sqlmap
sqlmap automates the detection and exploitation of SQL injection flaws in a web application's parameters.
Legal & ethical use. Running sqlmap against systems without written permission is a crime in most jurisdictions. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Confirm whether a parameter in your own practice app is injectable
- Understand the different SQL injection techniques (boolean, time, error, union)
Key features
- Detects many injection types
- Supports many database engines
- Can enumerate databases in an authorised test
- Tamper scripts and request-file input
Installation
Install from your distribution (`sudo apt install sqlmap`) or clone the GitHub repository (it needs Python).
Beginner usage guide
Use it only against deliberately vulnerable labs such as DVWA or OWASP Juice Shop running locally; start with --batch and low risk/level settings.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Test one parameter of a local practice app
sqlmap -u "http://127.0.0.1:8081/item?id=1" --batch-u is the target URL and --batch accepts default answers. Use only on an app you control.
Keep learning
🎓 Learning path: OWASP Top 10
🎓 Learning path: Web Security
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary sqlmap (1.10.9#stable) on 2026-10-27.