Dictionary · Ethical Hacking Tools
sqlmap
Web testing · Advanced
A tool that automates the detection of SQL injection in a web application you are authorized to test. It looks for places where input changes a database query's meaning.
It helps a tester check whether user input is being mixed into a database query. The defensive lesson is to use parameterized queries. The tool is not a way to browse a database you do not own.
Example: A test of a training application reports that one search box changes the query structure. Developers fix it with parameters and the retest is clean.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Detect SQL injection in an application covered by the test scope.
Authorized use: Test only applications you own or have written permission to assess. Git in the Zone does not include extraction commands or target URLs.
Operating systems: Python-based, commonly used on Linux, Windows, and macOS.
Language you will see
- parameter
- query
- detection
How to read the options
- Detection: The useful first result is that input can change a query. The fix is in the application, usually parameterized queries.
- Parameter: One input the application accepts. Not every input is in scope just because it exists.
Common misconception
- Detecting a query flaw is a development finding. It is not an invitation to extract data from a system outside the written test.