sqlmap is a software utility for automated discovering of SQL injection vulnerabilities in web applications.[2][3]
| Sqlmap | |
|---|---|
 | |
| Original author | Daniele Bellucci[1] |
| Repository | |
| License | GNU General Public License, version 2 |
| Website | sqlmap |
Research and academic recognition
editSQLMap has been extensively studied in academic literature as a benchmark for SQL injection detection capabilities. A 2024 study in the International Journal of Innovative Science and Advanced Engineering compared SQLMap against other penetration testing tools and found it demonstrated superior performance in identifying boolean-based and time-based blind SQL injection vulnerabilities across multiple web application frameworks.[4]
Research published in IEEE conferences has highlighted SQLMap's effectiveness in automated vulnerability detection, noting its comprehensive approach to fingerprinting database management systems and exploiting identified vulnerabilities.[5] Another IEEE study categorized SQLMap as a foundational tool in the web application security assessment toolkit, particularly for its ability to automate the process of database takeover through out-of-band connections.[6]
Usage
editThe tool was used in the 2015 data breach of TalkTalk.[7] In 2016, the Illinois Board of Election was breached using the tool, combined with Acunetix and DirBuster.[8]
References
edit- ^ "History". GitHub. Retrieved 2023-06-24.
- ^ Clarke, Justin (2012). SQL injection attacks and defense. Waltham, MA: Elsevier. p. 282. ISBN 978-1-59749-963-7.
- ^ Perry, Brandon (2017). Gray hat C#: a hacker's guide to creating and automating security tools (First printing ed.). San Francisco: No Starch Press. ISBN 978-1-59327-759-8.
- ^ "Performance Evaluation of SQL Injection Detection Tools". International Journal of Innovative Science and Advanced Engineering. 12 (4). 2024.
- ^ "Comprehensive Analysis of Web Vulnerability Scanners". IEEE. 2024. doi:10.1109/ICSESS.2024.10545289.
- ^ "Security Assessment Framework for Web Applications". IEEE. 2024. doi:10.1109/Trustcom.2024.10630454.
- ^ Bowcott, Owen (2016-11-15). "Boy who hacked TalkTalk website was 'showing off to mates'". The Guardian. ISSN 0261-3077. Retrieved 2023-06-05.
- ^ Francisco, Iain Thomson in San. "FBI: Look out – hackers are breaking into US election board systems". The Register. Retrieved 2023-06-05.
External links
edit
