sqlmap.conf

# 必须指定至少其中一个选项来设置源以获取目标URL
[Target]

# 直接连接到数据库.
# Examples:
#   mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME
#   oracle://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_SID
direct = 

# 目标网址
# Example: http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2
url = 

# 从Burp或WebScarab日志解析目标
# 有效: Burp proxy (http://portswigger.net/suite/) 请求日志文件路径
# or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project)
# 'conversations/' 文件夹路径
logFile = 

# 扫描指定文本文件中的多个目标
bulkFile =

# 从文件加载HTTP请求
# Example (file content): POST /login.jsp HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/4.0\n\nuserid=joe&password=guessme
requestFile = 

# 通过Google dork表达式返回目标主机，而不是提供目标网址。 
# 有关Google dorks的列表，请参阅Johnny Long Google Hacking数据库
# http://johnny.ihackstuff.com/ghdb.php.
# Example: +ext:php +inurl:"&id=" +intext:"powered by "
googleDork = 

# 从远程站点地图.xml文件解析目标
# Example: http://192.168.1.121/sitemap.xml
sitemapUrl = 

# 这些选项可用于指定如何连接到目标URL
[Request]

# 强制使用给定的HTTP方法（例如PUT）
method = 

# http数据
# 参数：--data
# 此参数是把数据以POST方式提交，sqlmap会像检测GET参数一样检测POST的参数。
# 例子：
# python sqlmap.py -u "http://www.target.com/vuln.php" --data="id=1" -f --banner --dbs --users
data = 

# 用于分割参数值的字符
paramDel = 

# HTTP Cookie header value
cookie = 

# 用于分割cookie值的字符
cookieDel = 

# 包含Netscape/wget格式的Cookie的文件
loadCookies = 

# HTTP cookie头
# 参数：--cookie,--load-cookies,--drop-set-cookie
# 这个参数在以下两个方面很有用：
# 1、web应用需要登陆的时候。
# 2、你想要在这些头参数中测试SQL注入时。
# 可以通过抓包把cookie获取到，复制出来，然后加到--cookie参数里。
# 在HTTP请求中，遇到Set-Cookie的话，sqlmap会自动获取并且在以后的请求中加入，并且会尝试SQL注入。
# 如果你不想接受Set-Cookie可以使用--drop-set-cookie参数来拒接。
# 当你使用--cookie参数时，当返回一个Set-Cookie头的时候，
# sqlmap会询问你用哪个cookie来继续接下来的请求。
# 当--level的参数设定为2或者2以上的时候，sqlmap会尝试注入Cookie参数。
# Valid: True or False
dropSetCookie = False

# HTTP User-Agent头
# 参数：--user-agent,--random-agent
# 默认情况下sqlmap的HTTP请求头中User-Agent值是：
# sqlmap/1.0-dev-xxxxxxx (http://sqlmap.org)
# 可以使用--user-anget参数来修改，
# 同时也可以使用--random-agnet参数来随机的从./txt/user-agents.txt中获取。
# 当--level参数设定为3或者3以上的时候，会尝试对User-Angent进行注入。
agent =

# 使用随机选择的HTTP User-Agent header值
# Valid: True or False
randomAgent = False

# HTTP Host header value.
host = 

# HTTP Referer header. Useful to fake the HTTP Referer header value at
# HTTP Referer头
参数：--referer
sqlmap可以在请求中伪造HTTP中的referer，当--level参数设定为3或者3以上的时候会尝试对referer注入。
referer = 

# Extra HTTP headers
# # # 额外的HTTP头
# # 参数：--headers
# 可以通过--headers参数来增加额外的http头
headers = Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
 Accept-Language: en-us,en;q=0.5
 Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7

# HTTP验证类型。 
# 仅当目标网址需要HTTP Basic，Digest或NTLM身份验证且您拥有此类数据时才有用.
# Valid: Basic, Digest, NTLM or PKI
authType = 

# HTTP身份验证凭证。 
# 仅当目标网址需要HTTP Basic，Digest或NTLM身份验证且您拥有此类数据时才有用。
# 语法：username：password
authCred = 

# HTTP认证PEM私钥/证书密钥文件。 
# 仅当目标网址需要PKI身份验证且您拥有此类数据时才有用。
语法：key_file
authFile = 

# 忽略HTTP 401 错误（未经授权）
# Valid: True or False
ignore401 = False

# 忽略系统默认代理设置
# Valid: True or False
ignoreProxy = False

# 忽略重定向尝试
# Valid: True or False
ignoreRedirects = False

# 忽略连接超时
# Valid: True or False
ignoreTimeouts = False

# 使用代理连接到目标URL
# Syntax: (http|https|socks4|socks5)://address:port
proxy = 

# 代理认证凭证。
# 仅当代理需要基本或摘要身份验证并且您拥有此类数据时才有用。
# Syntax: username:password
proxyCred =

# 从文件加载代理列表
proxyFile =

# 使用Tor匿名网络
# Valid: True or False
tor = False

# 设置tor的端口，如果不是默认端口的话
# Valid: integer
# torPort =

# 设置Tor代理类型
# Valid: HTTP, SOCKS4, SOCKS5
torType = SOCKS5

# 检查Tor是否可用
# Valid: True or False
checkTor = False

# 每个HTTP请求之间的延迟秒数
# Valid: float
# Default: 0
delay = 0

# 设置超时时间，默认30秒。
# Valid: float
# Default: 30
timeout = 30

# 设置连接超时时重试次数，默认3次
# Valid: integer
# Default: 3
retries = 3

# 随机更改给定参数的值
rParam = 

# URL address to visit frequently during testing.
# Example: http://192.168.1.121/index.html
safeUrl = 

# POST data to send to a safe URL.
# Example: username=admin&password=passw0rd!
safePost = 

# Load safe HTTP request from a file.
safeReqFile = 

# Test requests between two visits to a given safe URL (default 0).
# Valid: integer
# Default: 0
safeFreq = 0

# Skip URL encoding of payload data
# Valid: True or False
skipUrlEncode = False

# Parameter used to hold anti-CSRF token
csrfToken = 

# URL address to visit to extract anti-CSRF token
csrfUrl = 

# Force usage of SSL/HTTPS
# Valid: True or False
forceSSL = False

# Use HTTP parameter pollution.
# Valid: True or False
hpp = False

# Evaluate provided Python code before the request.
# Example: import hashlib;id2=hashlib.md5(id).hexdigest()
evalCode = 

# These options can be used to optimize the performance of sqlmap.
[Optimization]

# Use all optimization options.
# Valid: True or False
optimize = False

# Predict common queries output.
# Valid: True or False
predictOutput = False

# Use persistent HTTP(s) connections.
keepAlive = False

# Retrieve page length without actual HTTP response body.
# Valid: True or False
nullConnection = False

# Maximum number of concurrent HTTP(s) requests (handled with Python threads)
# to be used in the inference SQL injection attack.
# Valid: integer
# Default: 1
threads = 1


# These options can be used to specify which parameters to test for,
# provide custom injection payloads and optional tampering scripts.
[Injection]

# Testable parameter(s) comma separated. By default all GET/POST/Cookie
# parameters and HTTP User-Agent are tested by sqlmap.
testParameter = 

# Skip testing for given parameter(s).
skip =

# Skip testing parameters that not appear to be dynamic.
# Valid: True or False
skipStatic = False

# Regexp to exclude parameters from testing (e.g. "ses").
paramExclude =

# Force back-end DBMS to this value. If this option is set, the back-end
# DBMS identification process will be minimized as needed.
# If not set, sqlmap will detect back-end DBMS automatically by default.
# Valid: mssql, mysql, mysql 4, mysql 5, oracle, pgsql, sqlite, sqlite3,
# access, firebird, maxdb, sybase
dbms = 

# DBMS authentication credentials (user:password). Useful if you want to
# run SQL statements as another user, the back-end database management
# system is PostgreSQL or Microsoft SQL Server and the parameter is
# vulnerable by stacked queries SQL injection or you are connecting directly
# to the DBMS (-d switch).
# Syntax: username:password
dbmsCred = 

# Force back-end DBMS operating system to this value. If this option is
# set, the back-end DBMS identification process will be minimized as
# needed.
# If not set, sqlmap will detect back-end DBMS operating system
# automatically by default.
# Valid: linux, windows
os = 

# Use big numbers for invalidating values.
# Valid: True or False
invalidBignum = False

# Use logical operations for invalidating values.
# Valid: True or False
invalidLogical = False

# Use random strings for invalidating values.
# Valid: True or False
invalidString = False

# Turn off payload casting mechanism
# Valid: True or False
noCast = False

# Turn off string escaping mechanism
# Valid: True or False
noEscape = False

# Injection payload prefix string.
prefix = 

# Injection payload suffix string.
suffix = 

# Use given script(s) for tampering injection data.
tamper = 


# These options can be used to specify how to parse and compare page
# content from HTTP responses when using blind SQL injection technique.
[Detection]

# Level of tests to perform.
# The higher the value is, the higher the number of HTTP(s) requests are
# as well as the better chances to detect a tricky SQL injection.
# Valid: Integer between 1 and 5
# Default: 1
level = 1

# Risk of tests to perform.
# Note: boolean-based blind SQL injection tests with AND are considered
# risk 1, with OR are considered risk 3.
# Valid: Integer between 1 and 3
# Default: 1
risk = 1

# String to match within the raw response when the query is evaluated to 
# True, only needed if the page content dynamically changes at each refresh.
# Refer to the user's manual for further details.
string = 

# String to match within the raw response when the query is evaluated to 
# False, only needed if the page content dynamically changes at each refresh.
# Refer to the user's manual for further details.
notString = 

# Regular expression to match within the raw response when the query is
# evaluated to True, only needed if the needed if the page content
# dynamically changes at each refresh.
# Refer to the user's manual for further details.
# Valid: regular expression with Python syntax
# (http://www.python.org/doc/2.5.2/lib/re-syntax.html)
regexp = 

# HTTP response code to match when the query is True.
# Valid: Integer
# Example: 200 (assuming any False statement returns a different response
# code)
# code = 

# Compare pages based only on the textual content.
# Valid: True or False
textOnly = False

# Compare pages based only on their titles.
# Valid: True or False
titles = False


# These options can be used to tweak testing of specific SQL injection
# techniques.
[Techniques]

# SQL injection techniques to use.
# Valid: a string composed by B, E, U, S, T and Q where:
# B: Boolean-based blind SQL injection
# E: Error-based SQL injection
# U: UNION query SQL injection
# S: Stacked queries SQL injection
# T: Time-based blind SQL injection
# Q: Inline SQL injection
# Example: ES (means test for error-based and stacked queries SQL
# injection types only)
# Default: BEUSTQ (means test for all SQL injection types - recommended)
tech = BEUSTQ

# Seconds to delay the response from the DBMS.
# Valid: integer
# Default: 5
timeSec = 5

# Range of columns to test for
# Valid: range of integers
# Example: 1-10
uCols = 

# Character to use for bruteforcing number of columns
# Valid: string
# Example: NULL
uChar = 

# Table to use in FROM part of UNION query SQL injection
# Valid: string
# Example: INFORMATION_SCHEMA.COLLATIONS
uFrom = 

# Domain name used for DNS exfiltration attack
# Valid: string
dnsDomain =

# Resulting page URL searched for second-order response
# Valid: string
secondOrder =


[Fingerprint]

# Perform an extensive back-end database management system fingerprint
# based on various techniques.
# Valid: True or False
extensiveFp = False


# These options can be used to enumerate the back-end database
# management system information, structure and data contained in the
# tables. Moreover you can run your own SQL statements.
[Enumeration]

# Retrieve everything
# Valid: True or False
getAll = False

# Retrieve back-end database management system banner.
# Valid: True or False
getBanner = False

# Retrieve back-end database management system current user.
# Valid: True or False
getCurrentUser = False

# Retrieve back-end database management system current database.
# Valid: True or False
getCurrentDb = False

# Retrieve back-end database management system server hostname.
# Valid: True or False
getHostname = False

# Detect if the DBMS current user is DBA.
# Valid: True or False
isDba = False

# Enumerate back-end database management system users.
# Valid: True or False
getUsers = False

# Enumerate back-end database management system users password hashes.
# Valid: True or False
getPasswordHashes = False

# Enumerate back-end database management system users privileges.
# Valid: True or False
getPrivileges = False

# Enumerate back-end database management system users roles.
# Valid: True or False
getRoles = False

# Enumerate back-end database management system databases.
# Valid: True or False
getDbs = False

# Enumerate back-end database management system database tables.
# Optional: db
# Valid: True or False
getTables = False

# Enumerate back-end database management system database table columns.
# Optional: db, tbl, col
# Valid: True or False
getColumns = False

# Enumerate back-end database management system schema.
# Valid: True or False
getSchema = False

# Retrieve number of entries for table(s).
# Valid: True or False
getCount = False

# Dump back-end database management system database table entries.
# Requires: tbl and/or col
# Optional: db
# Valid: True or False
dumpTable = False

# Dump all back-end database management system databases tables entries.
# Valid: True or False
dumpAll = False

# Search column(s), table(s) and/or database name(s).
# Requires: db, tbl or col
# Valid: True or False
search = False

# Retrieve back-end database management system comments.
# Valid: True or False
getComments = False

# Back-end database management system database to enumerate.
db = 

# Back-end database management system database table(s) to enumerate.
tbl = 

# Back-end database management system database table column(s) to enumerate.
col = 

# Back-end database management system database table column(s) to not enumerate.
excludeCol = 

# Pivot column name.
pivotColumn =

# Use WHERE condition while table dumping (e.g. "id=1").
dumpWhere = 

# Back-end database management system database user to enumerate.
user = 

# Exclude DBMS system databases when enumerating tables.
# Valid: True or False
excludeSysDbs = False

# First query output entry to retrieve
# Valid: integer
# Default: 0 (sqlmap will start to retrieve the table dump entries from
# first one)
limitStart = 0

# Last query output entry to retrieve
# Valid: integer
# Default: 0 (sqlmap will detect the number of table dump entries and
# retrieve them until the last)
limitStop = 0

# First query output word character to retrieve
# Valid: integer
# Default: 0 (sqlmap will enumerate the query output from the first
# character)
firstChar = 0

# Last query output word character to retrieve
# Valid: integer
# Default: 0 (sqlmap will enumerate the query output until the last
# character)
lastChar = 0

# SQL statement to be executed.
# Example: SELECT 'foo', 'bar'
query = 

# Prompt for an interactive SQL shell.
# Valid: True or False
sqlShell = False

# Execute SQL statements from given file(s).
sqlFile = 


# These options can be used to run brute force checks.
[Brute force]

# Check existence of common tables.
# Valid: True or False
commonTables = False

# Check existence of common columns.
# Valid: True or False
commonColumns = False


# These options can be used to create custom user-defined functions.
[User-defined function]

# Inject custom user-defined functions
# Valid: True or False
udfInject = False

# Local path of the shared library
shLib = 


# These options can be used to access the back-end database management
# system underlying file system.
[File system]

# Read a specific file from the back-end DBMS underlying file system.
# Examples: /etc/passwd or C:\boot.ini
rFile = 

# Write a local file to a specific path on the back-end DBMS underlying
# file system.
# Example: /tmp/sqlmap.txt or C:\WINNT\Temp\sqlmap.txt
wFile = 

# Back-end DBMS absolute filepath to write the file to.
dFile = 


# These options can be used to access the back-end database management
# system underlying operating system.
[Takeover]

# Execute an operating system command.
# Valid: operating system command
osCmd = 

# Prompt for an interactive operating system shell.
# Valid: True or False
osShell = False

# Prompt for an out-of-band shell, Meterpreter or VNC.
# Valid: True or False
osPwn = False

# One click prompt for an out-of-band shell, Meterpreter or VNC.
# Valid: True or False
osSmb = False

# Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored
# procedure heap-based buffer overflow (MS09-004) exploitation.
# Valid: True or False
osBof = False

# Database process' user privilege escalation.
# Note: Use in conjunction with osPwn, osSmb or osBof. It will force the
# payload to be Meterpreter.
privEsc = False

# Local path where Metasploit Framework is installed.
# Valid: file system path
msfPath = 

# Remote absolute path of temporary files directory.
# Valid: absolute file system path
tmpPath = 


# These options can be used to access the back-end database management
# system Windows registry.
[Windows]

# Read a Windows registry key value.
# Valid: True or False
regRead = False

# Write a Windows registry key value data.
# Valid: True or False
regAdd = False

# Delete a Windows registry key value.
# Valid: True or False
regDel = False

# Windows registry key.
regKey = 

# Windows registry key value.
regVal = 

# Windows registry key value data.
regData = 

# Windows registry key value type.
regType = 


# These options can be used to set some general working parameters.
[General]

# Load session from a stored (.sqlite) file
# Example: output/www.target.com/session.sqlite
sessionFile = 

# Log all HTTP traffic into a textual file.
trafficFile = 

# Never ask for user input, use the default behaviour.
# Valid: True or False
batch = False

# Result fields having binary values (e.g. "digest").
binaryFields =

# Force character encoding used for data retrieval.
charset = 

# Check Internet connection before assessing the target.
checkInternet = False

# Crawl the website starting from the target URL.
# Valid: integer
# Default: 0
crawlDepth = 0

# Regexp to exclude pages from crawling (e.g. "logout").
crawlExclude =

# CSV输出中使用的分隔字符。
# Default: ,
csvDel = ,

# Format of dumped data
# Valid: CSV, HTML or SQLITE
dumpFormat = CSV

# Retrieve each query output length and calculate the estimated time of
# arrival in real time.
# Valid: True or False
eta = False

# Flush session files for current target.
# Valid: True or False
flushSession = False

# Parse and test forms on target URL.
# Valid: True or False
forms = False

# Ignore query results stored in session file.
# Valid: True or False
freshQueries = False

# Use DBMS hex function(s) for data retrieval.
# Valid: True or False
hexConvert = False

# Custom output directory path.
outputDir =

# Parse and display DBMS error messages from responses.
# Valid: True or False
parseErrors = False

# Regular expression for filtering targets from provided Burp.
# or WebScarab proxy log.
# Example: (google|yahoo)
scope = 

# Select tests by payloads and/or titles (e.g. ROW)
testFilter =

# Skip tests by payloads and/or titles (e.g. BENCHMARK)
testSkip =

# Update sqlmap.
# Valid: True or False
updateAll = False


[解忧杂货铺]

# 发现SQL注入时运行主机操作系统命令
alert =

# 设置问题的答案 (例如: "quit=N,follow=N")
answers =

# 当检测到注入点时发出声音提示我们
# Valid: True or False
beep = False

# 离线WAF/IPS/IDS有效载荷检测测试
# Valid: True or False
checkPayload = False

# 从sqlmap特定的UDF和表清理DBMS。
# Valid: True or False
cleanup = False

# 检查sqlmap是否缺少第三方库
# Valid: True or False
dependencies = False

# 禁用控制台输出着色
# Valid: True or False
disableColoring = False

# 你想对Google dork搜索结果的哪一个页面进行注入测试
# 默认是第1页，你也可以自己指定页码。
# Valid: integer
# Default: 1
googlePage = 1

# 对WAF/IPS/IDS保护进行全面测试
# Valid: True or False
identifyWaf = False

# 通过HTTP User-Agent header模拟智能手机
# Valid: True or False
mobile = False

# 离线模式工作（仅使用会话数据）
# Valid: True or False
offline = False

# 跳过启发式检测WAF/IPS/IDS保护
# Valid: True or False
skipWaf = False

# Conduct thorough tests only if positive heuristic(s).
# Valid: True or False
smart = False

# 用于存储临时文件的本地目录
tmpDir =

# Web服务器文件根目录 (例如 "/var/www")
webRoot =

# 简单的向导界面，用于初级用户
# Valid: True or False
wizard = False

# Verbosity level.
# 如果你想观察sqlmap对一个点是进行了怎样的尝试判断以及读取数据的，可以使用-v参数。
# 共有七个等级，默认为1：
# 0、只显示python错误以及严重的信息。
# 1、同时显示基本信息和警告信息。（默认）
# 2、同时显示debug信息。
# 3、同时显示注入的payload。
# 4、同时显示HTTP请求。
# 5、同时显示HTTP响应头。
# 6、同时显示HTTP响应页面。
# 如果你想看到sqlmap发送的测试payload最好的等级就是3。
# Valid: integer between 0 and 6
# Default: 1
verbose = 1