Typorithm · hard

SQL Injection (sqlmap)

sqlmap-injectionpentestsqlisqlmapdatabase

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn SQL Injection (sqlmap)

Web App Testing

sqlmap automates detecting and exploiting SQL injection during authorized testing: -u tests a URL, -r replays a captured request, and --dbs/--tables/--dump enumerate databases, tables, and data to demonstrate impact for the report. The remediation is parameterized queries (prepared statements) plus least-privilege database accounts.

SQL injection happens when user input is concatenated into a query, letting an attacker alter its logic. sqlmap automates finding and exploiting it: with -u and a parameter it probes for injectable points, and --batch runs non-interactively with sensible defaults.

Against a captured request saved to a file, -r replays it so sqlmap tests every parameter and header. --dbs lists databases, -D app --tables scopes to one database's tables, and --dump extracts rows — each step demonstrating impact for the report while a careful tester limits exposure of real data.

The fix is structural: use parameterized queries (prepared statements) so input is always data, never code, and run the application's database account with least privilege so even a successful injection reaches little. An ORM, allow-listed inputs, and a WAF add further depth.

SQLi = untrusted input concatenated into a query.

sqlmap -r replays a saved request; --dbs/--tables/--dump enumerate.

Fix: parameterized queries + least-privilege DB accounts.

sqlmap -u "https://t/item?id=1" --batch
sqlmap -r request.txt --dbs
sqlmap -r request.txt -D app --tables
sqlmap -r request.txt --dump

Read the implementation

Connect each part of the code to the concept before you type.

1. Test a URL

-u points sqlmap at a URL with a candidate injectable parameter; --batch accepts defaults non-interactively.

sqlmap -u "https://t/item?id=1" --batch

2. Enumerate databases

-r replays a captured request from a file; --dbs lists the database names to demonstrate impact.

sqlmap -r request.txt --dbs

3. List tables

-D selects a database and --tables enumerates its tables, scoping the proof of impact.

sqlmap -r request.txt -D app --tables

4. Dump data

--dump extracts data to evidence the vulnerability; in a real engagement testers minimize and avoid sensitive records.

sqlmap -r request.txt --dump

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.