sqlmap

sqlmap is an open-source penetration testing tool that automatically detects and exploits SQL injection vulnerabilities in web applications. SQL injection is a type of security flaw where an attacker can send specially crafted input to a website's database queries, causing the database to reveal data it should keep private — or even accept commands. Finding and demonstrating these vulnerabilities manually is time-consuming; sqlmap automates the entire process.

The tool works by taking a URL or a set of HTTP request parameters and systematically testing many different injection techniques — including techniques that are time-based (the database pauses for a moment if the injection succeeded) and techniques that cause errors, allowing sqlmap to infer information about the database structure. Once it confirms a vulnerability exists, it can automatically extract the database schema, dump table contents, retrieve file contents from the server, and in some cases execute operating system commands through the database connection. It supports a wide range of database systems including MySQL, PostgreSQL, Microsoft SQL Server, Oracle, and others, and includes fingerprinting capabilities to identify which database is running.

You would use sqlmap during authorized security assessments — for example, testing a web application you own or have explicit permission to test, as part of a penetration test or a bug bounty program. It is a standard tool in security professionals' toolkits for demonstrating the real-world impact of SQL injection to developers and stakeholders. sqlmap runs on any platform supporting Python 2.7 or Python 3.x with no additional dependencies required beyond a Python installation.