SQLMap
Web Security 6 commands

SQLMap

Automatic SQL injection and database takeover tool. Supports full detection and exploitation of SQL injection flaws.

sql-injectionwebdatabaseautomation
Official docs

Installation

sudo apt install sqlmap
# or
pip install sqlmap
# or
git clone https://github.com/sqlmapproject/sqlmap.git

Commands & usage

6 entries
  • sqlmap -u <url> --dbs

    Enumerate databases

  • sqlmap -u <url> -D <db> --tables

    List tables in database

  • sqlmap -u <url> -D <db> -T <table> --dump

    Dump table data

  • sqlmap -u <url> --os-shell

    Get OS shell

  • sqlmap -r request.txt

    Use saved HTTP request

  • sqlmap -u <url> --tamper=space2comment

    Use tamper scripts

Use cases

SQL injection testingDatabase enumerationData extractionAuthentication bypassWAF evasion testing