Lesson 10 of 15

Using SQLmap

SQLmap is the most powerful open-source tool for automated SQL injection detection and exploitation, capable of extracting entire databases with a single command. You will learn how to use SQLmap effectively, how to tune it for different injection types and database backends, and how to use it responsibly during authorized penetration tests. Understanding SQLmap also helps you appreciate what automated tools can and cannot do.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is a hands-on skill — you are learning to actually do something, not just understand it theoretically. The goal is muscle memory: being able to perform this action reliably under pressure, in a real engagement, without having to look it up every time. Practice until it feels automatic.

Why this matters

Web applications are the most common attack surface in modern security. The OWASP Top 10 vulnerabilities alone account for the majority of real-world breaches. Mastering web application security opens the door to bug bounty programs, penetration testing contracts, and application security roles.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Using SQLmap · Objective 1 of 4

VIDEO

Loading video…

Identify a potential injection point

Browse the target application and look for any input that is reflected in a database query result, used in a file path, or included in a system command. Common injection points include search boxes, login forms, URL parameters, HTTP headers (User-Agent, Referer, X-Forwarded-For), and JSON/XML body parameters in API requests. Test each input with a single quote (') to check for SQL injection, a semicolon (;) to check for command injection, and a double curly brace ({{7*7}}) to check for template injection. Any unexpected error or behavioral change in response to these probes indicates a potential injection vulnerability.

Run basic SQLmap detection

Run 'sqlmap -u "http://target/page?id=1" --level=3 --risk=2 --batch' to perform automated SQL injection detection with moderate aggressiveness. The --level flag (1–5) controls the number of tests performed, and --risk (1–3) controls how potentially harmful the payloads are — start with level 3 and risk 2 for a balance of thoroughness and safety. The --batch flag accepts all default answers to prompts, making the scan non-interactive. SQLmap will report the injection type (boolean-based blind, time-based blind, UNION-based, etc.) and the database management system if injection is found.

List databases

Once SQLmap confirms injection, run 'sqlmap -u "<url>" --dbs' to enumerate all databases accessible to the database user running the web application. The number of databases visible depends on the privileges of the database account — a misconfigured application running as root or sa will expose all databases on the server, not just the application's own database. Note each database name and identify which one belongs to the target application — it is typically named after the application or company. Avoid running --dbs against production systems without explicit written authorization, as it generates significant database load.

Dump the target table

Run 'sqlmap -u "<url>" -D <database> --tables' to list all tables in the target database, then 'sqlmap -u "<url>" -D <database> -T users --dump' to extract all data from the users table. SQLmap will automatically attempt to crack any password hashes it finds using its built-in dictionary. The dumped data typically includes usernames, email addresses, password hashes, and any other columns in the users table. In a real penetration test, successfully dumping the users table is a Critical finding that demonstrates the full impact of the SQL injection vulnerability.

Previous: Burp Suite Mastery Next Lesson