sqlmap 0.9

sqlmap is an automatic blind SQL injection tool.
sqlmap is an automatic blind SQL injection tool, developed in python, capable to enumerate entire remote database, perform an active database fingerprint and much more.

sqlmap's aim is to implement a fully functional database mapper tool which takes advantages of web application programming security flaws which lead to SQL injection vulnerabilities.

Main features:

  • Test of the remote url stability, based on page hash or string match;
  • Identification of url dynamic parameters;
  • Test numeric, string (single quote and double quotes) SQL injection on all url dynamic parameters and at first vulnerable it will be used to perform the future SQL injections;
  • Possible selection of HTTP method for testing and exploiting dynamic parameters, GET or POST (default: GET);
  • Fingerprint of web application database back-end based upon specific queries output which identify database characteristics and banner grabbing;
  • Random HTTP User-Agent header selection;
  • HTTP Cookie header provided, useful when web application requires authorization based on cookies and you an account;
  • Provide an anonymous HTTP proxy address to pass by request to the target url;
  • Other command line parameters to get database banner, enumerate databases, tables, columns, dump values, retrieve an arbitrary file content and provide own SQL expression to query remote database;
  • Debug output messages in verbose mode execution;
  • PHP setting magic_quotes_gpc evasion by encoding every query string, between single quotes, with CHAR (or similar) database function.
  • Reviewed the directory tree structure;
  • Splitted lib/common.py: inband injection functionalities now are
  • moved to lib/union.py;
  • Updated documentation files.

last updated on:
April 11th, 2011, 9:35 GMT
license type:
GPL (GNU General Public License) 
developed by:
Bernardo Damele
ROOT \ Database \ Database APIs
Download Button

In a hurry? Add it to your Download Basket!

user rating 16



Rate it!
What's New in This Release:
  • This version features a totally rewritten and powerful SQL injection detection engine, the ability to connect directly to a database server, support for time-based blind SQL injection and error-based SQL injection, support for four new database management systems, and much more.
read full changelog

Add your review! 1 USER REVIEW SO FAR