SQLMap — SQL Injection Tester GuideStep-by-step SQLMap reference: find, confirm and exploit SQL injection on lab targets (DVWA, OWASP Juice Shop). Educational use only.FAQ

What is SQLMap?

SQLMap is an open-source tool that automates SQL injection: you give it a URL with a parameter, it confirms the injection, fingerprints the database, and can list tables and dump data. What takes hours by hand takes it minutes.

Is SQLMap illegal?

The tool is legal and used in authorized audits. Pointing it at any site you do not own or lack permission to test is illegal — injection dumps real user data. Practice on DVWA or OWASP Juice Shop running on your own machine.

What does --dbs do?

--dbs lists all databases on the server after SQLMap confirms injection. Then -D picks one database, --tables lists its tables, -T picks a table, and --dump pulls the rows.

What is the difference between --batch and interactive mode?

By default SQLMap asks questions mid-run (which payload? try harder?). --batch answers yes to everything so a lab run finishes unattended. Add --random-agent to rotate the user-agent string.

What is tamper scripts (--tamper)?

Tamper scripts rewrite payloads to slip past weak filters — for example space2comment swaps spaces for comments. They beat naive keyword blocklists in labs, not real WAFs.

How do I point SQLMap at a login form?

Capture the POST request (browser devtools or Burp), save it to a file, and run sqlmap -r request.txt -p username. The -p flag tells SQLMap which parameter to inject so it ignores the rest.

What is --risk and --level?

--level 1-5 controls how many parameters and headers get tested; --risk 1-3 controls how dangerous the payloads are (risk 3 can UPDATE/DELETE data). Keep both at 1 in shared labs.

How do I protect my own app from SQLMap?

Use prepared statements (parameterized queries) everywhere, give the app DB user minimum privileges, put a WAF like ModSecurity in front, and log UNION/SELECT probe patterns. SQLMap then finds nothing to exploit.

All tools · Sitemap · Games