$ man sqlmap

sqlmap

Detects and exploits SQL injection automatically.

test itsends requests to the targetvia awesome-security

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

## why a developer should care

If you are unsure whether a parameter is injectable, sqlmap will tell you - and show how much data an attacker could pull. Use on staging with test data.

## install

Other platforms and pre-built binaries: official install guide ↗

Check it worked: open a new terminal and run sqlmap --version. "command not found" means it isn't installed or isn't on your PATH yet.

## shortcuts

## helps with

• A05 Injection

→ official docs · ← all tools