SQLMap

Use -r request.txt to pass a saved Burp Suite request, or --data='user=admin&pass=*' to test POST parameters. The * marks the injection point. Add --level=5 --risk=3 for maximum injection testing depth. Always test on authorized targets only.

Simple GET parameter tests complete in seconds. Full database dumps can take hours depending on database size and injection complexity. Use --threads for parallel requests, --batch for non-interactive mode, and --smart to reduce unnecessary requests on large targets.

SQLMap has built-in WAF bypass techniques including --tamper scripts (space2comment, between, randomcase), --random-agent, and --delay for rate limiting. Use --level=5 --risk=3 with tamper scripts for best WAF bypass results.

SQLMap supports five injection types: boolean-based blind (--technique=B), time-based blind (--technique=T), error-based (--technique=E), UNION query-based (--technique=U), and stacked queries (--technique=S). It automatically detects and selects the best technique.

Save a vulnerable request from Burp Suite to a file (right-click > Save item), then run sqlmap -r request.txt. SQLMap automatically parses cookies, headers, and POST data from the Burp request. Add -p parameter_name to target a specific parameter.

Yes. Use --dump-all to extract all data from all databases, or --dump -D dbname -T tablename for specific tables. Add --threads=10 for faster extraction. Use --where to filter rows. Always ensure you have authorization for the scope of data you extract.

SQLMap is an open-source penetration testing tool that automates SQL injection detection and exploitation. It supports five SQL injection types (boolean-based blind, time-based blind, error-based, UNION query-based, and stacked queries) and over 30 database backends. SQLMap can enumerate databases, extract data, escalate privileges, and execute OS commands through vulnerable web applications.

SQLMap is used for five primary tasks: detecting SQL injection vulnerabilities in web applications, enumerating database structures (databases, tables, columns), extracting sensitive data from vulnerable databases, escalating privileges to database administrator, and executing operating system commands through database-specific features like xp_cmdshell.

SQLMap sends specially crafted payloads to web application parameters and analyzes the server's responses. It tests for boolean-based blind (true/false logic), time-based blind (response delays), error-based (database errors), UNION query-based (appended SELECT), and stacked queries (semicolon-separated statements) injection types. Once injection is confirmed, it uses the identified technique to extract data or execute commands.

Yes, SQLMap is completely free and open source under the GNU General Public License (GPL). You can download it from GitHub, install it via apt-get install sqlmap on Kali Linux, or clone the repository directly. All features including tamper scripts, OS shell access, and database enumeration are included at no cost.

SQLMap itself is legal software. However, using it to test web applications without explicit written permission from the owner is illegal in most jurisdictions. SQL injection exploitation can modify data, extract credentials, and execute system commands. Unauthorized use violates laws like the CFAA (US) and Computer Misuse Act (UK). Always obtain proper authorization before testing.

SQLMap supports over 30 database backends including MySQL, PostgreSQL, Microsoft SQL Server, Oracle, SQLite, IBM DB2, Firebird, SAP MaxDB, Sybase, Informix, Altibase, MonetDB, MariaDB, and others. It automatically detects the database backend and adjusts exploitation techniques accordingly.

Yes, SQLMap includes over 30 tamper scripts for WAF bypass. Common scripts include space2comment (replaces spaces with /**/), charencode (URL-encodes characters), between (replaces > with NOT BETWEEN), and randomcase (randomizes letter casing). Chain multiple tamper scripts with --tamper=script1,script2 for maximum evasion.

--level controls the number of injection tests performed (1-5). Level 1 tests GET/POST parameters; level 5 tests cookies, HTTP headers, and User-Agent. --risk controls the risk of tests (1-3). Risk 1 uses safe tests; risk 3 adds heavy time-based tests that may cause DoS. Use --level=5 --risk=3 only in authorized penetration tests on resilient applications.

Yes, when the database user has sufficient privileges (DBA) and the database backend supports it. Use --os-shell to get an interactive command shell through MySQL's LOAD DATA INFILE or MSSQL's xp_cmdshell. You can also use --os-pwn for a Meterpreter shell through Metasploit integration.

Scan time depends on the target, techniques used, and --level/--risk settings. A basic boolean detection scan takes 30-60 seconds. Full enumeration with --level=5 --risk=3 can take 10-30 minutes. Time-based blind extraction is slowest, potentially hours for large datasets. Use --threads=10 to parallelize data extraction.

The --batch flag runs SQLMap in non-interactive mode, automatically answering 'yes' to all prompts and choosing default options. Essential for automated scanning, CI/CD pipelines, and scripted testing. Without --batch, SQLMap pauses for user input at every decision point.

Yes. Use sqlmap -u "http://target.com/" --data="username=admin&password=test" to test POST parameters. You can also save a full HTTP request with Burp Suite and load it with sqlmap -r request.txt, which automatically tests all parameters including POST data, cookies, and headers.

Practice on intentionally vulnerable applications like DVWA (Damn Vulnerable Web Application), bWAPP, SQLi-labs, or HackTheBox/TryHackMe machines. These environments are designed for learning and provide legal, safe targets. Never practice on systems you do not own or have permission to test.

SQLMap automates detection and exploitation, testing thousands of payloads automatically. Manual injection gives you full control and understanding of the vulnerability. SQLMap is faster and more thorough; manual testing is better for learning and complex injection scenarios that automation cannot handle. Professional penetration testers use both approaches.

Yes. Save the HTTP request containing the injection point with Burp Suite, then use sqlmap -r request.txt. For stored injection in form fields, SQLMap can test and exploit injection that is stored in the database and triggered when other users view the affected page.

Update SQLMap by running sqlmap --update if installed from the Git repository. On Kali Linux, use sudo apt update && sudo apt install --only-upgrade sqlmap. The --update flag pulls the latest code from the GitHub repository and ensures you have the newest tamper scripts and detection techniques.

Use --technique=T to test specifically for time-based blind injection. You can adjust the delay threshold with --time-sec=5 (default is 5 seconds). Time-based injection is the slowest technique but works when no error messages or UNION output are available. It measures response time differences to infer data.

Yes. Save the API request with Burp Suite and load it with sqlmap -r request.txt. SQLMap will automatically test all parameters in the request body, headers, and URL. For JSON APIs, use --data with the JSON payload and --headers to include authentication tokens.

Yes, use sqlmap with the --forms flag to automatically test login form parameters: sqlmap -u 'http://target.com/login' --forms. You can also manually specify the login POST data with --data='username=admin&password=test' and target specific parameters with -p. Sqlmap tests for authentication bypass through SQL injection in the login fields.

First start the Tor service (sudo service tor start), then configure sqlmap to use the Tor SOCKS5 proxy: sqlmap -u 'http://target.com' --proxy=socks5://127.0.0.1:9050. This routes all sqlmap traffic through the Tor network for anonymity. Note that Tor adds latency and may cause timeouts — increase --timeout to 30 seconds.

SQLMap has limited support for second-order injection. Use the --second-order flag to specify a URL that is triggered after the initial injection. First inject a payload into a registration or profile form, then point --second-order to the page where the stored payload is executed. Second-order injection requires manual identification of the injection and response pages.

Chain multiple tamper scripts with --tamper: sqlmap -u 'http://target.com/?id=1' --tamper=space2comment,between,randomcase. Common bypass chains include between+space2comment for ModSecurity, randomcase+charencode for Akamai, and apostrophemask+space2comment for Cloudflare. Write custom tamper scripts in /usr/share/sqlmap/tamper/ for specific WAF signatures.

SQLMap is legal to install and run, but using it against a website you do not own or lack written permission to test is illegal under computer-misuse laws such as the US CFAA and the UK Computer Misuse Act. Only run SQLMap against systems you own, deliberately vulnerable labs (DVWA, bWAPP, the SQLi-labs project), or targets covered by a signed engagement or an in-scope bug bounty program.

Use intentionally vulnerable practice environments: DVWA, bWAPP, OWASP Juice Shop, and the SQLi-labs series all run locally in a VM or Docker and are designed for training. These let you learn --dbs, --tables, and --dump safely without touching real infrastructure. Never practice on live sites, even 'just to test'.

A 'not injectable' result usually means the parameter is properly parameterized, a WAF is filtering payloads, or you have not probed deeply enough. Raise coverage with --level=5 --risk=3, provide a full request with -r request.txt (capturing cookies and headers), and try --tamper scripts if a WAF is present. If it is genuinely parameterized, that is the site being secure — not a SQLMap failure.

Capture the request in Burp Suite, save it to a file, and run sqlmap -r request.txt. SQLMap parses the method, body, cookies, and headers automatically. For a specific field use --data="user=admin&pass=test" -p user. This is the reliable way to test authenticated areas and complex forms.

Start with detection only (no --dump), use --batch to avoid accidental destructive prompts, and avoid --os-shell, --sql-shell, and stacked-query writes unless the scope explicitly authorizes them. Add --threads conservatively, log everything for the report, and prefer read-only enumeration (--current-db, --tables) before any data extraction. Coordinate with the client before touching production databases.

SQLMap automates payload generation, database fingerprinting, and extraction, which saves hours on confirmed injection points. Manual testing gives you deeper understanding and finds logic-specific or second-order flaws that automation misses. Best practice is to learn manual injection first, then use SQLMap to scale exploitation once you understand what it is doing.

Yes, if used carelessly. Stacked-query and --os-shell operations can write data or execute commands, and aggressive extraction on huge tables can load the server. Use read-only enumeration by default, avoid destructive flags unless authorized, test against a staging copy when possible, and never run high --risk levels on production without explicit sign-off.

SQLMap automatically stores session data in ~/.local/share/sqlmap/output/<target>/ (or the output directory), so re-running the same command resumes where it left off instead of re-testing. Use --flush-session to start fresh, and -o with --output-dir to control where results are written for your report.

Beginners should avoid --os-shell, --os-pwn, --sql-shell, and high --risk=3 settings until they understand the consequences — these can write to the database or execute commands. Start with -u, --dbs, --tables, --columns, and --dump on a lab target. Learn what each flag does before scaling up.

Document the vulnerable parameter, the injection type SQLMap identified, a redacted proof-of-concept, the database version/DBMS, and the potential impact (data exposure, auth bypass). Include remediation guidance — parameterized queries/prepared statements, least-privilege DB accounts, and input validation — and reference OWASP. Never include full dumped data in a report; prove impact with minimal evidence.