How to Insert data into a table with sqlmap using its sql-query command

Question

I'm using sqlmap on a test site and I wanted to modify some of the data inside of a table. Using the switch "--sql-query".

• What is the correct syntax?

example: is it --sql-query="My_query_here"?
Or maybe its --sql-query='myqueryhere'?

• How would I be able to modify multiple rows of data? example: Say I wanted to replace all data with the words. Game Over

• Is it possible to drop in a shell?

Answer 1

Most databases do not allow you to just insert data using SQL Injection (Unless of course you are already in an insert query and even then you usually can't control the table name). You can't simply stack queries, that is only allowed in MS-SQL and comic books. You can use a sub-select or union select to access data from another table, and SQLMap is doing this behind the scenes.

SQLMap's real strength is in data ex-filtration. If you want something more complex, like a multi-staged attack that gives you a shell, then you need to write an exploit. Take off the training wheals and be man (or woman).