From 2270b8da4739b73bdc10f49a98f40443e9368be8 Mon Sep 17 00:00:00 2001
From: Thomas Perkins <Ekultek@users.noreply.github.com>
Date: Thu, 7 Sep 2017 14:35:30 -0500
Subject: [PATCH] Updated Passing flags to sqlmap (markdown)

---
 Passing-flags-to-sqlmap.md | 215 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 214 insertions(+), 1 deletion(-)

diff --git a/Passing-flags-to-sqlmap.md b/Passing-flags-to-sqlmap.md
index 2056653..4155bf7 100644
--- a/Passing-flags-to-sqlmap.md
+++ b/Passing-flags-to-sqlmap.md
@@ -1 +1,214 @@
-# Passing flags to sqlmap from Zeus
\ No newline at end of file
+# Passing flags to sqlmap from Zeus
+
+***
+
+Everyone is familiar with [sqlmap](https://github.com/sqlmapproject/sqlmap), and if you're not you need to do some research before you use this tool. From the sqlmap developers, sqlmap is a "`Automatic SQL injection and database takeover tool`". If you have no idea what that means, go checkout sqlmap's github from the link above and try it out.
+
+If you are familiar with sqlmap, you know it has a bunch of flags that can be used. Well sqlmap's API is capable of processing all those flags as well, only problem is it will process them differently then running an actual sqlmap session. For example, with sqlmap `-v 3` will set the verbosity to level 3, using the API you need to do `verbose 3`.
+
+Here is a list of all the flags the sqlmap API understands, they must be spelled exactly as is for the API to understand the argument you are passing _(NOTE: if the argument you pass is not recognized by the sqlmap API it will be passed over)_:
+
+ - osShell
+- getUsers
+- getPasswordHashes
+- excludeSysDbs
+- ignoreTimeouts
+- regData
+- prefix
+- code
+- googlePage
+- query
+- randomAgent
+- testSkip
+- authType
+- csvDel,
+- requestFile
+- predictOutput
+- wizard
+- stopFail
+- forms
+- uChar
+- pivotColumn
+- dropSetCookie
+- commonColumns
+- smart
+- getAll
+- risk
+- sqlFile
+- rParam
+- getCurrentUser
+- notString
+- getRoles
+- getPrivileges
+- testParameter
+- tbl
+- trafficFile
+- osSmb
+- level
+- dnsDomain
+- dumpTable
+- method
+- skipWaf
+- timeout
+- firstChar
+- torPort
+- regRead
+- binaryFields
+- checkTor
+- commonTables
+- direct
+- tmpPath
+- titles
+- getSchema
+- identifyWaf
+- paramDel
+- safeReqFile
+- regKey
+- headers
+- crawlExclude
+- user
+- authCred
+- loadCookies
+- offline
+- outputDir
+- tmpDir
+- disablePrecon
+- murphyRate
+- invalidLogical
+- getCurrentDb
+- hexConvert
+- proxyFile
+- answers
+- host
+- dependencies
+- cookie
+- proxy
+- regType
+- optimize
+- safeUrl
+- limitStop
+- search
+- uFrom
+- noCast
+- testFilter
+- ignoreCode
+- eta
+- csrfToken
+- threads
+- logFile
+- os
+- col
+- rFile
+- proxyCred
+- verbose
+- crawlDepth
+- updateAll
+- privEsc
+- forceDns
+- paramExclude
+- invalidBignum
+- regexp
+- getDbs
+- freshQueries
+- uCols
+- smokeTest
+- wFile
+- udfInject
+- invalidString
+- tor
+- forceSSL
+- torTypeSOCKS5
+- beep
+- disableColoring
+- configFile
+- scope
+- authFile
+- isDba
+- regVal
+- ignoreProxy
+- checkInternet
+- safePost
+- ignoreRedirectshpp
+- Connection
+- skipUrlEncode
+- skip
+- agent
+- purgeOutput
+- retries
+- extensiveFp
+- secondOrder
+- batch
+- limitStart
+- flushSession
+- osCmd
+- suffix
+- dbmsCred
+- regDel
+- shLib
+- sitemapUrl
+- timeSec
+- msfPath
+- dumpAll
+- getHostname
+- sessionFile
+- delay
+- noEscape
+- getTables
+- safeFreq
+- liveTest
+- webRoot
+- lastChar
+- string
+- dbms
+- dumpWhere
+- tamper
+- charset
+- runCase
+- osPwn
+- evalCode
+- cleanup
+- csrfUrl
+- getBanner
+- profile
+- getComments
+- bulkFile
+- db
+- excludeCol
+- dumpFormat
+- alert
+- harFile
+- skipStatic
+- parseErrors
+- getCount
+- dFile
+- data
+- regAdd
+- dummy
+- getColumns
+- mobile
+- googleDork
+- saveConfig
+- sqlShell
+- tech
+- referer
+- textOnly
+- cookieDel
+- osBof
+- keepAlive
+
+Now that we have that out of the way, lets go ahead and give you some examples:
+
+Lets say you want to run the following commands on sqlmap: `--level=3 --risk=3 --threads=10 --random-agent`. By passing `--sqlmap-args="level 3, risk 3, randomAgent true, theads 10"` you can accomplish the same concept:
+
+![sqlmap-arguments](https://user-images.githubusercontent.com/14183473/30181446-e57e4024-93d8-11e7-8445-dbb8d764675a.png)
+![sqlmap-args2](https://user-images.githubusercontent.com/14183473/30181448-e74e9f5c-93d8-11e7-954e-9c4ca2513509.png)
+![sqlmap-args3](https://user-images.githubusercontent.com/14183473/30181450-e8aca0a6-93d8-11e7-966c-3358663e6895.png)
+![sqlmap-args4](https://user-images.githubusercontent.com/14183473/30181454-ea02199a-93d8-11e7-8a20-3f61d6de98bb.png)
+
+Now if we look at the client part of the sqlmap API:
+
+
+![api-client](https://user-images.githubusercontent.com/14183473/30181701-b5798a7c-93d9-11e7-8b04-dc5855d446da.png)
+![screenshot from 2017-09-07 14-34-40](https://user-images.githubusercontent.com/14183473/30181703-b68ccd52-93d9-11e7-9cb6-fadc47fc111e.png)
+
+As you can see the level was raised to 3 and randomAgent is now true. This will take some getting use to, but it has the full functionality of sqlmap.
\ No newline at end of file