You have already done SQL injection the hard way: you inferred the query's shape, balanced the quotes, matched the column count, and pulled rows out of a table with a UNION SELECT. That manual skill is the foundation for this lesson — and now you will meet the tool that automates the very same loop at machine speed.
sqlmap is the de-facto standard for automated SQL injection. Hand it a candidate request and it will detect whether a parameter is injectable, work out which technique applies (boolean-blind, error-based, time-blind, UNION, or stacked queries), fingerprint the database engine, and then enumerate and extract data — databases, tables, columns, and rows — from a handful of flags. What took you several careful manual steps becomes one command.
Scope warning. sqlmap is one of the highest-impact tools in the kit. Detection alone sends many crafted requests, and the extraction modes (--dump) read real data out of a live database — a serious, irreversible action against production. Run sqlmap only against a target you own (a local lab) or one covered by a signed scope or in-scope bug-bounty asset. This is the unchanging rule from the ethics and authorization lesson: capability is never permission.About the practical. You can point sqlmap at a parameter on the bundled NovaCart application, but the cleanest workflow is to save a candidate request (from Burp/ZAP) to a file and feed it with -r. If you have no lab to hand, follow the commands closely so you can recognise them — you do not need a live dump to finish the lesson.In this lesson you will:
- See how sqlmap automates the manual UNION technique you already practised — and the other four injection families it handles.
- Supply a target with **
-u(a URL) or, better,-r(a saved raw request) — and run non-interactively with--batch**. - Enumerate with **
--dbs,--tables,--columns, and read rows with--dump**. - Understand **
--level/--risk(breadth and aggression vs. noise) and--tamper** scripts (the automated bridge to WAF bypass). - Learn why you must understand manual SQLi first — sqlmap is a force multiplier, not a substitute — and that the fix is unchanged: parameterised queries.
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.