You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
<divclass="form-label">TARGET URL<itooltip="Specify the target URL to scan for SQL injection vulnerabilities, including any query parameters.">ⁱ</i></div>
<divclass="form-label">BURP FILE WITH HTTP REQUESTS<itooltip="Rather than providing a single target URL, it is possible to test and inject against HTTP requests proxied through Burp proxy.">ⁱ</i></div>
<divclass="form-label">SCOPE FOR BURP PROXY FILE<itooltip="Rather than using all hosts parsed from provided logs with option -l, you can specify valid Python regular expression to be used for filtering desired ones.">ⁱ</i></div>
<divclass="form-label">HTTP(S) PROXY CREDENTIAL<itooltip="If the HTTP(S) proxy requires authentication, you can provide the credentials in the format username:password to the option --proxy-cred.">ⁱ</i></div>
<u>--ignore-proxy</u><itooltip="Run sqlmap against a target part of a local area network by ignoring the system-wide set HTTP(S) proxy server setting.">ⁱ</i>
<u>--tor</u><itooltip="If, for any reason, you need to stay anonymous, instead of passing by a single predefined HTTP(S) proxy server, you can configure a Tor client together with Privoxy (or similar) on your machine as explained in Tor installation guides.
Then you can use a switch --tor and sqlmap will try to automatically set Tor proxy connection settings.">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --check-tor -->
<labelclass="checkbox-label" for="checkTor">
<inputtype="checkbox" id="checkTor">
<b></b>
<u>--check-tor</u><itooltip="You are strongly advised to use --check-tor occasionally to be sure that everything was set up properly.
With --check-tor sqlmap will check if everything works as expected by sending a single request to an official 'Are you using Tor?' page before any target requests.">ⁱ</i>
<spanclass="checkmark"></span>
</label>
</div>
</div>
<!-- --tor-port -->
<labelclass="form-group" for="torPort">
<divclass="form-label">TOR PROXY PORT<itooltip="In case that you want to manually set the port of used Tor proxy.">ⁱ</i></div>
<divclass="form-label">PARAMETER DELIMITER<itooltip="There are cases when default parameter delimiter (&) needs to be overwritten for sqlmap to be able to properly split and process each parameter separately, e.g.:
<divclass="form-label">PYTHON CODE TO EVALUATE<itooltip="Evaluate custom Python code before each request and use its output to modify parameters or payloads.
Perfect for dynamic payload generation, custom hashing, encoding, or manipulating request data on the fly.
<divclass="form-label">HTTP BODY DATA<itooltip="By default the HTTP method used to perform HTTP requests is GET, but you can implicitly change it to POST by providing the data to be sent in the POST requests.
Such data, being those parameters, are tested for SQL injection as well as any provided GET parameters.">ⁱ</i></div>
<divclass="form-label">USER-AGENT HEADER VALUE<itooltip="By default sqlmap performs HTTP requests with the "sqlmap/1.0-dev-x (http://sqlmap.org)" User-Agent header, but it can changed with the option -A.
Moreover, by providing the switch --random-agent, sqlmap will randomly select a User-Agent from the ./txt/user-agents.txt textual file and use it for all HTTP requests within the session.
Some sites perform a server-side check of HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system.
Sometimes web servers expose different interfaces toward mobile phones than to desktop computers.
In such cases you can enforce usage of one of predetermined smartphone HTTP User-Agent header values by using a --mobile switch (sqlmap will ask you to pick one of popular smartphones which it will imitate in current run).
Note that also the HTTP User-Agent header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></div>
<optionvalue="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Windows</option>
<optionvalue="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for macOS</option>
<optionvalue="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Linux</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPhone</option>
<optionvalue="Mozilla/5.0 (iPad; CPU OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPad</option>
<optionvalue="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36">Google Chrome 137 for Android</option>
<optionvalue="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Microsoft Edge 137 for Windows</option>
<optionvalue="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.3296.68">Microsoft Edge 137 macOS</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 EdgiOS/137.3296.65 Mobile/15E148 Safari/605.1.15">Microsoft Edge 137 for iOS</option>
<optionvalue="Mozilla/5.0 (Linux; Android 10; HD1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36 EdgA/137.0.3296.53">Microsoft Edge 137 for Android</option>
<optionvalue="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15">Apple Safari 18.4 for macOS</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPhone</option>
<optionvalue="Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPad</option>
<optionvalue="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Windows</option>
<optionvalue="Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for macOS</option>
<optionvalue="Mozilla/5.0 (X11; Linux i686; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Linux</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPhone</option>
<optionvalue="Mozilla/5.0 (iPad; CPU OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPad</option>
<optionvalue="Mozilla/5.0 (Android 15; Mobile; rv:139.0) Gecko/139.0 Firefox/139.0">Firefox 139 for Android</option>
<optionvalue="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/119.0.0.0">Opera for Windows</option>
<optionvalue="Mozilla/5.0 (Linux; Android 15; Pixel 8 Pro Build/AP4A.250205.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.39 Mobile Safari/537.36 THDConsumer/7.45 (Android 15; Pixel 8 Pro) DID:84d0d3e3907e6ea1">Android 15 WebView for Pixel 8 Pro</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 [FBAN/FBIOS;FBAV/507.0.0.58.94;FBBV/716584418;FBDV/iPhone17,4;FBMD/iPhone;FBSN/iOS;FBSV/18.3.2;FBSS/3;FBID/phone;FBLC/en_US;FBOP/5;FBRV/719878764;IABMV/1]">Facebook App for iOS 18.3.2</option>
<optionvalue="Mozilla/5.0 (Linux; Android 14; SM-A137F Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.135 Mobile Safari/537.36 [FBAN/EMA;FBLC/sk_SK;FBAV/451.0.0.9.108;FB_FW/1;FBDM/DisplayMetrics{density=2.8125, width=1080, height=2301,2.8125, xdpi=403.411, ydpi=399.759};]">Facebook App for Android 14</option>
<optionvalue="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 Instagram 344.0.9.27.90 (iPhone15,4; iOS 18_3_2; en_US; en; scale=3.00; 1179x2556; 631222391) NW/3">Instagram App for iOS 18.3.2</option>
<inputtype="text" id="customUserAgent" class="form-control" placeholder="Custom User Agent value">
</div>
</label>
<!-- --referer -->
<labelclass="form-group" for="referer">
<divclass="form-label">HTTP REFERER HEADER<itooltip="By default no HTTP Referer header is sent in HTTP requests if not explicitly set by the --referer switch.
Note that also the HTTP Referer header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></div>
<divclass="form-label">COOKIE VALUE<itooltip="HTTP Cookie header value for authentication (and for exploitation if the --level is set to 2 or above).
If you provide a HTTP Cookie header with option --cookie and the target URL sends an HTTP Set-Cookie header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.
<divclass="form-label">LIVE COOKIES FILE<itooltip="Option --live-cookies can be used to provide a cookies file which will be used for loading of up-to-date values.
This means that that same file will be read prior to each request to get the latest value for HTTP Cookie header. It should point to a file with fresh/up-to-date cookie values.
Trick is that once you delete its content, sqlmap immediately will stop and wait for the update of its content. Same applies if you just modify its content in-place.You can do this indefinitely number of times during a run.
In your case, you can just run sqlmap in one terminal with --live-cookies pointing to a file containing starting cookie value, while in another terminal you can do a periodic deletion and filling of that same file.">ⁱ</i></div>
<divclass="form-label">RAW COOKIE FILE<itooltip="An option --load-cookies can be used to provide a special file containing Netscape/wget formatted cookies.
This format includes not only cookie names and values but also their domains, paths, expiry, and security attributes.
Unlike the --cookie or -H options which requires to manually enter raw cookie strings, the --load-cookies reads structures cookie data, which can help fully replicate a browser session.">ⁱ</i></div>
<u>--drop-set-cookie</u><itooltip="If the web application responds with Set-Cookie headers, sqlmap will automatically use its value in all further HTTP requests as the Cookie header. Sqlmap will also automatically test those values for SQL injection.
This can be avoided by providing the switch --drop-set-cookie.
Therefore, an sqlmap will ignore any coming Set-Cookie header.">ⁱ</i>
<spanclass="checkmark"></span>
</div>
</label>
<div></div>
<!-- --auth-type/--auth-cred -->
<labelclass="form-group" for="authType">
<divclass="form-label">HTTP PROTOCOL AUTHENTICATION<itooltip="These options can be used to specify which HTTP protocol authentication back-end web server implements and the valid credentials to be used to perform all HTTP requests to the target application.">ⁱ</i></div>
<divclass="form-label">PRIVATE KEY AUTHENTICATION<itooltip="This option should be used in cases when the web server requires proper client-side certificate and a private key for authentication.
Supplied value should be a PEM formatted key_file that contains your certificate and a private key.">ⁱ</i></div>
<divclass="form-label">TOKEN EXTRACTION URL<itooltip="Option --csrf-url can be used for retrieval of the token value from arbitrary URL address.
This is useful if the vulnerable target URL doesn't contain the necessary token value in the first place, but it is required to extract it from some other location.">ⁱ</i></div>
<divclass="form-label">TOKEN EXTRACTION DATA<itooltip="Send this POST data when sqlmap visits the anti-CSRF token URL to retrieve a new token.
Use together with --csrf-url for applications that require a POST request to generate or refresh the CSRF token, ensuring your scans stay authenticated and valid.
<divclass="form-label">ANTI-CSRF TOKEN FIELD<itooltip="Option --csrf-token can be used to set the name of the hidden value that contains the randomized token.
This is useful in cases when web sites use non-standard names for such fields.">ⁱ</i></div>
<divclass="form-label">SAFE REQUEST URL<itooltip="Visit the specified URL regularly during scanning to keep your session alive or prevent automatic logouts.
Sqlmap will visit this safe URL between requests to maintain access while testing.
Useful for applications with aggressive session timeouts or login expirations.
You can send specific data to this request with --safe-post.
<divclass="form-label">SAFE REQUEST DATA<itooltip="Send this custom POST data to the safe URL during session keep-alive requests.
Ideal when your application requires a specific POST body to refresh a session or simulate a real user action while maintaining authentication during a scan.
You should specify a URL using the --safe-url switch.
<divclass="form-label">FILE WITH A SAFE REQUEST<itooltip="Use a complete HTTP request from a file as the safe URL visit to keep your session active.
Great for complex authentication flows or when you need to replay a real request with headers, cookies, or big chunk of POST data to prevent timeouts and maintain access while scanning.
<divclass="form-label" >TESTABLE PARAMETERS<itooltip="Comma separated parameters for testing. By default sqlmap tests all GET parameters and POST parameters.
When the value of --level is >= 2 it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections.
It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on value of --level too.
For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p "id,user-agent".">ⁱ</i></div>
<divclass="form-label" >FORBIDDEN PARAMETERS<itooltip="Skip testing for given parameter(s). That is especially useful in cases when you want to use higher value for --level and test all available parameters excluding some of HTTP headers normally being tested.
For instance, to skip testing for HTTP header User-Agent and HTTP header Referer at --level=5, provide --skip="user-agent,referer".">ⁱ</i></div>
<divclass="form-label">FORBIDDEN PARAMETERS REGEX<itooltip="Skip testing for given parameter(s). This is the same as --skip, but this switch is based on a regular expressions.
For instance, to skip testing for parameters which contain string token or session in their names, provide --param-exclude="token|session"">ⁱ</i></div>
<divclass="form-label">PARAMETERS SCAN CATEGORY ALLOWLIST<itooltip="The --param-filter parameter restrict scans to specific components of HTTP requests, improving efficiency and reducing noise.
Accepted comma-separated values include GET (URL parameters), POST (request body), COOKIE, HOST, USER-AGENT, and REFERER.
This switch can isolate high-risk areas like API endpoints (test only POST body parameters) or speed-up headers injection testing (specifying COOKIE,HOST,USER-AGENT,REFERER filter with --level=5 focuses scans on headers, ignoring GET/POST parameters).
The filter reduces scan times by 30-40% in header-rich environments and minimizes false positives from unnecessary parameters.">ⁱ</i></div>
<divclass="form-label">PREFIX TO PREPEND<itooltip="The --prefix parameter allows you to prepend a custom string to every SQL injection payload before it is sent to the target application.
This parameter is essential when applications require specific SQL syntax or characters before the actual injection payload to construct a valid query.
It is particularly useful when dealing with applications that embed parameters within complex SQL queries requiring specific opening syntax, such as closing quotes or parentheses before the injection point.">ⁱ</i></div>
<divclass="form-label">SUFFIX TO APPEND<itooltip="The --suffix parameter enables you to append a custom string to every SQL injection payload after the main injection code.
It is crucial when applications require specific closing characters or comments to prevent SQL syntax errors, such as SQL comments (--) or closing parentheses to maintain query validity.">ⁱ</i></div>
<divclass="form-label">PARAMETER(S) WITH RANDOM VALUE(S)<itooltip="Randomly change the value of the specified parameter(s) on each request.
Great for avoiding caching, WAF tracking, or when you want each request to look unique. Useful for scanning parameters that the app or security device ignores unless they change on every request.
<u>--titles</u><itooltip="Compare only the <title> tag of each page when checking for SQL injection differences, instead of analyzing the full page content.
Great for web apps where the page content changes a lot but the title reflects the true application state—useful for noisy apps, dynamic pages, or when other detection methods are unreliable.
Turn on when you knows that the distinction of a True query from a False one can be done using HTML title (e.g. "Welcome" for True and "Forbidden" for False).
">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --text-only -->
<labelclass="checkbox-label" for="textOnly">
<inputtype="checkbox" id="textOnly">
<u>--text-only</u><itooltip="Compare only the textual content of each page (stripped of HTML tags) to detect SQL injection, ignoring markup and scripts.
Useful when HTML layout or scripts change on every request, but the actual text on the page is what matters for detection—helps reduce false positives on dynamic sites.
This way, in a good number of cases, you can automatically tune the detection engine.">ⁱ</i>
<u>--ignore-redirects</u><itooltip="Ignore HTTP redirects and treat redirection responses as normal results, without following them.
Useful for endpoints that always redirect, when redirects interfere with scanning, or if you want sqlmap to process only the original response without chasing further URLs.
<u>--ignore-timeouts</u><itooltip="Ignore time out requests and continue scanning as if nothing happened.
Perfect for unstable or slow targets, letting sqlmap complete scans without interruption from occasional network issues or delayed server responses.
">ⁱ</i>
<spanclass="checkmark"></span>
</label>
</div>
</div>
<!-- --string -->
<labelclass="form-group" for="string">
<divclass="form-label">TRUE DETECTION STRING<itooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<divclass="form-label">TRUE DETECTION REGEXP<itooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<divclass="form-label">FALSE DETECTION STRING<itooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<divclass="form-label">EXPECTED HTTP CODE<itooltip="Use this in cases when you know that the distinction of a True query from a False one can be done using HTTP code.">ⁱ</i></div>
<divclass="form-label">STOP SCAN ON THIS HTTP STATUS CODE<itooltip="Abort testing when the specified HTTP status code (like 403 or 500) appears in the response.
Use this to stop scans automatically if you trigger a block, web application firewall or major server error. Great for avoiding account lockouts or when you want fast feedback if the application changes its behavior during the scan.">ⁱ</i></div>
<divclass="form-label">RETRY ON CONTENT REGEXP<itooltip="Retry the request if the response body matches the given regular expression.
Perfect for skipping over temporary issues, like 'Service Unavailable' or anti-bot messages—use this to keep your scan going if you hit intermittent errors or protections that show specific content in their response.
<u>--invalid-bignum</u><itooltip="This parameter forces sqlmap to use large integer numbers for invalidating original parameter values during SQL injection tests.
Instead of standard invalidation methods (e.g., negative values), sqlmap replaces original values with very large numbers, which can bypass application filters that block typical techniques.
It is particularly useful when applications filter standard parameter invalidation methods but may not properly handle extremely large numeric values.">ⁱ</i>
<u>--invalid-logical</u><itooltip="The switch enables the use of logical operations to invalidate parameter values.
Sqlmap replaces original values with logical expressions that always return false (e.g., id=(1=0)).
This method is effective when applications expect logical values or block other invalidation techniques.
The parameter serves as an alternative for standard invalidation methods in environments with advanced filtering mechanisms.">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --invalid-string -->
<labelclass="checkbox-label" for="invalidString">
<inputtype="checkbox" id="invalidString">
<u>--invalid-string</u><itooltip="This parameter causes sqlmap to use random character strings for parameter value invalidation. Sqlmap generates random strings instead of original values, bypassing application filters focused on numeric values.
It is useful when applications have special validation mechanisms for numbers but do not check string inputs.
The parameter automatically replaces parameters with random strings during boolean-based injection tests.">ⁱ</i>
By default sqlmap automatically escapes special characters in payloads (adds backslash before apostrophes). This switch is useful when applications have their own escaping mechanisms or when automatic escaping breaks payloads.
It is often combined with --no-cast in environments with query length restrictions where every character matters.">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --predict-output -->
<labelclass="checkbox-label" for="predictOutput">
<inputtype="checkbox" id="predictOutput">
<u>--predict-output</u><itooltip="The switch enables a statistical algorithm for predicting query results in inference techniques.
Sqlmap builds statistical tables of most probable character values based on the txt/common-outputs.txt file and current enumeration knowledge.
It significantly speeds up data retrieval when values belong to common patterns (system table names, privileges).
The parameter is not compatible with --threads and works best when retrieving standard DBMS entities.">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --skip-urlencode -->
<labelclass="checkbox-label" for="skipUrlencode">
<inputtype="checkbox" id="skipUrlencode">
<u>--skip-urlencode</u><itooltip="Send payload data without URL encoding.
Useful for debugging, custom encoding schemes, or when the target expects raw input.
Use with caution — most apps require URL-encoded data, so skipping encoding can cause requests to fail or be misinterpreted.
">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --chunked -->
<labelclass="checkbox-label" for="chunked">
<inputtype="checkbox" id="chunked">
<u>--chunked</u><itooltip="Use HTTP Parameter Pollution (HPP) by sending multiple instances of the same parameter in requests.
Great for testing if the web app or backend handles duplicate parameters insecurely—can help bypass filters, trigger edge-case bugs, or discover hidden vulnerabilities that appear only when parameters are polluted.
">ⁱ</i>
<spanclass="checkmark"></span>
</label>
<!-- --hpp -->
<labelclass="checkbox-label" for="hpp">
<inputtype="checkbox" id="hpp">
<u>--hpp</u><itooltip="Send POST requests using HTTP chunked transfer encoding instead of a standard Content-Length.
Useful for bypassing WAFs, filters, or edge devices that mishandle or ignore chunked requests.
Try this if standard POSTs are blocked or behave differently.
">ⁱ</i>
<spanclass="checkmark"></span>
</label>
</div>
</div>
<!-- --dbms -->
<labelclass="form-group" for="dbms">
<divclass="form-label">FORCE TARGET DATABASE ENGINE<itooltip="Greatly reduces scan time by minimalizing number of requests, using payloads appropriate only for the selected database engine.">ⁱ</i></div>