SQL Injection is one of the oldest, and still one of the most dangerous, web vulnerabilities — category three in the OWASP Top 10 list covered in the previous article in this section. sqlmap is a free, open-source tool that almost fully automates the process of detecting and exploiting this vulnerability — work that could take hours manually, sqlmap does in minutes.
Very important: sqlmap is a powerful tool capable of directly extracting the database contents of a real application. Running it against any target without explicit, written authorization is a crime and can carry serious legal consequences. This tutorial should only be run against a local lab environment like DVWA (Damn Vulnerable Web Application), which is specifically designed for exactly this purpose.
Step 1: Install
Already installed on Kali Linux. On other distributions:
sudo apt install sqlmap
Step 2: Prepare the lab target
If you've installed DVWA on your own virtual machine (set its security level to Low to keep the exercise simple), go to its SQL Injection section and intercept a sample request — e.g., with an id parameter — through Burp Suite to get the exact URL and request parameters.
Step 3: Run a basic scan against a specific parameter
Assume the vulnerable URL looks like this:
sqlmap -u "http://192.168.1.20/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=xxxx; security=low"
sqlmap automatically tests the id parameter against dozens of different patterns to determine whether it's actually vulnerable, and if so, exactly what type of injection works (Boolean-based, Time-based, Union-based, etc.).
Step 4: Fingerprint the database
Once the vulnerability is confirmed, you can extract the database management system's type and version:
sqlmap -u "..." --cookie="..." --banner
Step 5: List the databases
sqlmap -u "..." --cookie="..." --dbs
This shows the names of every database present on the server.
Step 6: List the tables in a specific database
sqlmap -u "..." --cookie="..." -D dvwa --tables
And to see a specific table's columns and ultimately extract data:
sqlmap -u "..." --cookie="..." -D dvwa -T users --columns
Why does this level of automation matter?
In a real penetration test, time is limited. sqlmap lets you confirm in minutes whether a parameter is genuinely vulnerable, instead of spending hours manually testing dozens of injection patterns — and in your final report, show exactly how that vulnerability could lead to a full database disclosure. That kind of concrete evidence is exactly what turns a pentest report from a theoretical claim into an actionable document for the development team.
Blog