About
sqlmap probes request parameters for SQL injection flaws. Once it finds one, it can enumerate the databases behind the endpoint. Use it only on applications you own or have written permission to test.
Install it
pkg install sqlmap
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
6 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
sqlmap -u "https://example.com/item?id=1" --batch Probe a parameter for injection flaws on an application you own or are authorised to test, running unattended. sqlmap -u "https://example.com/item?id=1" --dbs List the database names once an injectable parameter is found. sqlmap -r request.txt --batch Replay a saved HTTP request. Headers and cookies go out exactly as captured. sqlmap --data="id=1" -u https://example.com/api Test a POST body parameter rather than a query string. sqlmap -u "https://example.com/item?id=1" --tables -D appdb Enumerate the tables in a specific database during an authorised assessment. sqlmap -u "https://example.com/item?id=1" --risk 3 --level 5 Raise the number of payloads and tests. Slower, but more thorough. Worked example
Run sqlmap -u "https://example.com/item?id=1" --batch and this is what you should see.
$ sqlmap -u "https://example.com/item?id=1" --batch
[INFO] testing connection to the target URL
[INFO] GET parameter id appears to be injectable
[INFO] the back-end DBMS is MySQL
available databases [2]:
[*] appdb
[*] information_schema Developed by
Bernardo Damele and Miroslav Stampar .