Web security
sqlmap for Beginners: Testing SQL Injection in a Lab
sqlmap automates the checking and exploitation of SQL injection. It saves time, but it does not replace understanding, so learn the flaw first with SQL injection explained. Run it only against your own lab or systems you have written permission to test. Pointing it at a live site without permission is illegal and can damage data.
Set Up a Target
Use DVWA in a virtual machine and set its security level to low. In the examples, 192.168.56.20 is the lab server. DVWA needs a login, so copy your session cookie from your browser (or from Burp Suite).
Test One Parameter
sqlmap -u "http://192.168.56.20/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=YOURSESSION; security=low" --batch
--batch accepts the default answers. sqlmap reports whether the id parameter is injectable and which technique worked, such as boolean-based or time-based.
Look Around, Then Stop
- Add
--dbsto list databases. - Add
-D dvwa --tablesto list tables in one database. - Add
-D dvwa -T users --columnsto list columns. - Dump data only from lab databases you created.
In a real engagement you stop as soon as you prove the flaw, and the report says what could be reached. You do not copy customer data.
Settings That Matter
--leveland--riskmake tests broader and riskier. Keep the defaults until you know why you need more.--delay 1slows requests.--random-agentchanges the user agent, which helps in a lab where you study detection.- Save the output directory; it holds a log of every request.
Then Fix It
The fix is parameterized queries, not a filter. Read the defense side in SQL injection explained and the report advice in how to write a penetration testing report. The skill is taught in our Application Security course.
Sources and Further Reading
Want to test and report on a vulnerable web app with a trainer? Book free trial classes. Contact us or call +91 86868 92922.
Courses Mentioned in This Guide
More Guides
ffuf Commands for Beginners: Find Hidden Web Paths in a Lab
ffuf commands and cheat sheet: find directories and files, use filters and rate limits and read the results, with examples for a lab you own.
Read the guide →OWASP ZAP for Beginners: A Free Web Vulnerability Scanner
Learn OWASP ZAP step by step: proxy your browser, spider a site, run passive and active scans, read alerts and use the baseline script, in a lab you own.
Read the guide →SQL Injection Explained: How It Works and How to Prevent It
SQL injection in plain language: how it works, in-band and blind variants, real impact, how testers find it legally, and the fixes developers should use.
Read the guide →Cross-Site Scripting (XSS) Explained for Beginners
XSS in plain language: reflected, stored and DOM-based cross-site scripting, what an attacker can do, how testers find it, and how developers prevent it.
Read the guide →Start Your Cyber Security Career
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps