Exploiting SQL
Injection
Vulnerabilities with
sqlmap: A
Practical Guide
suvojit paul
1|Page
What is SQL Injection (SQLi)
SQL Injection (SQLi) is a web security vulnerability that allows an attacker
to interfere with the queries that an application makes to its database. It
occurs when user-supplied input is improperly sanitized before being
included in an SQL query. This can give attackers unauthorized access to
data, and in some cases, control over the database server.
Types of SQL Injection (SQLi)
Error-Based SQLi – Uses database error messages to extract data.
Union-Based SQLi – Uses UNION SQL operator to fetch data from other
tables.
Boolean-Based Blind SQLi – Infers data by observing true/false behavior.
Time-Based Blind SQLi – Uses time delays to detect true/false conditions.
Out-of-Band SQLi – Sends data through external channels like DNS or
HTTP.
Second-Order SQLi – Injected data is stored and executed later.
Stored (Persistent) SQLi – Malicious input is saved in the database and
triggered later
What is DataBase
A database in a web server environment is a structured storage system
used to store, retrieve, and manage data that powers dynamic websites and
web applications.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
2|Page
Database Structure
Goal of SQL Injection Attack
The goal of an SQL Injection (SQLi) attack is to manipulate database queries to:
• Bypass authentication
• Access, steal, or delete sensitive data
• Modify database content
• Gain administrative privileges
• Execute system commands (in advanced cases)
What is sqlmap?
sqlmap is an open-source penetration testing tool that automates the
process of detecting and exploiting SQL Injection (SQLi) vulnerabilities in
web applications.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
3|Page
Flag Use Case Example
Target URL with vulnerable
-u -u "[Link]
parameter
Specify POST data for --data
--data
testing "username=admin&password=123"
--cookie Test SQLi using cookies --cookie="PHPSESSID=abcd1234"
Define HTTP method (e.g.,
-method --method=POST
PUT, POST)
--headers Add custom HTTP headers --headers="X-API-Key: 12345"
Flag Use Case Example
Set test intensity (1–5, higher = more
--level --level=5
tests)
--risk Set risk level of tests (1–3) --risk=3
Limit testing to specific SQLi types (B,
--technique --technique=BU
U, T, E, S, Q)
Flag Use Case Example
--dbs List all available databases --dbs
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
4|Page
Flag Use Case Example
--tables -D
--tables List tables in a specific database
dbname
--columns -D
--columns List columns in a specific table dbname -T
tablename
--dump -D
--dump Dump data from a table or database dbname -T
tablename
--schema Dump database schema --schema
Practical Part: SQL Injection Using sqlmap:
Target website, Copy the website
URL -[Link]
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
5|Page
Try to find the Databases.
Two databases found.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
6|Page
Now, try to find the tables from acuart database.
Table enumeration completed.
Now, try to find the Columns from users table.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
7|Page
Columns are.
Now it’s time to dump the user name and password.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
8|Page
Dump result
Now try to login on - [Link]
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
9|Page
I logged in successfully.
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]
10 | P a g e
Thank you
SUVOJIT PAUL
Subhojitpaul218@[Link]
[Link]