How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?


From the SQLMap man pages:

--delay=DELAY Delay in seconds between each HTTP request

| improve this answer | |
  • 1
    I think you should consider to set --host option, because some WAF checks headers like Host and SQLmap include information about itself in the host header. – hmrojas.p May 16 '18 at 18:13
  • 2
    That would not lower the request rate as per askers question but would add a host header. There are a lot of indications, user-agent being another one, but those are out of the scope for this question :) – Nomad May 16 '18 at 19:52
  • 1
    @hmrojas.p +1 this can still be interesting to know as a comment even if not in the scope of the question. It is related since it could help bypass a WAF. – baptx May 9 '19 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.