sqlmap Tutorial for Beginners

sqlmap automates the tedious parts of SQL injection: detecting the injectable parameter, fingerprinting the database, and extracting data character by character. It is the right tool once you understand the manual technique, because then you can point it precisely and read its output critically. Use it only on targets you are authorized to test, like WebVerse labs.

What sqlmap does, and when to go manual

sqlmap probes parameters with its own payloads, confirms an injection, identifies the DBMS, and then enumerates or dumps on request. It shines at blind extraction, the exact per-character binary search you would otherwise script by hand. It is weaker at unusual injection points (a custom header, a nested JSON field, a second-order sink) and it is loud, so for a quiet or oddly shaped target, manual testing still wins. Know both.

Pointing it at a request

The reliable way to run sqlmap is to give it a real request. Capture the full HTTP request from your proxy (including cookies, headers, and body), save it to request.txt, and run:

sqlmap -r request.txt

Mark the parameter to focus on with an asterisk in the saved request, or pass -p <param>. Feeding the whole request means sqlmap tests exactly what the app receives, authentication and all.

Levels, risk, and enumeration

--level (1 to 5) widens where sqlmap injects (adding headers, cookies) and --risk (1 to 3) allows heavier payloads. Raise them when a default run finds nothing:

sqlmap -r request.txt --level=5 --risk=3
sqlmap -r request.txt --dbs                 # list databases
sqlmap -r request.txt -D appdb --tables     # list tables
sqlmap -r request.txt -D appdb -T users --dump   # dump a table

Add --batch to accept defaults non-interactively, and --threads to speed up blind extraction.

Tamper scripts for WAFs

When a filter blocks sqlmap's payloads, tamper scripts rewrite them using the same ideas as manual WAF evasion: case swaps, inline comments, encoding:

sqlmap -r request.txt --tamper=space2comment,between,charencode
sqlmap --list-tampers        # see what is available

Pick tampers that match the filter you observed, since stacking irrelevant ones just adds noise.

Getting a shell

Where the database privileges allow it, sqlmap can escalate to the primitives from SQL injection to RCE:

sqlmap -r request.txt --os-shell      # interactive OS command shell
sqlmap -r request.txt --sql-shell     # interactive SQL shell

These need the right privileges and a writable path or xp_cmdshell, so they fail on locked-down targets, as they should.

Using it responsibly

sqlmap sends a lot of traffic and can modify data with higher risk settings. Only run it against systems you own or are explicitly authorized to test. WebVerse labs are built for exactly this, so sign up free and point it at a live target to watch it work end to end.