Switch: --union-cols
TODO
+By default sqlmap tests for UNION query SQL injection technique using 1 to
+10 columns. However, this range can be increased up to 50 columns by
+providing an higher --level value. See the relevant
+paragraph for details.
You can manually tell sqlmap to test for this type of SQL injection with a
+specific range of columns by providing the tool with the
+--union-cols switch followed by a range of integers. For
+instance, 12-16 means tests for UNION query SQL injection by
+using 12 up to 16 columns.
Switch: --union-char
TODO
+By default sqlmap tests for UNION query SQL injection technique using
+NULL character. However, by providing an higher
+--level value sqlmap will performs tests also with a
+random number because there are some corner cases where UNION query tests
+with NULL fail whereas with a random integer they succeed.
You can manually tell sqlmap to test for this type of SQL injection with a
+specific character by providing the tool with the
+--union-char switch followed by a string.
Switches: --common-tables
TODO
+There are cases where --tables switch can not be used to
+retrieve the databases' table names. These cases usually fit into one
+of the following categories:
+
information_schema is not available.If any of the first two cases apply and you provided the
+--tables switch, sqlmap will prompt you with a question
+to fall back to this technique.
+Either of these cases apply to your situation, sqlmap can possibly still
+identify some existing tables if you provide it with the
+--common-tables switch. sqlmap will perform a
+brute-force attack in order to detect the existence of common tables
+across the DBMS.
The list of common table names is txt/common-tables.txt and you
+can edit it as you wish.
Switches: --common-columns
TODO
+As per tables, there are cases where --columns switch
+can not be used to retrieve the databases' tables' column names. These
+cases usually fit into one of the following categories:
+
information_schema is not available.If any of the first two cases apply and you provided the
+--columns switch, sqlmap will prompt you with a question
+to fall back to this technique.
+Either of these cases apply to your situation, sqlmap can possibly still
+identify some existing tables if you provide it with the
+--common-columns switch. sqlmap will perform a
+brute-force attack in order to detect the existence of common columns
+across the DBMS.
The list of common table names is txt/common-columns.txt and you
+can edit it as you wish.