webapp-sqlmap

SKILL.md preview

---
name: webapp-sqlmap
description: >
  Automated SQL injection detection and exploitation tool for web application security testing.
  Use when: (1) Testing web applications for SQL injection vulnerabilities in authorized assessments,
  (2) Exploiting SQL injection flaws to demonstrate impact, (3) Extracting database information for
  security validation, (4) Bypassing authentication mechanisms through SQL injection, (5) Identifying
  vulnerable parameters in web requests, (6) Automating database enumeration and data extraction.
version: 0.1.0
maintainer: sirappsec@gmail.com
category: offsec
tags: [sqli, sql-injection, webapp, database-security, exploitation, sqlmap]
frameworks: [OWASP, CWE, MITRE-ATT&CK]
dependencies:
  packages: [sqlmap, python3]
references:
  - https://sqlmap.org/
  - https://owasp.org/www-community/attacks/SQL_Injection
  - https://cwe.mitre.org/data/definitions/89.html
---

# SQLMap - Automated SQL Injection Tool

## Overview

SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection vulnerabilities. This skill covers authorized security testing including vulnerability detection, database enumeration, data extraction, and authentication bypass.

**IMPORTANT**: SQL injection exploitation is invasive and can corrupt data. Only use SQLMap with proper written authorization on systems you own or have explicit permission to test.

## Quick Start

Basic SQL injection detection:

```bash
# Test single parameter
sqlmap -u "http://example.com/page?id=1"

# Test with POST data
sqlmap -u "http://example.com/login" --data="username=admin&password=test"

# Test from saved request file
sqlmap -r request.txt

# Detect and enumerate databases
sqlmap -u "http://example.com/page?id=1" --dbs
```

## Core Workflow

### SQL Injection Testing Workflow

Progress:
[ ] 1. Verify authorization for web application testing
[ ] 2. Identify potential injection points
[ ] 3. Detect SQL injection vulnerabilities
[ ] 4. Determine DBMS type and version
[ ] 5. Enumerate databases and tables
[ ] 6. Extract sensitive data (if authorized)
[ ] 7. Document findings with remediation guidance
[ ] 8. Clean up any test artifacts

Work through each step systematically. Check off completed items.

### 1. Authorization Verification

**CRITICAL**: Before any SQL injection testing:
- Confirm written authorization from application owner
- Verify scope includes web application security testing
- Understand data protection and handling requirements
- Document allowed testing windows
- Confirm backup and rollback procedures

### 2. Target Identification

Identify potential SQL injection points:

**GET Parameters**:
```bash
# Single URL with parameter
sqlmap -u "http://example.com/product?id=1"

# Multiple parameters
sqlmap -u "http://example.com/search?query=test&category=all&sort=name"

# Test all parameters
sqlmap -u "http://example.com/page?id=1&name=test" --level=5 --risk=3
```

**POST Requests**:
```bash
# POST data directly
sqlmap -u "http://example.com/login" --data="user=admin&pass=test"

# From Burp Suite request file
sqlmap -r login_request.txt

# With additional headers
sqlmap -u "http://example.com/api" --data='{"user":"admin"}' --headers="Content-Type: application/json"
```

**Cookies and Headers**:
```bash
# Test cookies
sqlmap -u "http://example.com/" --cookie="sessionid=abc123; role=user"

# Test custom headers
sqlmap -u "http://example.com/" --headers="X-Forwarded-For: 1.1.1.1\nUser-Agent: Test"

# Test specific injection point
sqlmap -u "http://example.com/" --cookie="sessionid=abc123*; role=user"
```

### 3. Detection and Fingerprinting

Detect SQL injection vulnerabilities:

```bash
# Basic detection
sqlmap -u "http://example.com/page?id=1"

# Aggressive testing (higher risk)
sqlmap -u "http://example.com/page?id=1" --level=5 --risk=3

# Specify technique
sqlmap -u "http://example.com/page?id=1" --technique=BEUSTQ

# Detect DBMS
sqlmap -u "http://example.com/page?id=1" --fingerprint

…