sqlmap is an automated penetration testing tool that detects and exploits SQL injection vulnerabilities in web applications. Its core functionality includes database fingerprinting, data extraction (tables, columns, users, passwords), file system read/write, OS command execution, and out-of-band exfiltration via DNS or ICMP. The architecture is a modular monolith: a central controller orchestrates DBMS-specific plugins (30+ databases), injection technique engines (boolean blind, error-based, UNION, time-based, stacked queries, DNS, OData, SPARQL, JWT, NoSQL, etc.), and tamper scripts for WAF bypass. The tool exposes both a CLI (sqlmap.py) and a REST API (sqlmapapi.py). External dependencies are minimal—most third-party libraries are vendored (chardet, colorama, beautifulsoup, pydes, fcrypt). The codebase demonstrates deep knowledge of SQL dialects, HTTP protocol handling, and security research, with extensive offline test suites and deterministic test harnesses. Notable technical strengths include pure-Python protocol clients (TDS, Kerberos, gRPC-Web), disk-spilling data structures (BigArray), and a safe JSON serializer that replaces pickle. Drift risks include remnants of Python 2 compatibility shims, bundled crypto implementations, and static fingerprinting data that may lag behind new DBMS versions.
This repository contains a collection of example SQLMap command lines for bypassing Web Application Firewalls (WAF) during SQL injection penetration testing. It is essentially a cheat sheet or reference guide, not a software application. The content is provided in plain text files with various tamper script combinations and techniques. The repository has no actual code, scripts, or executable components; it solely consists of documentation and example usage. While the commands may be useful for security professionals, the repository itself is not a functional tool and has seen no active development since its creation around 2021.