Skills sqlmap-database-penetration-testing
📦
sqlmap-database-penetration-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access
Assess SQL Injection with SQLMap
SQL injection testing needs repeatable checks and strict scope control. This skill guides authorized SQLMap workflows for discovery, enumeration, and reporting.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "sqlmap-database-penetration-testing" from https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-sqlmap-database-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "sqlmap-database-penetration-testing". Authorized tester asks for a safe first SQLMap assessment plan.
Expected outcome:
A scoped test plan with target confirmation, low-impact detection, evidence capture, and reporting checkpoints.
Using "sqlmap-database-penetration-testing". Security engineer asks how to enumerate a confirmed lab injection.
Expected outcome:
A staged workflow covering database discovery, table review, column review, and minimal proof collection.
Using "sqlmap-database-penetration-testing". Instructor asks for a classroom exercise about SQL injection impact.
Expected outcome:
A lab-focused lesson outline with prerequisites, controlled target assumptions, expected observations, and ethics reminders.
Security Audit
Criticalv5 • 7/7/2026 Open versioned report
The static Ruby backtick findings are Markdown false positives, but the skill contains high-risk offensive SQLMap guidance. Confirmed issues include sensitive file access, remote command execution, public target exploitation examples, credential dumping, and evasion guidance.
1
Files scanned
401
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
System password file access
sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
The example directs SQLMap to read /etc/passwd from a target server. That is sensitive file access through exploitation, even if presented as guidance.
Critical
Post-Exploitation Server Control Guidance
The advanced section shows OS shell access, OS command execution, server file reads, and server file writes through SQLMap. These actions can lead to full target host compromise.
The cited section directly includes SQLMap OS shell, OS command, file-read, and file-write operations against a target server.
High
System reconnaissance
sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
The command runs whoami on the target through SQLMap OS command execution. This is post-exploitation command execution guidance.
High
Credential and Sensitive Data Dumping Guidance
The skill lists extracted usernames, passwords, hashes, and sensitive data as deliverables and provides SQLMap dump workflows. This enables unauthorized database data extraction if used outside approved scope.
The text explicitly names credential and hash extraction and shows table, column, and full database dump workflows.
High
Evasion and Unscoped Target Discovery Guidance
The skill includes Google dork target discovery, random user agents, Tor proxying, request delays, and WAF tamper scripts. These tactics are useful for unauthorized discovery and evasion.
The cited lines combine target discovery with anonymity, rate-limit avoidance, user-agent rotation, and WAF tamper guidance.
Medium
System reconnaissance
- Consider `--delay` to avoid triggering rate limits
The advice recommends delays to avoid triggering rate limits. This can reduce operational impact, but it also supports evasion during scanning.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Risk Factors
⚙️ External commands (92)
SKILL.md:17 SKILL.md:37-43 SKILL.md:43-46 SKILL.md:46-52 SKILL.md:52-57 SKILL.md:57-59 SKILL.md:59-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-69 SKILL.md:69-71 SKILL.md:71-74 SKILL.md:74-75 SKILL.md:75-80 SKILL.md:80-82 SKILL.md:82-85 SKILL.md:85-86 SKILL.md:86-91 SKILL.md:91-93 SKILL.md:93-96 SKILL.md:96-98 SKILL.md:98-101 SKILL.md:101-103 SKILL.md:103-106 SKILL.md:106-107 SKILL.md:107-108 SKILL.md:108-113 SKILL.md:113-116 SKILL.md:116-119 SKILL.md:119-122 SKILL.md:122-125 SKILL.md:125-130 SKILL.md:130-133 SKILL.md:133-136 SKILL.md:136-144 SKILL.md:144-145 SKILL.md:145-146 SKILL.md:146-147 SKILL.md:147-148 SKILL.md:148-171 SKILL.md:171-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-182 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198 SKILL.md:198-210 SKILL.md:210-211 SKILL.md:211 SKILL.md:212-222 SKILL.md:222-223 SKILL.md:223-224 SKILL.md:224-229 SKILL.md:229-244 SKILL.md:244-247 SKILL.md:247-257 SKILL.md:257-260 SKILL.md:260-267 SKILL.md:267-270 SKILL.md:270-276 SKILL.md:276-279 SKILL.md:279-293 SKILL.md:293-296 SKILL.md:296-308 SKILL.md:308-315 SKILL.md:315-327 SKILL.md:327-332 SKILL.md:332-347 SKILL.md:347-352 SKILL.md:352-361 SKILL.md:361-366 SKILL.md:366-372 SKILL.md:372-377 SKILL.md:377-386 SKILL.md:386-391 SKILL.md:391-400
🌐 Network access (27)
SKILL.md:39 SKILL.md:48 SKILL.md:51 SKILL.md:58 SKILL.md:70 SKILL.md:81 SKILL.md:92 SKILL.md:97 SKILL.md:102 SKILL.md:127 SKILL.md:128 SKILL.md:231 SKILL.md:235 SKILL.md:239 SKILL.md:243 SKILL.md:262 SKILL.md:263 SKILL.md:272 SKILL.md:275 SKILL.md:281 SKILL.md:288 SKILL.md:298 SKILL.md:301 SKILL.md:304 SKILL.md:307 SKILL.md:262 SKILL.md:263
Detected Patterns
System password file accessSystem reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-sqlmap-database-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-sqlmap-database-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). sqlmap-database-penetration-testing security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5BibTeX citation
@techreport{sickn33-sickn33-sqlmap-database-penetration-testing-2026,
author = {sickn33},
title = {sqlmap-database-penetration-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sqlmap-database-penetration-testing security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-sqlmap-database-penetration-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Validate Scoped Web Applications
Plan SQLMap checks for a client-approved URL and document injection evidence without exceeding scope.
Confirm Remediation In Staging
Retest a fixed endpoint in a controlled environment and compare current behavior with the prior finding.
Teach Database Attack Concepts
Build lab exercises that explain SQL injection enumeration, impact, and reporting responsibilities.
Try These Prompts
Begin Authorized Check
I have written authorization to test this lab endpoint. Help me plan a low-impact SQLMap check and reporting notes.
Map Database Structure
For an authorized training target, outline the SQLMap sequence to enumerate databases, tables, and columns safely.
Use Captured Requests
I have a scoped HTTP request file from my engagement. Explain how to test the chosen parameter and record evidence.
Plan Advanced Retesting
Within an approved staging environment, help me tune SQLMap options for reliability while minimizing traffic and data access.
Best Practices
- Confirm written authorization and exact scope before any scan.
- Use owned systems, staging environments, or purpose-built training labs.
- Collect the minimum evidence needed and avoid unnecessary sensitive data dumps.
Avoid
- Running scans against unknown domains or search results.
- Dumping credentials when limited proof is enough.
- Using evasion or anonymity options to bypass monitoring.
Frequently Asked Questions
Does this skill run SQLMap automatically?
No. It provides guidance and example workflows. Users must run tools themselves in authorized environments.
Can I use it on public websites?
Only with explicit written permission. Unapproved testing can be illegal and harmful.
What tools does it assume?
It assumes SQLMap is installed and that the user can capture or supply valid HTTP requests.
Does it help with reporting?
Yes. It highlights evidence, database enumeration steps, limitations, and legal scope reminders.
Can it bypass security controls?
The source includes evasion examples. Use such options only when they are explicitly allowed by scope.
Is it suitable for beginners?
It can help beginners in labs, but users need basic web security knowledge and clear authorization.