sqlmap — Attack Tool

sqlmap is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws.

Tool identity and evidence

Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.

Aliases: sqlmap

Primary tool reference

Existing author guides

SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard) · 2024-11-04
SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 2. (Advanced, custom setup) · 2024-11-05

Primary documentation

sqlmap project documentation

Connected ecosystem references

Linked tags

attack_tool attack_uses

Documented actor use

Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.

APT41 · G0096 · Pinned relationship source (relationship--6ef0dcc3-19d3-42be-b842-942790e4a07f)
Ajax Security Team · G0130 · Pinned relationship source (relationship--03632545-0422-4b88-b5c8-f3b52ccfd28f)

Technique-specific simulations and detections

Detection links describe the associated behavior, not independently verified tool-specific signatures.

T1190 · Exploit Public-Facing Application · Detection rules & anomalies

Telemetry context

Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.