I use sqlmap to test the services of my company.

I tried increasing the value of its "--level" option, but I do not find clear descriptions of the tests added with an increased "--risk" value.

So, what do risk level 2 and 3 tests do, and what are the risks of running them?

| improve this question | | | | |
  • 1
    Their GitHub wiki gives some basic info about all the options sqlmap has. Also about the risk and level parameter. – Eelke Jun 28 '17 at 14:34
  • Based on the link from the comment above, it might be interesting to open the xml/payloads.xml file and see if there's any structure or comments to the file that indicate the payloads run with each level – iainpb Jun 28 '17 at 14:37
  • Level

By default sqlmap will test all GET and POST parameters specified, however in some cases you might want to test additional entry points such as HTTP headers. It is possible to specify it with specific options, but the most straight forward technique is to use the --level option. There is 5 levels available in sqlmap (default being level 1). Level 2 adds HTTP Cookie header testing, level 3 adds HTTP User-Agent/Referer headers. I can't provide to you more info about higher levels because there is no more info about them on sqlmap wiki.

  • Risk

Regarding the risk. There are 3 risk values. The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.