sqlmap is a free, open-source tool that automates the detection and exploitation of SQL injection vulnerabilities. Given a request with an injectable parameter, it fingerprints the backend database, confirms the injection type (boolean, error-based, time-based, union, stacked), and can then enumerate databases, tables and columns, dump data, read or write files, and in some cases run operating-system commands. It is the standard tool for testing and demonstrating SQL injection impact.
Last updated: 6 August 2026
sqlmap takes the manual grind out of SQL injection. A tester points it at a suspicious URL or a saved request file, and it works out whether the parameter is injectable and how, then supports the full exploitation chain: list the databases, pick a table, and dump its rows to prove the data is exposed. It supports many DBMSes, can use a saved Burp request for authenticated testing, and can escalate to file access or command execution where the configuration allows. It is used both to find injection and to show its real business impact.
Linux · Windows · macOS
Open source (GNU GPLv2)
sqlmap -u "https://example.com/item?id=1" --batchTest a single parameter for SQL injection non-interactively.
sqlmap -u "https://example.com/item?id=1" --dbsEnumerate the available databases once injection is confirmed.
sqlmap -u "https://example.com/item?id=1" -D shop --tablesList the tables inside a chosen database.
sqlmap -u "https://example.com/item?id=1" -D shop -T users --dumpDump the rows of a specific table.
sqlmap -r request.txt --batchUse a saved raw HTTP request (for example from Burp) to test authenticated endpoints.
sqlmap -u "https://example.com/item?id=1" --level=3 --risk=2Increase test depth and risk to detect harder-to-find injections.
sqlmap -u "https://example.com/item?id=1" --os-shellAttempt an interactive OS shell where the DBMS and privileges permit.
sqlmap actively exploits injection and can read, modify or destroy data, so run it only against applications you own or are explicitly authorised, in writing, to test. Unauthorised use is a clear offence under the IT Act 2000. Even within scope, dumping live customer data can breach privacy obligations, so agree data-handling rules beforehand.
Automated detection can miss context-specific injections and can trigger false positives; a human should confirm results. Aggressive options like --dump, --os-shell or high --risk can damage or overload production databases. WAFs and input filtering can block it, and it only tests injection, not other web vulnerability classes.
| Tool | Pick it when |
|---|---|
| Burp Suite (manual + scanner) | You want to find and understand injection by hand or across a whole app. |
| Ghauri | You want a sqlmap-style tool that handles some WAF/edge cases differently. |
| NoSQLMap | The backend is a NoSQL database such as MongoDB rather than SQL. |
| jSQL Injection | You prefer a lightweight GUI for basic injection testing. |
| Manual payloads | You need precise control to bypass filters sqlmap cannot handle automatically. |
Ethical Hacking Course (6 months) — web application security (injection) module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000