Merge pull request #1931 from HackTricks-wiki/research_update_src_pentesting-web_sql-injection_sqlmap_20260221_130048

Research Update Enhanced src/pentesting-web/sql-injection/sq...

Author: carlospolop

src/pentesting-web/sql-injection/sqlmap.md

@@ -169,7 +169,7 @@ sqlmap -r r.txt -p id --not-string ridiculous --batch
 | apostrophenullencode.py      | Replaces apostrophe character with its illegal double unicode counterpart                                                          |
 | appendnullbyte.py            | Appends encoded NULL byte character at the end of payload                                                                          |
 | base64encode.py              | Base64 all characters in a given payload                                                                                           |
-| between.py                   | Replaces greater than operator \('>'\) with 'NOT BETWEEN 0 AND \#'                                                              |
+| between.py                   | Replaces greater than operator \('>'\) with 'NOT BETWEEN 0 AND \#'                                                              |
 | bluecoat.py                  | Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator |
 | chardoubleencode.py          | Double url-encodes all characters in a given payload \(not processing already encoded\)                                            |
 | commalesslimit.py            | Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M'                                                                       |
@@ -180,7 +180,7 @@ sqlmap -r r.txt -p id --not-string ridiculous --batch
 | charunicodeescape.py         | Unicode-url-encodes non-encoded characters in a given payload \(not processing already encoded\). "\u0022"                         |
 | equaltolike.py               | Replaces all occurances of operator equal \('='\) with operator 'LIKE'                                                             |
 | escapequotes.py              | Slash escape quotes \(' and "\)                                                                                                    |
-| greatest.py                  | Replaces greater than operator \('>'\) with 'GREATEST' counterpart                                                              |
+| greatest.py                  | Replaces greater than operator \('>'\) with 'GREATEST' counterpart                                                              |
 | halfversionedmorekeywords.py | Adds versioned MySQL comment before each keyword                                                                                   |
 | ifnull2ifisnull.py           | Replaces instances like 'IFNULL\(A, B\)' with 'IF\(ISNULL\(A\), B, A\)'                                                            |
 | modsecurityversioned.py      | Embraces complete query with versioned comment                                                                                     |
@@ -203,19 +203,28 @@ sqlmap -r r.txt -p id --not-string ridiculous --batch
 | space2mysqldash.py           | Replaces space character \(' '\) with a dash comment \('--'\) followed by a new line \('\n'\)                                      |
 | space2plus.py                | Replaces space character \(' '\) with plus \('+'\)                                                                                 |
 | space2randomblank.py         | Replaces space character \(' '\) with a random blank character from a valid set of alternate characters                            |
-| symboliclogical.py           | Replaces AND and OR logical operators with their symbolic counterparts \(&& and                                                    |
+| symboliclogical.py           | Replaces AND and OR logical operators with their symbolic counterparts \(&& and \|\|\)                                               |
 | unionalltounion.py           | Replaces UNION ALL SELECT with UNION SELECT                                                                                        |
-| unmagicquotes.py             | Replaces quote character \('\) with a multi-byte combo %bf%27 together with generic comment at the end \(to make it work\)         |
+| unmagicquotes.py             | Replaces quote character \(') with a multi-byte combo %bf%27 together with generic comment at the end \(to make it work\)         |
 | uppercase.py                 | Replaces each keyword character with upper case value 'INSERT'                                                                     |
 | varnish.py                   | Append a HTTP header 'X-originating-IP'                                                                                            |
 | versionedkeywords.py         | Encloses each non-function keyword with versioned MySQL comment                                                                    |
 | versionedmorekeywords.py     | Encloses each keyword with versioned MySQL comment                                                                                 |
 | xforwardedfor.py             | Append a fake HTTP header 'X-Forwarded-For'                                                                                        |
+| luanginxmore.py              | POST-only tamper that prepends millions of dummy parameters to exhaust Lua‑Nginx WAF parsers (e.g., Cloudflare).                   |
 
-## References
-- [SQLMap: Testing SQL Database Vulnerabilities](https://blog.bughunt.com.br/sqlmap-vulnerabilidades-banco-de-dados/)
+`luanginxmore` generates ~4.2M random POST parameters before your payload; use it only with `--method=POST` and expect large request sizes to crash poorly configured Lua-Nginx WAFs.
 
-{{#include ../../banners/hacktricks-training.md}}
+## Recent switches worth enabling (>=1.9.x)
 
+* **HTTP/2 transport**: `--http2` forces sqlmap to speak HTTP/2 (helpful against front-ends that rate-limit HTTP/1.1 but relax h2). Combine with `--force-ssl` to pin HTTPS.
+* **Proxy rotation**: `--proxy-file proxies.txt --proxy-freq 3` will rotate through a list, changing proxy every 3 requests to avoid IP-based throttling.
+* **Offline / purge modes**: `--offline` reuses cached session data without touching the target (zero network traffic), while `--purge` securely wipes the session/output directory when you’re done.
+* **Mobile UA emulation**: `--mobile` prompts you to spoof a popular smartphone User-Agent, useful on APIs that expose additional fields to mobile clients.
 
+## References
+- [SQLMap Usage Wiki](https://github.com/sqlmapproject/sqlmap/wiki/usage)
+- [SQLMap Command Builder (flags summary incl. HTTP/2)](https://vizzdoom.github.io/sqlmap-command-builder/)
+- [luanginxmore tamper (sqlmap GitHub)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/tamper/luanginxmore.py)
 
+{{#include ../../banners/hacktricks-training.md}}