Cyber Research Wiki

sqlmap

sqlmap is an automated framework for detecting and exploiting SQL injection vulnerabilities in web applications and services, with extensive DBMS fingerprinting, data enumeration, and post-exploitation capabilities.

Overview

sqlmap is an open-source project maintained on GitHub (sqlmapproject/sqlmap) and released under GPLv2. Implemented in Python and running cross‑platform, it focuses on web-exposed SQL injection assessment and automation. The project documents broad support for relational and SQL‑compatible database management systems (DBMSs), five primary SQL injection techniques, DBMS and operating system fingerprinting, session handling, proxy support, and optional integration with Metasploit for specific takeover features.

What It Is

sqlmap is a specialized security testing tool for SQL injection (SQLi). It automates the process of probing HTTP‑accessible inputs—such as query parameters, request bodies, and headers—to determine whether untrusted data is interpreted as SQL by a back‑end DBMS. Upon confirming injection, sqlmap can fingerprint the DBMS, infer privileges, and enumerate or extract data, with optional post‑exploitation actions where DBMS features and privileges permit. Its scope is confined to SQL/relational injection; it is not intended for NoSQL injection, SSRF, or other injection classes.

How It Works

sqlmap ingests a single URL, raw HTTP requests, proxy capture logs, or lists of targets, and tests multiple request components (e.g., GET, POST, Cookie, User‑Agent, Referer) for injection points. Its detection and exploitation engine implements boolean‑based blind, time‑based blind, error‑based, UNION‑based, and stacked‑query techniques, selecting and optimizing methods adaptively based on observed application behavior. After identifying a viable vector, it fingerprints the back‑end DBMS and version, infers the current user or role, and can enumerate users, schemas, tables, columns, and data where privileges allow; it also supports executing custom SQL statements through identified injection points. For DBMSs that expose file system or command execution interfaces and when authorized privileges exist, sqlmap offers post‑exploitation actions, with some advanced takeover paths optionally leveraging Metasploit. Reliability features include tamper scripts for payload mutation to work around basic WAF or filtering, authenticated session handling, proxy support, and session/cookie management. In certain scenarios, it can operate with direct DBMS credentials to perform selected actions without traversing a web injection path.

Core Concepts

Typical Workflow

Use Cases

Limitations

Related Tools

Evidence Gaps

Sources

Confidence

high