I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. But i want to check the news id. Is that possible?

1 Answer 1


By default, sqlmap tries all possible parameters, hence it should include both menu_id and news_id in its execution sequentially.

If, on the other hand, you'd like to skip menu_id and go straight for the second parameter, you could run it as follows:

./sqlmap.py -u "http://www.example.com/index.php?menu_id=1002&news_id=5" -p news_id
  • it worked. And we can change the parameters like "index.php?news_id=5&menu_id=1002". It works too :) Commented Jan 22, 2014 at 13:43

Not the answer you're looking for? Browse other questions tagged .