X-SQL
sqlmap
Automated SQL injection detection and exploitation, with controlled dumps.
OVERVIEW
sqlmap automates SQL injection detection by trying boolean-based, time-based, UNION-based, and stacked-query techniques against a given parameter, and then automates exploitation too: engine fingerprinting, and extraction of databases, tables, and rows.
The --risk and --level flags control how aggressive the detection payloads are; on fragile or production targets it's worth starting low and only increasing if scope allows.
USE CASES
Practical use cases
- 01
Confirming whether a suspected parameter is truly injectable, without assuming a scanner false positive.
- 02
Fingerprinting the database engine and version once injection is confirmed.
- 03
Extracting schema and specific data within the scope the client authorized.
- 04
Testing WAF bypasses with the bundled tamper scripts when traffic is being filtered.
QUICK START
When a parameter already looks injectable and you need to confirm impact and extract data within scope and the rules of engagement.
- Confirm detection first with --risk=1 --level=1, without dumping anything yet.
- If the engine allows it, raise risk/level only as much as needed to confirm the technique.
- Verify with the client that scope permits extraction before using --dump.
- Document the exact query and technique used for the report.
root@itspentest:~# sqlmap -u "https://target.com/item?id=1" --batch --risk=1 --level=1BEFORE YOU RUN IT
What to check before running it
High risk/level values can trip the WAF, cause lockouts, or even corrupt data on some engines.
--dump extracts real data: always confirm the rules of engagement allow it before running it.
Time-based techniques are slow and unreliable over networks with unstable latency — prefer boolean/UNION when possible.