sqlmap - security development in Python
summary
SQLmap is an all‑in‑one SQL injection tool claiming ~10k downloads per month and about 200 active testers; it runs on Python 2 and integrates with Metasploit to upload web shells and get reverse shells. The code implements five injection techniques (blind, error, UNION, time, stacked), DBMS‑specific plugins and a pivoting method for obscure engines, automated hash cracking via hashlib, multi‑threading, page dynamic content removal, statistical timing detection to cut false positives, and 14 tamper scripts for IDS/IPS evasion; a GUI and professional reporting are planned.
AI-written summary · about
chapters (19)
- 0:00Start
- 3:24Short history
- 13:41Project statistics (ohloh.net)
- 15:39Features (2)
- 16:27Community
- 18:13SQL Injection for dummies
- 27:31Error-based technique (2)
- 29:12Union query technique (2)
- 30:29Time delay-based technique (2)
- 33:42Program's structure
- 35:23Program's workflow
- 36:46Development environment
- 37:20Testing environment
- 37:41Inference (binary search)
- 39:36Character prediction
- 45:26Reflective values
- 50:48False positives
- 52:40Heuristic test
- 54:09Tampering scripts
related talks
22mIntegrating Security Measures Throughout Development
22mSecure Your Code — Injections and Logging
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
50mHands-On ModSecurity and Logging
36mSQLViking: Pillaging your Data
34mActive Security Honeypot for MySQL and PostgreSQL protecting databases from ransomware attacks
23m{JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries
01h 30mCommon Webapp Vulnerabilities and What to Do About Them