SQLMap Complete Tutorial 2026: Install, SQL Injection Testing & Automation

Pentest & Bug Bounty

Confirm and exploit an injection point in seconds, then prove impact by extracting a benign proof row for the report — without hand-writing payloads for each DBMS.

Regression Testing

Re-run a saved SQLMap session against a fixed endpoint in CI to verify a patched parameter is no longer injectable before release.

Detection Tuning

Generate real attack traffic in a lab to validate that your WAF rules, SIEM analytics, and app logs actually catch injection attempts.

Training

Teach analysts what a live SQLi looks like on the wire — payloads, timing, and the tell-tale error strings the DBMS returns.

The fastest safe target is DVWA in a container. It exposes a classic ?id= injection on the SQL Injection page. Run it on an isolated host and never expose port 8080 to the internet.

Log in, click Create / Reset Database, then open DVWA Security and set the level to Low for your first run. You will raise it to Medium and High later to practise tamper scripts.

DVWA requires a session cookie plus a security cookie. SQLMap needs both to reach the vulnerable page. Copy them from your browser's developer tools (Application → Cookies) or from a Burp-captured request.

Kali Linux ships SQLMap in the default kali-linux-default metapackage. Before installing anything, check whether it is already present and what version you have.

On Debian, Ubuntu, Parrot or a minimal Kali build, install from the distribution repositories. Update the package index first so you get the current packaged release.

Confirm the binary runs, Python resolves, and the help text renders. The --dependencies flag reports optional libraries for advanced features (e.g. connecting directly to a DBMS, or Metasploit integration).

This is the maintainers' recommended method and always gives you the newest engine. A shallow clone keeps the download small. Works identically on Linux, macOS and Windows (WSL or native).

From a source clone you invoke python3 sqlmap.py rather than a global sqlmap command. Add a shell alias so the rest of this guide's commands work verbatim.

SQLMap has a built-in updater that pulls the latest commit when run from a Git checkout. Either flag works; both fast-forward your clone.

On modern Linux, PEP 668 blocks a system-wide pip install. pipx installs SQLMap into its own virtual environment and drops a global sqlmap command onto your PATH — clean and reversible.

A container keeps the tool and its Python runtime off your host entirely — handy for CI runners or a shared jump box. There is no official image, so build a tiny one from the source repo.

This compose file stands up the whole range in one command: a DVWA target and the SQLMap image on a shared, isolated network. From the SQLMap container, the target is reachable as http://dvwa.

Start minimal: give SQLMap the URL and the cookies, and add --batch so it answers its own prompts with sensible defaults. It will test the id parameter and report which techniques land.

Once a parameter is confirmed, SQLMap caches the result in a session file so subsequent commands skip re-detection and jump straight to the data.

For POST forms, pass the body with --data and SQLMap flips to POST automatically. Use -p to test only one parameter when a request has many, which is faster and quieter.

The cleanest way to handle authenticated, header-heavy, or JSON endpoints is to save the raw HTTP request to a file and hand it over with -r. SQLMap parses every header, cookie and body field, and tests them all.

Chain the low-noise identity checks first. Knowing the DBMS, the current user, and whether that user is a DBA shapes every decision that follows — a DBA opens up file and OS access; a low-priv user does not.

Descend the hierarchy. Narrow with -D (database) and -T (table) so you only extract what matters instead of dumping the whole server.

Extract specific columns rather than whole tables. In a real engagement you dump the minimum needed to prove impact — a single row, or just the username and hash columns — not the entire customer table.

SQLMap recognises common hash formats during a dump and will offer to crack them against a built-in dictionary. Extracted data is written to CSV under the output directory, keyed by target host.

For ad-hoc queries, drop into an interactive SQL shell that runs each statement through the injection point. And because SQLMap caches everything, you can pause and resume long jobs at will.

If a quick scan comes up empty, raise the level to test cookies and headers, and the risk to allow heavier payloads. This is the standard "second pass" when you suspect an injection the defaults skipped.

When you already know the backend, tell SQLMap. Restricting the technique and naming the DBMS cuts the request count dramatically and avoids wasting time on tests that cannot succeed.

Threads accelerate data retrieval; delays and randomised agents slow you down to stay under rate-based detection. Pick a lane based on whether you are racing a lab clock or evading a SOC.

SQLMap can detect a WAF/IPS with --identify-waf, then reshape payloads with one or more tamper scripts. List every script with --list-tampers; chain them left-to-right with commas.

If the DB user has file privileges (e.g. MySQL FILE, or MSSQL/PostgreSQL equivalents), SQLMap can read arbitrary files and, where secure_file_priv allows, write to the web root — a classic path to a web shell.

When stacked queries and privileges align, --os-shell deploys a stager through the injection and hands you an interactive command prompt on the database server. --os-cmd runs a single command non-interactively.

Send SQLMap traffic through Burp to inspect and log every request, or through Tor to rotate source addresses. Proxying through Burp is invaluable for understanding exactly what the tool sends.

SQLMap can discover its own targets: crawl a site to a given depth, auto-submit forms, or (in a lab) seed from a search dork. Use these to broaden coverage across an in-scope application.

This query flags the default SQLMap User-Agent and classic injection markers in web request logs, plus a volumetric burst from a single client to a single URI. Adjust the table name to your web-log source.

The Splunk equivalents: one search on the User-Agent and payload signatures, one on request volume per source. Point them at your web-access sourcetype.

Most "SQLMap isn't working" problems are request-context issues, not the tool. This table covers the ones that account for the majority of failed first scans.

Keep the engine current, know where your loot lands, and wipe engagement data when the report is delivered. Output (sessions, logs, CSV dumps) is stored per target under the SQLMap output directory.