Skip to content
BackEsc
Sign in

SQL Injection · passage 181 of 186

SQLmap: Evaluate Python Code

1 code block · SQL Injection/SQLmap.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

The `--eval` option lets you define or modify request parameters using Python. The evaluated variables can then be used inside the URL, headers, cookies, etc. Particularly useful in scenarios such as: * **Dynamic parameters**: When a parameter needs to be randomly or sequentially generated. * **Token generation**: For handling CSRF tokens or dynamic auth headers. * **Custom logic**: E.g., encoding, encryption, timestamps, etc.

sqlmap -u "http://example.com/vulnerable.php?id=1" --eval="import random; id=random.randint(1,10)"
sqlmap -u "http://example.com/vulnerable.php?id=1" --eval="import hashlib;id2=hashlib.md5(id).hexdigest()"

Source: SQL Injection/SQLmap.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 157 to 182, reading order first.

  1. SQLite Injection: SQLite Comments§ 157text · SQLite Injection.md
  2. SQLite Injection: SQLite Enumeration§ 158text · SQLite Injection.md
  3. SQLite Injection: SQLite String Methodology§ 159text · SQLite Injection.md
  4. SQLite Injection: SQLite Blind Methodology§ 160text · SQLite Injection.md
  5. SQLite Injection: SQLite Blind With Substring Equivalent§ 161text · SQLite Injection.md
  6. SQLite Injection: SQlite Error Based§ 1621 code block · SQLite Injection.md
  7. SQLite Injection: SQlite Time Based§ 1631 code block · SQLite Injection.md
  8. SQLite Injection: Attach Database§ 1643 code blocks · SQLite Injection.md
  9. SQLite Injection: Loadextension§ 1653 code blocks · SQLite Injection.md
  10. SQLite Injection: SQLite Read File§ 166text · SQLite Injection.md
  11. SQLite Injection: SQLite Write File§ 1671 code block · SQLite Injection.md
  12. SQLmap: SQLmap§ 168text · SQLmap.md
  13. SQLmap: Basic Arguments For SQLmap§ 1691 code block · SQLmap.md
  14. SQLmap: Load A Request File§ 1701 code block · SQLmap.md
  15. SQLmap: Custom Injection Point§ 1711 code block · SQLmap.md
  16. SQLmap: Second Order Injection§ 1721 code block · SQLmap.md
  17. SQLmap: Getting A Shell§ 173text · SQLmap.md
  18. SQLmap: Crawl And Auto-Exploit§ 1741 code block · SQLmap.md
  19. SQLmap: Proxy Configuration For SQLmap§ 1751 code block · SQLmap.md
  20. SQLmap: Injection Tampering§ 176text · SQLmap.md
  21. SQLmap: Suffix And Prefix§ 1771 code block · SQLmap.md
  22. SQLmap: Default Tamper Scripts§ 1781 code block · SQLmap.md
  23. SQLmap: Custom Tamper Scripts§ 1791 code block · SQLmap.md
  24. SQLmap: Custom SQL Payload§ 1801 code block · SQLmap.md
  25. SQLmap: Evaluate Python Code§ 1811 code block · SQLmap.md
  26. SQLmap: Preprocess And Postprocess Scripts§ 1821 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in