Skip to main content

​
Overview

The SQLi Exploiter confirms SQL injection vulnerabilities and extracts data from databases to demonstrate impact. It provides a web interface for SQLMap, the industry-standard SQL injection exploitation tool. The SQLi Exploiter is an offensive tool: it actively exploits SQL injection vulnerabilities to extract database contents. It does not add data to your Attack Surface and does not generate findings. Results are displayed as a detailed report with extracted data and injection point details.

​
Supported targets

Provide the exact URL with parameters you want to test. The tool will attempt to identify and exploit vulnerable parameters.

​
Scan options

​
HTTP method

When using POST method, provide the POST data in the format param1=value1&param2=value2.

​
Enumeration

Select what data to extract from the database:

​
Light crawling

When enabled, SQLMap crawls the website up to second-level links to discover additional injection points automatically. This is useful when:
  • You don’t know which exact URL is vulnerable
  • You want to test multiple pages from a starting URL
  • The vulnerable parameter might be on a linked page
Light Crawling increases scan time as it discovers and tests multiple pages. Disable it if you already know the exact vulnerable URL and parameter.

​
Advanced options

Toggle Advanced to access additional configuration:

​
Authentication

Use cookies to test authenticated pages or maintain session state during exploitation.
For detailed authentication configuration, see Authenticated scanning.

​
Injection targeting

Supported databases:
  • MySQL
  • Oracle
  • PostgreSQL
  • Microsoft SQL Server
  • Microsoft Access
  • IBM DB2
  • SQLite
  • Firebird
  • Sybase
  • SAP MaxDB
  • HSQLDB
  • Informix

​
Payload generation

Use prefix/suffix when the injection point requires specific SQL syntax to close statements or comments.

​
Tamper scripts

Modify payloads to bypass WAFs or filters:

​
Detection settings

Risk level 3 includes OR-based SQL injection tests that could potentially modify or delete data. Use with caution and only on test environments.

​
Techniques

Select which SQL injection techniques to use:
For faster scans, disable techniques you know won’t work. For example, if error messages are suppressed, disable Error-based (E).

​
Rate limiting

Increase delay to avoid triggering rate limits or intrusion detection systems.

​
Form testing

​
How it works

The SQLi Exploiter follows this process:
  1. Parameter discovery: Identifies injectable parameters in the URL, POST data, or forms
  2. Injection testing: Tests various SQL injection techniques against each parameter
  3. Database fingerprinting: Identifies the database type and version
  4. Data extraction: Extracts requested information using confirmed injection points
  5. Report generation: Displays extracted data, injection points, and SQLMap output
The report includes:
  • Summary: Current user, database, hostname, banner, and DBMS users
  • Databases and Tables: List of databases with table counts and names
  • Usernames and Passwords: Extracted credentials from user tables
  • Injection Points: Vulnerable parameters with technique and payload details
  • Console: Raw SQLMap output for detailed analysis

​
Important considerations

Only use exploitation tools against systems you have explicit written authorization to test. Data extraction may have legal implications even with permission.

​
Ethical guidelines

  • Get explicit written authorization before testing
  • Minimize data extraction, extract only enough to prove the vulnerability
  • Handle extracted data securely and delete after engagement
  • Report findings responsibly to asset owners
  • Document all actions for audit purposes

​
During testing

  • Avoid modifying or deleting data
  • Use lower risk levels on production systems
  • Monitor for unintended impact
  • Stop immediately if unexpected issues occur

​
Follow-up actions

After exploiting SQL injection:
  • Document findings: Include extracted data samples (sanitized) in reports
  • Assess full scope: Determine what other data is accessible
  • Test remediation: Re-test after fixes are applied
  • Check related issues: SQL injection often indicates broader input validation problems
  • Run Website Scanner: Check for other web vulnerabilities
  • Use Sniper: Test for additional exploitable vulnerabilities