SQLMap - Cheetsheat

👉 Overview

👀 What ?

SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.

🧐 Why ?

SQLMap is important because it helps cybersecurity professionals to detect vulnerabilities in databases and applications that could be exploited by malicious actors. These vulnerabilities can lead to data breaches and unauthorized access to sensitive information.

⛏️ How ?

SQLMap is used by providing it with a vulnerable HTTP request. The tool then tests different SQL injection techniques and if it finds an injection point, it can be used further to exploit the vulnerability, e.g., to read, write or delete data in the database.

⏳ When ?

SQLMap has been in use since its release in 2006.

⚙️ Technical Explanations

SQLMap works by sending different types of SQL queries to the target and observing the response. If the response is different based on the SQL query, it's a clear indication that the application is vulnerable to SQL Injection. SQLMap supports a broad range of DBMS, including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, and many others. It offers functionalities like database fingerprinting, data fetching from the database, accessing the underlying file system, executing commands on the operating system via out-of-band connections and much more.