Overview

sqlmap is an open source penetration testing tool that automates the detection and exploitation of SQL injection flaws and the takeover of database servers. First released in 2006 by Bernardo Damele Assumpção Guimarães and Miroslav Štampar, it has spent two decades being refined against real engagements and community bug reports, and today ships one of the most accurate SQL injection detection engines available.

Point it at a URL, a raw HTTP request, or a Burp/WebScarab log and it will fingerprint the back-end database, confirm which payload actually exploits the flaw, and then go as far as the session user’s privileges allow — enumerating schemas, dumping data, reading and writing files, and executing operating-system commands.

Key Features

• Five injection techniques — boolean-based blind, time-based blind, error-based, UNION query, and stacked queries, each with an active fingerprinting stage that names the exact payload in use.
• 40+ database back-ends — including MySQL, MariaDB, PostgreSQL, Oracle, Microsoft SQL Server, SQLite, Firebird and IBM DB2, plus cloud data warehouses such as Amazon Redshift, Snowflake and ClickHouse.
• Deep enumeration — list databases, tables and columns, or search across every database for a given name; dump tables, ranges or individual columns, with dictionary-based password hash cracking built in.
• Full takeover and pivot — read and write files on the underlying file system, upload and execute a custom payload for an interactive shell, and cascade to further targets through Metasploit or a SQL shell.
• WAF and evasion support — detects and fingerprints Web Application Firewalls and IPS/IDS, then applies tamper scripts and request chunking to slip past them.
• Flexible input — targets can come from a single URL, a saved request file, a Burp Suite or WebScarab log, or a bulk list of URLs, with cookie, header, proxy, Tor and Google-dork options.
• Broad DBMS coverage of protocols — direct connection to a DBMS without going through the web application (the -d switch), including over SSH or SOCKS.

Why Use It

Manual SQL injection testing is slow, repetitive and easy to get wrong. sqlmap turns it into a repeatable process: it decides automatically which techniques apply, keeps a session cache so a resumed run does not repeat work, and reports the confirmed injection point rather than a guess. For a penetration tester or a DevSecOps team running authorised assessments, that combination — breadth of back-ends, depth of exploitation and a long track record — is what makes it a default choice rather than a niche tool.

Because it is a powerful offensive tool, it should only ever be run against systems you own or have written permission to test. Bundled with the tool is the same warning: use it responsibly, and never against a target you have not been authorised to assess.

Use Cases

• Authorised penetration tests — confirm and exploit SQL injection findings during an engagement, and measure the real blast radius in context.
• CI/CD security regression checks — run scripted --batch scans against a staging deployment to catch a newly introduced injection point before release.
• Bug bounty triage — quickly separate a genuine injection from a false positive, and produce evidence of impact in the report.
• CTF and lab practice — the classic tool for SQL injection challenges and intentionally vulnerable lab environments.

Platforms

sqlmap is written in Python and runs out of the box on Python 2.7 and Python 3.x on any platform — Linux, macOS, Windows, and BSD. It is packaged by most major distributions, and Windows users can run it standalone or from the pre-built package.

Licence

Free and open source. sqlmap is released under the GNU General Public License, version 2 (or later), with clarifications and exceptions; a separate commercial licence is sold for embedding sqlmap technology inside proprietary products without the copyleft obligations.

Alternatives

• Nuclei — template-driven vulnerability scanner for broad, repeatable web checks
• Browse more security tooling in the directory