistent HTTP(s) connections">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<!-- --null-connection -->
<label class="form-group" for="nullConnection">
<div class="checkbox-label">
<input type="checkbox" id="nullConnection">
<b>HTTP NULL CONNECTIONS OPTIMIZATION</b>
<u>--null-connection</u><i tooltip="Connection optimization - Retrieve page length without actual HTTP response body.
There are special HTTP request types which can be used to retrieve HTTP response's size without getting the HTTP body.
This knowledge can be used in blind injection technique to distinguish True from False responses.
When this switch is provided, sqlmap will try to test and exploit two different NULL connection techniques: Range and HEAD.
If any of these is supported by the target web server, speed up will come from the obvious saving of used bandwidth.
Remark: incompatible with --text-only.">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<!-- --http2 -->
<label class="form-group" for="http2">
<div class="checkbox-label">
<input type="checkbox" id="http2">
<b>USE HTTP2 CONNECTIONS</b>
<u>--http2</u><i tooltip="Connection optimization - Use HTTP version 2 (experimental).">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<h3>Proxy Options</h3>
<!-- --proxy -->
<label class="form-group" for="proxy">
<div class="form-label">HTTP(S) PROXY<i tooltip="Use a proxy to connect to the target URL.">ⁱ</i></div>
<div class="form-label"><u>--proxy</u></div>
<input type="text" id="proxy" class="form-control" placeholder="http://127.0.0.1:8080">
</label>
<!-- --proxy-cred -->
<label class="form-group" for="proxyCred">
<div class="form-label">HTTP(S) PROXY CREDENTIAL<i tooltip="If the HTTP(S) proxy requires authentication, you can provide the credentials in the format username:password to the option --proxy-cred.">ⁱ</i></div>
<div class="form-label"><u>--proxy-cred</u></div>
<input type="text" id="proxyCred" class="form-control" placeholder="username:password">
</label>
<!-- --proxy-file -->
<label class="form-group" for="proxyFile">
<div class="form-label">HTTP(S) PROXY FILE<i tooltip="Use a proxy to connect to the target URL.">ⁱ</i></div>
<div class="form-label"><u>--proxy-file</u></div>
<input type="text" id="proxyFile" class="form-control" placeholder="proxy-file.txt">
</label>
<!-- --proxy-freq -->
<label class="form-group" for="proxyFreq">
<div class="form-label">PROXY ROTATION NUMBER<i tooltip="Requests between change of proxy from a given --proxy-file list.">ⁱ</i></div>
<div class="form-label"><u>--proxy-freq</u></div>
<input type="number" id="proxyFreq" class="form-control" min="1" step="1" placeholder="3">
</label>
<!-- --ignore-proxy -->
<label class="form-group">
<div class="checkbox-label" for="proxyIgnore">
<input type="checkbox" id="proxyIgnore">
<b>IGNORE SYSTEM PROXY SETTINGS</b>
<u>--ignore-proxy</u><i tooltip="Run sqlmap against a target part of a local area network by ignoring the system-wide set HTTP(S) proxy server setting.">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<div class="form-group">
<span class="form-label checkbox-grid">TOR ANONYMITY NETWORK SETTINGS</span>
<div class="checkbox-grid">
<!-- --tor -->
<label class="checkbox-label" for="tor">
<input type="checkbox" id="tor">
<u>--tor</u><i tooltip="If, for any reason, you need to stay anonymous, instead of passing by a single predefined HTTP(S) proxy server, you can configure a Tor client together with Privoxy (or similar) on your machine as explained in Tor installation guides.
Then you can use a switch --tor and sqlmap will try to automatically set Tor proxy connection settings.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --check-tor -->
<label class="checkbox-label" for="checkTor">
<input type="checkbox" id="checkTor">
<b></b>
<u>--check-tor</u><i tooltip="You are strongly advised to use --check-tor occasionally to be sure that everything was set up properly.
With --check-tor sqlmap will check if everything works as expected by sending a single request to an official 'Are you using Tor?' page before any target requests.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- --tor-port -->
<label class="form-group" for="torPort">
<div class="form-label">TOR PROXY PORT<i tooltip="In case that you want to manually set the port of used Tor proxy.">ⁱ</i></div>
<div class="form-label"><u>--tor-port</u></div>
<input type="number" id="torPort" class="form-control" min="1" max="65535" placeholder="9050">
</label>
<!-- --tor-type -->
<label class="form-group" for="torType">
<div class="form-label">TOR PROXY TYPE<i tooltip="In case that you want to manually set the type of used Tor proxy.">ⁱ</i></div>
<div class="form-label"><u>--tor-type</u></div>
<select id="torType" class="form-control">
<option value="">-- Choose Type --</option>
<option value="SOCKS5">SOCKS5 (default)</option>
<option value="SOCKS4">SOCKS4</option>
<option value="HTTP">HTTP</option>
</select>
</label>
</div>
</div>
</div>
</div>
<!-- REQUEST Tab -->
<div class="tab-content" id="request">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Request Data</h3>
<!-- --method -->
<label class="form-group" for="method">
<div class="form-label">HTTP REQUEST METHOD<i tooltip="Force usage of given HTTP method (e.g. PUT).">ⁱ</i></div>
<div class="form-label"><u>--method</u></div>
<select id="method" class="form-control">
<option value="">-- Choose HTTP Method --</option>
<option value="GET">GET</option>
<option value="POST">POST</option>
<option value="PUT">PUT</option>
<option value="DELETE">DELETE</option>
<option value="HEAD">HEAD</option>
<option value="OPTIONS">OPTIONS</option>
<option value="PATCH">PATCH</option>
<option value="custom">--Custom--</option>
</select>
<div class="form-group" id="customHttpMethodGroup" style="display: none">
<input type="text" id="customHttpMethod" class="form-control" placeholder="Custom HTTP method value">
</div>
</label>
<!-- --param-del -->
<label class="form-group" for="paramDel">
<div class="form-label">PARAMETER DELIMITER<i tooltip="There are cases when default parameter delimiter (&) needs to be overwritten for sqlmap to be able to properly split and process each parameter separately, e.g.:
query=foobar;id=1 instead query=foobar&id=1">ⁱ</i></div>
<div class="form-label"><u>--param-del</u></div>
<input type="text" id="paramDel" class="form-control" placeholder="&">
</label>
<!-- -r -->
<label class="form-group" for="requestFile">
<div class="form-label">FILE WITH AN HTTP REQUEST<i tooltip="Load HTTP request from a file">ⁱ</i></div>
<div class="form-label"><u>-r</u></div>
<input type="text" id="requestFile" class="form-control" placeholder="request.txt">
</label>
<!-- --eval -->
<label class="form-group" for="eval">
<div class="form-label">PYTHON CODE TO EVALUATE<i tooltip="Evaluate custom Python code before each request and use its output to modify parameters or payloads.
Perfect for dynamic payload generation, custom hashing, encoding, or manipulating request data on the fly.
">ⁱ</i></div>
<div class="form-label"><u>-r</u></div>
<input type="text" id="eval" class="form-control" placeholder="from flask_unsign import session as s; session = s.sign({'uid': session}, secret='SecretExfilratedFromTheMachine')">
</label>
<!-- --data -->
<label class="form-group" for="data">
<div class="form-label">HTTP BODY DATA<i tooltip="By default the HTTP method used to perform HTTP requests is GET, but you can implicitly change it to POST by providing the data to be sent in the POST requests.
Such data, being those parameters, are tested for SQL injection as well as any provided GET parameters.">ⁱ</i></div>
<div class="form-label"><u>--data</u></div>
<textarea id="data" class="form-control" rows="4" placeholder="param1=value1¶m2=value2"></textarea>
</label>
</label>
<h3>Request Headers</h3>
<!-- --host -->
<label class="form-group" for="host">
<div class="form-label">CUSTOM HTTP HOST HEADER<i tooltip="You can manually set HTTP Host header value.
By default HTTP Host header is parsed from a provided target URL.
Note that also the HTTP Host header is tested against SQL injection if the --level is set to 5.">ⁱ</i></div>
<div class="form-label"><u>--host</u></div>
<input type="text" id="host" class="form-control" placeholder="example.com">
</label>
<!-- -A / --random-agent / --mobile -->
<label class="form-group" for="userAgent">
<div class="form-label">USER-AGENT HEADER VALUE<i tooltip="By default sqlmap performs HTTP requests with the "sqlmap/1.0-dev-x (http://sqlmap.org)" User-Agent header, but it can changed with the option -A.
Moreover, by providing the switch --random-agent, sqlmap will randomly select a User-Agent from the ./txt/user-agents.txt textual file and use it for all HTTP requests within the session.
Some sites perform a server-side check of HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system.
Sometimes web servers expose different interfaces toward mobile phones than to desktop computers.
In such cases you can enforce usage of one of predetermined smartphone HTTP User-Agent header values by using a --mobile switch (sqlmap will ask you to pick one of popular smartphones which it will imitate in current run).
Note that also the HTTP User-Agent header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></div>
<div class="form-label"><u>--mobile / --random-agent / -A</u></div>
<select id="userAgent" class="form-control">
<option value="">Default: sqlmap/1.0-dev-x (http://sqlmap.org)</option>
<option value="mobile">--mobile</option>
<option value="random">--random-agent</option>
<option value="custom">--Custom--</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for macOS</option>
<option value="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Linux</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPad</option>
<option value="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36">Google Chrome 137 for Android</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Microsoft Edge 137 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.3296.68">Microsoft Edge 137 macOS</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 EdgiOS/137.3296.65 Mobile/15E148 Safari/605.1.15">Microsoft Edge 137 for iOS</option>
<option value="Mozilla/5.0 (Linux; Android 10; HD1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36 EdgA/137.0.3296.53">Microsoft Edge 137 for Android</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15">Apple Safari 18.4 for macOS</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPad</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for macOS</option>
<option value="Mozilla/5.0 (X11; Linux i686; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Linux</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPad</option>
<option value="Mozilla/5.0 (Android 15; Mobile; rv:139.0) Gecko/139.0 Firefox/139.0">Firefox 139 for Android</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/119.0.0.0">Opera for Windows</option>
<option value="Mozilla/5.0 (Linux; Android 15; Pixel 8 Pro Build/AP4A.250205.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.39 Mobile Safari/537.36 THDConsumer/7.45 (Android 15; Pixel 8 Pro) DID:84d0d3e3907e6ea1">Android 15 WebView for Pixel 8 Pro</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 [FBAN/FBIOS;FBAV/507.0.0.58.94;FBBV/716584418;FBDV/iPhone17,4;FBMD/iPhone;FBSN/iOS;FBSV/18.3.2;FBSS/3;FBID/phone;FBLC/en_US;FBOP/5;FBRV/719878764;IABMV/1]">Facebook App for iOS 18.3.2</option>
<option value="Mozilla/5.0 (Linux; Android 14; SM-A137F Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.135 Mobile Safari/537.36 [FBAN/EMA;FBLC/sk_SK;FBAV/451.0.0.9.108;FB_FW/1;FBDM/DisplayMetrics{density=2.8125, width=1080, height=2301,2.8125, xdpi=403.411, ydpi=399.759};]">Facebook App for Android 14</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 Instagram 344.0.9.27.90 (iPhone15,4; iOS 18_3_2; en_US; en; scale=3.00; 1179x2556; 631222391) NW/3">Instagram App for iOS 18.3.2</option>
<option value="Mozilla/5.0 (Linux; Android 14; SM-S906U Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/135.0.7049.38 Mobile Safari/537.36 Instagram 374.0.0.43.67 Android (34/14; 480dpi; 1080x2122; samsung; SM-S906U; g0q; qcom; en_US; 715888958; IABMV/1)">Instagram App for Android 14</option>
</select>
<div class="form-group" id="customUserAgentGroup" style="display: none;">
<input type="text" id="customUserAgent" class="form-control" placeholder="Custom User Agent value">
</div>
</label>
<!-- --referer -->
<label class="form-group" for="referer">
<div class="form-label">HTTP REFERER HEADER<i tooltip="By default no HTTP Referer header is sent in HTTP requests if not explicitly set by the --referer switch.
Note that also the HTTP Referer header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></div>
<div class="form-label"><u>--referer</u></div>
<input type="url" id="referer" class="form-control" placeholder="https://127.0.0.1/login">
</label>
<!-- -headers -->
<label class="form-group" for="headers">
<div class="form-label">EXTRA HTTP HEADERS<i tooltip="Extra HTTP headers separated by a newline.">ⁱ</i></div>
<div class="form-label"><u>--headers</u></div>
<textarea id="headers" class="form-control" rows="4" placeholder="X-Forwarded-For: 127.0.0.1 Authorization: Bearer token"></textarea>
</label>
<h3>Authentication</h3>
<!-- --cookie -->
<label class="form-group" for="cookie">
<div class="form-label">COOKIE VALUE<i tooltip="HTTP Cookie header value for authentication (and for exploitation if the --level is set to 2 or above).
If you provide a HTTP Cookie header with option --cookie and the target URL sends an HTTP Set-Cookie header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.
See also: --drop-set-cookie">ⁱ</i></div>
<div class="form-label"><u>--cookie</u></div>
<input id="cookie" class="form-control" placeholder="PHPSESSID=abc123; userid=1"></input>
</label>
<!-- --cookie-del -->
<label class="form-group" for="cookieDel">
<div class="form-label">COOKIE DELIMITER<i tooltip="The HTTP Cookie header values are usually separated by a ; character, not by an &.
Sqlmap can recognize these as separate sets of parameter=value too, as well as GET and POST parameters.
In case that the separation character is other than ; it can be specified by using option --cookie-del">ⁱ</i></div>
<div class="form-label"><u>--cookie-del</u></div>
<input type="text" id="cookieDel" class="form-control" placeholder=";">
</label>
<!-- --live-cookies -->
<label class="form-group" for="cookieLive">
<div class="form-label">LIVE COOKIES FILE<i tooltip="Option --live-cookies can be used to provide a cookies file which will be used for loading of up-to-date values.
This means that that same file will be read prior to each request to get the latest value for HTTP Cookie header. It should point to a file with fresh/up-to-date cookie values.
Trick is that once you delete its content, sqlmap immediately will stop and wait for the update of its content. Same applies if you just modify its content in-place.You can do this indefinitely number of times during a run.
In your case, you can just run sqlmap in one terminal with --live-cookies pointing to a file containing starting cookie value, while in another terminal you can do a periodic deletion and filling of that same file.">ⁱ</i></div>
<div class="form-label"><u>--live-cookies</u></div>
<input type="text" id="cookieLive" class="form-control" placeholder="live-cookies.txt">
</label>
<!-- --load-cookies -->
<label class="form-group" for="cookieLoad">
<div class="form-label">RAW COOKIE FILE<i tooltip="An option --load-cookies can be used to provide a special file containing Netscape/wget formatted cookies.
This format includes not only cookie names and values but also their domains, paths, expiry, and security attributes.
Unlike the --cookie or -H options which requires to manually enter raw cookie strings, the --load-cookies reads structures cookie data, which can help fully replicate a browser session.">ⁱ</i></div>
<div class="form-label"><u>--load-cookies</u></div>
<input type="text" id="cookieLoad" class="form-control" placeholder="load-cookies.txt">
</label>
<!-- --drop-set-cookie -->
<label class="form-group">
<div class="checkbox-label" for="cookieDrop">
<input type="checkbox" id="cookieDrop">
<b>IGNORE Set-Cookie HEADER</b>
<u>--drop-set-cookie</u><i tooltip="If the web application responds with Set-Cookie headers, sqlmap will automatically use its value in all further HTTP requests as the Cookie header. Sqlmap will also automatically test those values for SQL injection.
This can be avoided by providing the switch --drop-set-cookie.
Therefore, an sqlmap will ignore any coming Set-Cookie header.">ⁱ</i>
<span class="checkmark"></span>
</div>
</label>
<div></div>
<!-- --auth-type/--auth-cred -->
<label class="form-group" for="authType">
<div class="form-label">HTTP PROTOCOL AUTHENTICATION<i tooltip="These options can be used to specify which HTTP protocol authentication back-end web server implements and the valid credentials to be used to perform all HTTP requests to the target application.">ⁱ</i></div>
<div class="form-label"><u>--auth-type / --auth-cred</u></div>
<select id="authType" class="form-control">
<option value="">-- Choose auth method --</option>
<option value="Basic">Basic</option>
<option value="Digest">Digest</option>
<option value="NTLM">NTLM</option>
</select>
<div class="form-group">
<input type="text" id="authCred" class="form-control" placeholder="username:password">
</div>
</label>
<!-- --auth-file -->
<label class="form-group" for="authFile">
<div class="form-label">PRIVATE KEY AUTHENTICATION<i tooltip="This option should be used in cases when the web server requires proper client-side certificate and a private key for authentication.
Supplied value should be a PEM formatted key_file that contains your certificate and a private key.">ⁱ</i></div>
<div class="form-label"><u>--auth-file</u></div>
<input type="text" id="authFile" class="form-control" placeholder="auth_file.key">
</label>
<h3>CSRF Tokens Control</h3>
<!-- --csrf-url -->
<label class="form-group" for="csrfUrl">
<div class="form-label">TOKEN EXTRACTION URL<i tooltip="Option --csrf-url can be used for retrieval of the token value from arbitrary URL address.
This is useful if the vulnerable target URL doesn't contain the necessary token value in the first place, but it is required to extract it from some other location.">ⁱ</i></div>
<div class="form-label"><u>--csrf-url</u></div>
<input type="url" id="csrfUrl" class="form-control" placeholder="https://example.com/profile/">
</label>
<!-- --csrf-method -->
<label class="form-group" for="csrfMethod">
<div class="form-label">HTTP METHOD FOR TOKEN RETRIEVAL<i tooltip="HTTP method for token extraction.">ⁱ</i></div>
<div class="form-label"><u>--csrf-method</u></div>
<select id="csrfMethod" class="form-control">
<option value="">-- Choose HTTP method --</option>
<option value="GET">GET</option>
<option value="POST">POST</option>
<option value="PUT">PUT</option>
<option value="DELETE">DELETE</option>
<option value="HEAD">HEAD</option>
<option value="OPTIONS">OPTIONS</option>
<option value="PATCH">PATCH</option>
<option value="custom">--Custom--</option>
</select>
<div class="form-group" id="customCsrfMethodGroup">
<input type="text" id="customCsrfMethod" class="form-control" placeholder="">
</div>
</label>
<!-- --csrf-data -->
<label class="form-group" for="csrfData">
<div class="form-label">TOKEN EXTRACTION DATA<i tooltip="Send this POST data when sqlmap visits the anti-CSRF token URL to retrieve a new token.
Use together with --csrf-url for applications that require a POST request to generate or refresh the CSRF token, ensuring your scans stay authenticated and valid.
">ⁱ</i></div>
<div class="form-label"><u>--csrf-data</u></div>
<input type="text" id="csrfData" class="form-control" placeholder="anticsrf=KvWS8aJQ&action=show">
</label>
<!-- --csrf-token -->
<label class="form-group" for="csrfToken">
<div class="form-label">ANTI-CSRF TOKEN FIELD<i tooltip="Option --csrf-token can be used to set the name of the hidden value that contains the randomized token.
This is useful in cases when web sites use non-standard names for such fields.">ⁱ</i></div>
<div class="form-label"><u>--csrf-token</u></div>
<input type="text" id="csrfToken" class="form-control" placeholder="anti-csrf">
</label>
<!-- --csrf-retries -->
<label class="form-group" for="csrfRetries">
<div class="form-label" >RETRIES DURING TOKEN RETRIEVAL<i tooltip="Retries for anti-CSRF token retrieval.
Default: 0">ⁱ</i></div>
<div class="form-label"><u>--csrf-retries</u></div>
<input type="number" id="csrfRetries" class="form-control" placeholder="0" min="0" step="1">
</label>
<h3>Safe Requests</h3>
<!-- safe-url -->
<label class="form-group" for="safeUrl">
<div class="form-label">SAFE REQUEST URL<i tooltip="Visit the specified URL regularly during scanning to keep your session alive or prevent automatic logouts.
Sqlmap will visit this safe URL between requests to maintain access while testing.
Useful for applications with aggressive session timeouts or login expirations.
You can send specific data to this request with --safe-post.
">ⁱ</i></div>
<div class="form-label"><u>--safe-url</u></div>
<input type="url" id="safeUrl" class="form-control" placeholder="https://example.com/login">
</label>
<!-- --safe-post -->
<label class="form-group" for="safePost">
<div class="form-label">SAFE REQUEST DATA<i tooltip="Send this custom POST data to the safe URL during session keep-alive requests.
Ideal when your application requires a specific POST body to refresh a session or simulate a real user action while maintaining authentication during a scan.
You should specify a URL using the --safe-url switch.
">ⁱ</i></div>
<div class="form-label"><u>--safe-post</u></div>
<input type="text" id="safePost" class="form-control" placeholder="login=admin&password=letmein">
</label>
<!-- --safe-req -->
<label class="form-group" for="safeReq">
<div class="form-label">FILE WITH A SAFE REQUEST<i tooltip="Use a complete HTTP request from a file as the safe URL visit to keep your session active.
Great for complex authentication flows or when you need to replay a real request with headers, cookies, or big chunk of POST data to prevent timeouts and maintain access while scanning.
">ⁱ</i></div>
<div class="form-label"><u>--safe-req</u></div>
<input type="text" id="safeReq" class="form-control" placeholder="safe-request-file.txt">
</label>
<!-- --safe-freq -->
<label class="form-group" for="safeFreq">
<div class="form-label">SAFE REQUEST FREQUENCY<i tooltip="Set how many injection requests sqlmap sends before each visit to the safe URL.
For example, --safe-freq=5 means send 5 attack requests, then automatically hit your safe URL once to refresh session state.
Adjust this number based on session timeout: smaller values for fast-expiring sessions, larger for more speed-focused scans.
Use it together with --safe-url, --safe-post or --safe-req to balance attack speed and session maintenance.
">ⁱ</i></div>
<div class="form-label"><u>--safe-freq</u></div>
<input type="number" id="safeFreq" class="form-control" placeholder="5">
</label>
</div>
</div>
</div>
</div>
<!-- INJECTION Tab -->
<div class="tab-content" id="injection">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Parameters</h3>
<!-- -p -->
<label class="form-group" for="paramTest">
<div class="form-label" >TESTABLE PARAMETERS<i tooltip="Comma separated parameters for testing. By default sqlmap tests all GET parameters and POST parameters.
When the value of --level is >= 2 it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections.
It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on value of --level too.
For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p "id,user-agent".">ⁱ</i></div>
<div class="form-label" for="paramTest"><u>-p</u></div>
<input type="text" id="paramTest" class="form-control" placeholder="id,user-agent">
</label>
<!-- --skip -->
<label class="form-group" for="paramSkip">
<div class="form-label" >FORBIDDEN PARAMETERS<i tooltip="Skip testing for given parameter(s). That is especially useful in cases when you want to use higher value for --level and test all available parameters excluding some of HTTP headers normally being tested.
For instance, to skip testing for HTTP header User-Agent and HTTP header Referer at --level=5, provide --skip="user-agent,referer".">ⁱ</i></div>
<div class="form-label" for="paramSkip"><u>--skip</u></div>
<input type="text" id="paramSkip" class="form-control" placeholder="csrf_token,session_id">
</label>
<!-- --param-exclude -->
<label class="form-group" for="paramExclude">
<div class="form-label">FORBIDDEN PARAMETERS REGEX<i tooltip="Skip testing for given parameter(s). This is the same as --skip, but this switch is based on a regular expressions.
For instance, to skip testing for parameters which contain string token or session in their names, provide --param-exclude="token|session"">ⁱ</i></div>
<div class="form-label"><u>--param-exclude</u></div>
<input type="text" id="paramExclude" class="form-control" placeholder="token|session">
</label>
<!-- --param-filter -->
<label class="form-group" for="paramFilter">
<div class="form-label">PARAMETERS SCAN CATEGORY ALLOWLIST<i tooltip="The --param-filter parameter restrict scans to specific components of HTTP requests, improving efficiency and reducing noise.
Accepted comma-separated values include GET (URL parameters), POST (request body), COOKIE, HOST, USER-AGENT, and REFERER.
This switch can isolate high-risk areas like API endpoints (test only POST body parameters) or speed-up headers injection testing (specifying COOKIE,HOST,USER-AGENT,REFERER filter with --level=5 focuses scans on headers, ignoring GET/POST parameters).
The filter reduces scan times by 30-40% in header-rich environments and minimizes false positives from unnecessary parameters.">ⁱ</i></div>
<div class="form-label"><u>--param-filter</u></div>
<input type="text" id="paramFilter" class="form-control" placeholder="GET,POST,COOKIE,USER-AGENT...">
</label>
<!-- --prefix -->
<label class="form-group" for="prefix">
<div class="form-label">PREFIX TO PREPEND<i tooltip="The --prefix parameter allows you to prepend a custom string to every SQL injection payload before it is sent to the target application.
This parameter is essential when applications require specific SQL syntax or characters before the actual injection payload to construct a valid query.
It is particularly useful when dealing with applications that embed parameters within complex SQL queries requiring specific opening syntax, such as closing quotes or parentheses before the injection point.">ⁱ</i></div>
<div class="form-label"><u>--prefix</u></div>
<input type="text" id="prefix" class="form-control" placeholder="')">
</label>
<!-- --suffix -->
<label class="form-group" for="suffix">
<div class="form-label">SUFFIX TO APPEND<i tooltip="The --suffix parameter enables you to append a custom string to every SQL injection payload after the main injection code.
It is crucial when applications require specific closing characters or comments to prevent SQL syntax errors, such as SQL comments (--) or closing parentheses to maintain query validity.">ⁱ</i></div>
<div class="form-label"><u>--suffix</u></div>
<input type="text" id="suffix" class="form-control" placeholder="-- -">
</label>
<!-- --randomize -->
<label class="form-group" for="randomize">
<div class="form-label">PARAMETER(S) WITH RANDOM VALUE(S)<i tooltip="Randomly change the value of the specified parameter(s) on each request.
Great for avoiding caching, WAF tracking, or when you want each request to look unique. Useful for scanning parameters that the app or security device ignores unless they change on every request.
">ⁱ</i></div>
<div class="form-label"><u>--randomize</u></div>
<input type="number" id="randomize" class="form-control" placeholder="tracking">
</label>
<h3>Detection</h3>
<div class="form-group grid-row-span-3">
<span class="form-label checkbox-grid">DETECTION TECHNIQUES</span>
<div class="checkbox-grid">
<!-- --titles -->
<label class="checkbox-label" for="titles">
<input type="checkbox" id="titles">
<u>--titles</u><i tooltip="Compare only the <title> tag of each page when checking for SQL injection differences, instead of analyzing the full page content.
Great for web apps where the page content changes a lot but the title reflects the true application state—useful for noisy apps, dynamic pages, or when other detection methods are unreliable.
Turn on when you knows that the distinction of a True query from a False one can be done using HTML title (e.g. "Welcome" for True and "Forbidden" for False).
">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --text-only -->
<label class="checkbox-label" for="textOnly">
<input type="checkbox" id="textOnly">
<u>--text-only</u><i tooltip="Compare only the textual content of each page (stripped of HTML tags) to detect SQL injection, ignoring markup and scripts.
Useful when HTML layout or scripts change on every request, but the actual text on the page is what matters for detection—helps reduce false positives on dynamic sites.
This way, in a good number of cases, you can automatically tune the detection engine.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --ignore-redirects -->
<label class="checkbox-label" for="ignoreRedirects">
<input type="checkbox" id="ignoreRedirects">
<u>--ignore-redirects</u><i tooltip="Ignore HTTP redirects and treat redirection responses as normal results, without following them.
Useful for endpoints that always redirect, when redirects interfere with scanning, or if you want sqlmap to process only the original response without chasing further URLs.
">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --ignore-timeouts -->
<label class="checkbox-label" for="ignoreTimeouts">
<input type="checkbox" id="ignoreTimeouts">
<u>--ignore-timeouts</u><i tooltip="Ignore time out requests and continue scanning as if nothing happened.
Perfect for unstable or slow targets, letting sqlmap complete scans without interruption from occasional network issues or delayed server responses.
">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- --string -->
<label class="form-group" for="string">
<div class="form-label">TRUE DETECTION STRING<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--string</u></div>
<input type="text" id="string" class="form-control" placeholder="">
</label>
<!-- --regexp-->
<label class="form-group" for="regexp">
<div class="form-label">TRUE DETECTION REGEXP<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--regexp</u></div>
<input type="text" id="regexp" class="form-control" placeholder="">
</label>
<!-- --not-string -->
<label class="form-group" for="notString">
<div class="form-label">FALSE DETECTION STRING<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--not-string</u></div>
<input type="text" id="notString" class="form-control" placeholder="">
</label>
<!-- --code -->
<label class="form-group" for="code">
<div class="form-label">EXPECTED HTTP CODE<i tooltip="Use this in cases when you know that the distinction of a True query from a False one can be done using HTTP code.">ⁱ</i></div>
<div class="form-label"><u>--code</u></div>
<input type="number" id="code" class="form-control" min="100", max="599", step="1" placeholder="201">
</label>
<!-- --abort-code -->
<label class="form-group" for="abortCode">
<div class="form-label">STOP SCAN ON THIS HTTP STATUS CODE<i tooltip="Abort testing when the specified HTTP status code (like 403 or 500) appears in the response.
Use this to stop scans automatically if you trigger a block, web application firewall or major server error. Great for avoiding account lockouts or when you want fast feedback if the application changes its behavior during the scan.">ⁱ</i></div>
<div class="form-label"><u>--abort-code</u></div>
<input type="number" id="abortCode" min="100" max="599" class="form-control" placeholder="500">
</label>
<!-- --ignore-code -->
<label class="form-group" for="ignoreCode">
<div class="form-label">STOP SCAN ON THIS HTTP STATUS CODE<i tooltip="Ignore HTTP responses with the specified status code(s), like 401, 404, or 500.
Use this to skip over noisy or irrelevant errors so your scan focuses on valuable responses.
Remark: what the help suggests, wildcards like * or 4* are not supported—only a comma-separated list of integer codes will work.
">ⁱ</i></div>
<div class="form-label"><u>--ignore-code</u></div>
<input type="number" id="ignoreCode" min="100" max="599" class="form-control" placeholder="500">
</label>
<!-- --retries -->
<label class="form-group" for="retries">
<div class="form-label">MAX NUMBER OF RETRIES<i tooltip="Set how many times sqlmap should retry a request after a connection timeout.
Increase for unstable or slow networks to improve scan reliability, or decrease for faster scans if connection issues are rare.
Default: 3.
">ⁱ</i></div>
<div class="form-label"><u>--retries</u></div>
<input type="number" id="retries" class="form-control" placeholder="3">
</label>
<!-- --retry-on -->
<label class="form-group" for="retryOn">
<div class="form-label">RETRY ON CONTENT REGEXP<i tooltip="Retry the request if the response body matches the given regular expression.
Perfect for skipping over temporary issues, like 'Service Unavailable' or anti-bot messages—use this to keep your scan going if you hit intermittent errors or protections that show specific content in their response.
">ⁱ</i></div>
<div class="form-label"><u>--retry-on</u></div>
<input type="number" id="retryOn" class="form-control" placeholder="(?i)error|unavailable">
</label>
<h3>Attack Optimalization</h3>
<!-- --level -->
<label class="form-group grid-column-span-2" for="level">
<div class="form-label">ATTACK <u>--level</u> <span id="levelValue">1</span></div>
<input type="range" id="level" class="slider" min="1" max="5" value="1">
<div class="additional-help" id="level-help">1: Show also information and warning messages (default).</div>
</label>
<!-- --risk -->
<label class="form-group grid-column-span-2" for="risk">
<div class="form-label">ATTACK <u>--risk</u> <span id="riskValue">1</span></div>
<input type="range" id="risk" class="slider" min="1" max="3" value="1">
<div class="additional-help" id="risk-help">1: Innocuous test for the majority of SQL injection points (default).</div>
</label>
<!-- Attack techniques -->
<div class="form-group grid-row-span-2">
<span class="form-label checkbox-grid">ATTACK TECHNIQUES</span>
<div class="checkbox-grid">
<label class="checkbox-label" for="techB">
<input type="checkbox" id="techB" value="B">
<u>Boolean-based blind (B)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techE">
<input type="checkbox" id="techE" value="E">
<u>Error-based (E)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techU">
<input type="checkbox" id="techU" value="U">
<u>Union query-based (U)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techS">
<input type="checkbox" id="techS" value="S">
<u>Stacked queries (S)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techT">
<input type="checkbox" id="techT" value="T">
<u>Time-based blind (T)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techQ">
<input type="checkbox" id="techQ" value="Q">
<u>Inline queries (Q)</u>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- Attack tuning -->
<div class="form-group grid-row-span-2">
<span class="form-label checkbox-grid">ATTACK TUNING</span>
<div class="checkbox-grid">
<!-- --invalid-bignum -->
<label class="checkbox-label" for="invalidBignum">
<input type="checkbox" id="invalidBignum">
<u>--invalid-bignum</u><i tooltip="This parameter forces sqlmap to use large integer numbers for invalidating original parameter values during SQL injection tests.
Instead of standard invalidation methods (e.g., negative values), sqlmap replaces original values with very large numbers, which can bypass application filters that block typical techniques.
It is particularly useful when applications filter standard parameter invalidation methods but may not properly handle extremely large numeric values.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --invalid-logical -->
<label class="checkbox-label" for="invalidLogical">
<input type="checkbox" id="invalidLogical">
<u>--invalid-logical</u><i tooltip="The switch enables the use of logical operations to invalidate parameter values.
Sqlmap replaces original values with logical expressions that always return false (e.g., id=(1=0)).
This method is effective when applications expect logical values or block other invalidation techniques.
The parameter serves as an alternative for standard invalidation methods in environments with advanced filtering mechanisms.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --invalid-string -->
<label class="checkbox-label" for="invalidString">
<input type="checkbox" id="invalidString">
<u>--invalid-string</u><i tooltip="This parameter causes sqlmap to use random character strings for parameter value invalidation. Sqlmap generates random strings instead of original values, bypassing application filters focused on numeric values.
It is useful when applications have special validation mechanisms for numbers but do not check string inputs.
The parameter automatically replaces parameters with random strings during boolean-based injection tests.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --no-cast -->
<label class="checkbox-label" for="noCast">
<input type="checkbox" id="noCast">
<u>--no-cast</u><i tooltip="The switch disables sqlmap's automatic payload casting mechanism.
Normally sqlmap adds CAST() functions to payloads for handling different DBMS data types.
Using --no-cast is necessary when applications have payload length restrictions or when casting functions are blocked by WAF.
It significantly reduces the size of generated payloads, which is critical in environments with character limits.
It is often combined with --no-escape in environments with query length restrictions where every character matters.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --no-escape -->
<label class="checkbox-label" for="noEscape">
<input type="checkbox" id="noEscape">
<u>--no-escape</u><i tooltip="This parameter disables sqlmap's built-in string escaping mechanism.
By default sqlmap automatically escapes special characters in payloads (adds backslash before apostrophes). This switch is useful when applications have their own escaping mechanisms or when automatic escaping breaks payloads.
It is often combined with --no-cast in environments with query length restrictions where every character matters.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --predict-output -->
<label class="checkbox-label" for="predictOutput">
<input type="checkbox" id="predictOutput">
<u>--predict-output</u><i tooltip="The switch enables a statistical algorithm for predicting query results in inference techniques.
Sqlmap builds statistical tables of most probable character values based on the txt/common-outputs.txt file and current enumeration knowledge.
It significantly speeds up data retrieval when values belong to common patterns (system table names, privileges).
The parameter is not compatible with --threads and works best when retrieving standard DBMS entities.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --skip-urlencode -->
<label class="checkbox-label" for="skipUrlencode">
<input type="checkbox" id="skipUrlencode">
<u>--skip-urlencode</u><i tooltip="Send payload data without URL encoding.
Useful for debugging, custom encoding schemes, or when the target expects raw input.
Use with caution — most apps require URL-encoded data, so skipping encoding can cause requests to fail or be misinterpreted.
">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --chunked -->
<label class="checkbox-label" for="chunked">
<input type="checkbox" id="chunked">
<u>--chunked</u><i tooltip="Use HTTP Parameter Pollution (HPP) by sending multiple instances of the same parameter in requests.
Great for testing if the web app or backend handles duplicate parameters insecurely—can help bypass filters, trigger edge-case bugs, or discover hidden vulnerabilities that appear only when parameters are polluted.
">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --hpp -->
<label class="checkbox-label" for="hpp">
<input type="checkbox" id="hpp">
<u>--hpp</u><i tooltip="Send POST requests using HTTP chunked transfer encoding instead of a standard Content-Length.
Useful for bypassing WAFs, filters, or edge devices that mishandle or ignore chunked requests.
Try this if standard POSTs are blocked or behave differently.
">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- --dbms -->
<label class="form-group" for="dbms">
<div class="form-label">FORCE TARGET DATABASE ENGINE<i tooltip="Greatly reduces scan time by minimalizing number of requests, using payloads appropriate only for the selected database engine.">ⁱ</i></div>
<div class="form-label"><u>--dbms</u></div>
<select id="dbms" class="form-control">
<option value="">Auto-detect</option>
<option value="MySQL">MySQL</option>
<option value="Oracle">Oracle</option>
<option value="PostgreSQL">PostgreSQL</option>
<option value="Microsoft SQL Server">Microsoft SQL Server</option>
<option value="Microsoft Access">Microsoft Access</option>
<option value="IBM DB2">IBM DB2</option>
<option value="SQLite">SQLite</option>
<option value="Firebird">Firebird</option>
<option value="Sybase">Sybase</option>
<option value="SAP MaxDB">SAP MaxDB</option>
<option value="Informix">Informix</option>
<option value="MariaDB">MariaDB</option>
<option value="Percona">Percona</option>
<option value="MemSQL">MemSQL</option>
<option value="TiDB">TiDB</option>
<option value="CockroachDB">CockroachDB</option>
<option value="HSQLDB">HSQLDB</option>
<option value="H2">H2</option>
<option value="MonetDB">MonetDB</option>
<option value="Apache Derby">Apache Derby</option>
<option value="Amazon Redshift">Amazon Redshift</option>
<option value="Vertica">Vertica</option>
<option value="Mckoi">Mckoi</option>
<option value="Presto">Presto</option>
<option value="Altibase">Altibase</option>
<option value="MimerSQL">MimerSQL</option>
<option value="CrateDB">CrateDB</option>
<option value="Greenplum">Greenplum</option>
<option value="Drizzle">Drizzle</option>
<option value="Apache Ignite">Apache Ignite</option>
<option value="Cubrid">Cubrid</option>
<option value="InterSystems Cache">InterSystems Cache</option>