sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About sqlmap
sqlmap takes a URL or a request and works out whether a parameter is injectable, what database is behind it, and how far the injection reaches. Its detection engine covers the main injection techniques, and once it has a foothold it can fingerprint the database, enumerate and dump data, read and write files on the underlying filesystem, and in some configurations execute operating system commands through out-of-band connections.
That last capability is why it belongs firmly in authorised testing only. Pointed at a web application you own or have written permission to test, it is the fastest way to find out whether an injection flaw is real and how much it exposes.
It is pure Python, works on any platform with Python 2.7 or 3.x, and is dual licensed under the GPL and a commercial licence.
Strengths
- A powerful detection engine covering the main SQL injection techniques
- Fingerprints the database and enumerates or dumps data once a flaw is confirmed
- Can reach the underlying filesystem and, in some cases, the operating system
- Pure Python, so it runs anywhere with no compilation
Limitations
- Only legitimate against applications you own or are authorised to test
- Aggressive settings can damage data in the target database
- A very large option surface with a real learning curve
- Web application firewalls block it easily, which hides real flaws
Details
- Pricing
- Free · Dual licensed: free and open source under GPLv2, with a separate commercial licence available.
- License
- GPL-2.0
- Developer
- sqlmap project
- Platforms
- Windows, macOS, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Testing your own web application for SQL injection before an attacker does
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Selected from the TechWalrus downloads catalog (Security); facts checked against the developer's own pages, 3 sources on file.