sqlmap_scan
Test a URL for SQL injection vulnerabilities using SQLMap. Identify vulnerable parameters and extract database information when authorized.
Instructions
Test a URL for SQL injection vulnerabilities using SQLMap.
SQLMap automates the detection and exploitation of SQL injection flaws. This tool requires explicit authorization — SQL injection testing can cause database errors and potential data exposure.
IMPORTANT: The target URL parameter is named 'url', not 'target'. Always call this tool as: sqlmap_scan(url="http://...", ...)
Args: url: Full target URL including query string to test. MUST be named 'url' (not 'target'). Example: "http://example.com/search?q=test" method: HTTP method: GET or POST. data: POST data string (e.g. "username=admin&password=test"). parameter: Specific parameter to test (e.g. "q" or "username"). If empty, tests all parameters. headers: Additional HTTP headers as a dict (e.g. {"Authorization": "Bearer token"}). Useful for testing authenticated endpoints. level: Detection aggressiveness level (1-5). Default: 1 (safe). Levels 3+ significantly increase request count. risk: Risk of tests (1-3). Default: 1 (safe). Risk 2+ includes boolean-based tests; Risk 3 includes heavy OR-based tests. dbms: Force specific DBMS (e.g. "mysql", "postgresql", "mssql"). Leave empty for auto-detection. technique: SQLi technique(s) to test: B(oolean-blind), E(rror-based), U(nion-query), S(tacked-queries), T(ime-blind), Q(inline-queries). Can be combined: "BT" = boolean + time-blind. Default: all techniques. prefix: Injection prefix string to close the original SQL expression (e.g. "'))" for LIKE expressions like LIKE '%q%')). Crucial for complex injection points that sqlmap can't auto-detect. suffix: Injection suffix string appended after payload (e.g. "--"). tamper: Tamper script name(s) to bypass WAF/filters (e.g. "space2comment", "between,randomcase"). batch: Run in non-interactive batch mode (recommended: True). dump: Dump contents of affected database tables (requires confirmed injection). enum_tables: Enumerate database tables (--tables flag). enum_users: Enumerate database users (--users flag). enum_dbs: Enumerate available databases (--dbs flag). sql_query: Execute a custom SQL SELECT query via the injection point (e.g. "SELECT email,password FROM Users"). Useful when --tables/--dump fail due to JSON response filtering. timeout: Override scan timeout in seconds.
Returns: SQL injection test results including vulnerable parameters, DBMS info, and optionally dumped data or enumerated tables/users/databases.
Note: - Level > 2 or Risk > 2 requires careful consideration — may cause errors. - Target must be in tengu.toml [targets].allowed_hosts. - This tool requires explicit human authorization for exploitation. - dump/enum_* flags require a confirmed injection point.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| data | No | ||
| dbms | No | ||
| dump | No | ||
| risk | No | ||
| batch | No | ||
| level | No | ||
| method | No | GET | |
| prefix | No | ||
| suffix | No | ||
| tamper | No | ||
| headers | No | ||
| timeout | No | ||
| enum_dbs | No | ||
| parameter | No | ||
| sql_query | No | ||
| technique | No | ||
| enum_users | No | ||
| enum_tables | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||