sqlmap

sqlmap project

Automated SQL injection detection and exploitation — the reference tool for proving an injection is real.

Vulnerability Management Free & Open Source CLI Practiced in lab Cross-platform

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Preparation
9 Detection & Analysis
10 Containment, Eradication & Recovery
11 Post-Incident Activity

Description

sqlmap automates the whole SQL injection workflow: detecting the injectable parameter, fingerprinting the DBMS, and then escalating from a boolean oracle to full data extraction.

It matters for a Django project because it answers the question a code review cannot: is this parameter actually exploitable? Django's ORM parameterises queries, so sqlmap finds nothing against normal code — point it at a view using .raw() or .extra() with string formatting and it dumps the table.

Techniques worth knowing by name: boolean-based blind, time-based blind, error-based, UNION query, and stacked queries.

Use cases

  • Confirming an injection finding before reporting it
  • Proving a fix works: the same command must find nothing afterwards
  • Fingerprinting the database behind an unfamiliar application

Example

sqlmap -u "http://localhost:8000/search/?q=test" --batch --level=2 --risk=2

Related blog posts