Skip to content
BackEsc
Sign in

SQL Injection · passage 185 of 186

SQLmap: Reduce Requests Number

3 code blocks · SQL Injection/SQLmap.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

The parameter `--test-filter` is helpful when you want to focus on specific types of SQL injection techniques or payloads. Instead of testing the full range of payloads that SQLMap has, you can limit it to those that match a certain pattern, making the process more efficient, especially on large or slow web applications.

sqlmap -u "https://www.target.com/page.php?category=demo" -p category --test-filter="Generic UNION query (NULL)"
sqlmap -u "https://www.target.com/page.php?category=demo" --test-filter="boolean"

By default, SQLmap runs with level 1 and risk 1, which generates fewer requests. Increasing these values without a purpose may lead to a larger number of tests that are time-consuming and unnecessary.

sqlmap -u "https://www.target.com/page.php?id=1" --level=1 --risk=1

Use the `--technique` option to specify the types of SQL injection techniques to test for, rather than testing all possible ones.

sqlmap -u "https://www.target.com/page.php?id=1" --technique=B

Source: SQL Injection/SQLmap.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 183 to 186, reading order first.

  1. SQLmap: Preprocessing Script (preprocess.py)§ 1832 code blocks · SQLmap.md
  2. SQLmap: Postprocessing Script (postprocess.py)§ 1841 code block · SQLmap.md
  3. SQLmap: Reduce Requests Number§ 1853 code blocks · SQLmap.md
  4. SQLmap: SQLmap Without SQL Injection§ 1861 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in