Automate SQL Injection Detection and Exploitation

SQLMap Database Penetration Testing is a skill for automated SQL injection detection and assessment with SQLMap. It structures work from identifying a suspected injection point through database, table, and column enumeration to extraction and vulnerability reporting. The workflow covers URL targets, captured HTTP requests, logs, and bulk target files, keeping target selection tied to an authorized engagement.

Assessment topics include boolean-based blind, time-based blind, error-based, UNION query-based, stacked-query, and out-of-band techniques. The skill also addresses database-specific structure discovery, selected-table or selected-column extraction, password hash handling, and advanced operating-system or file-access features. Those advanced features remain within the stated permission and scope requirements; the operating-system shell example requires DBA privileges.

Target input methods include a URL containing a parameter, a Burp Suite request file for POST-based testing, a request log, or a file containing multiple URLs. Search-based target discovery is discussed with an explicit restriction to legal, authorized targets. The workflow distinguishes selecting a database, selecting a table, and selecting columns, and offers non-interactive operation through batch mode.

Use it for educational work or a security assessment with explicit written permission from the system owner. Prerequisites include an installed SQLMap, a confirmed or suspected injectable parameter, network connectivity, and the engagement's permitted scope. Testing unknown sites through search-based discovery is outside the legal boundaries described by the skill. All testing activities and findings must be documented.

Before a command probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, the workflow requires an exact target, confirmation of written authorization and scope, presentation of the command and expected effect, and explicit confirmation in the current conversation. Without that confirmation, remain read-only and provide defensive guidance. Controlled labs, sandboxes, or disposable VMs are preferred.

WAF or IPS controls may block traffic. SQLMap activity creates significant log entries, large data extractions can take substantial time, and time-based assessment is slower than error-based assessment. Reducing a timing threshold can create false negatives. Rate limiting and session expiry also affect long-running work.

Inputs include the target URL, a verified or suspected injection point, written authorization, and optionally a captured HTTP request. Outputs include database names, table structures, column names and types, extracted records and hash values within scope, and a report confirming injection type and severity.

Troubleshooting addresses unrecognized injection points, blocked traffic, connection timeouts, slow time-based checks, large tables, and dropped sessions. The relevant controls include test level and risk, parameter selection, technique selection, request delays, timeouts, retries, thread count, bounded extraction, selected columns, output directories, and session continuation. Assessment options include full enumeration, POST requests, bulk targets, assessment intensity, selected credentials, and advanced features.

SQLMap may be preinstalled on Kali Linux or obtained from GitHub. Burp Suite provides request captures, and Burp or WebScarab logs can supply request inputs. Database coverage includes MySQL, PostgreSQL, Microsoft SQL Server, Oracle, Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB, and Informix. Inspect available tamper scripts with:

sqlmap --list-tampers

The workflow also covers User-Agent variation, tamper-script selection, proxy options, and persistent HTTP connections as operational configuration topics.