# sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

Repository: https://github.com/sqlmapproject/sqlmap
Canonical: https://ross.abutalabs.com/products/sqlmap
Homepage: http://sqlmap.org
Language: Python
License: NOASSERTION
License Family: other
Topics: sql-injection, detection, exploitation, python, database, pentesting, api-security, appsec, security-testing, security-testing-tool, sqlinjection, webapp-security, database-security, dbms, webappsec
Last push: 2026-08-26T11:46:12+00:00

## Health v2 (maintenance only)
Score: 75/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 31, longevity 100
- inputs: {"age_days": 5181, "days_push": 7, "days_rel": 244, "gap_med": 364, "n_releases_24m": 2}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 38275, forks 6347 (observed 2026-08-28T04:12:07.336482+00:00)

## What it is
sqlmap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws and the takeover of database servers. It supports five injection techniques, fingerprints and works with 40+ database backends, and can access file systems and execute OS commands where the backend permits.

## Use cases
- detect sql injection vulnerabilities in a web application
- automatically exploit sql injection flaws during a pentest
- fingerprint the backend database behind a web app
- enumerate database tables and columns to find sensitive data
- dump data from a database via sql injection
- test whether a web parameter is injectable with boolean or time-based blind techniques
- execute operating system commands through a database takeover
- audit api endpoints for sqlinjection issues

## When to choose
- you are a penetration tester or security researcher assessing web applications for SQL injection
- you need broad DBMS support (MySQL, PostgreSQL, Oracle, SQL Server, and more) in one tool
- you want automated detection across five injection techniques without writing payloads by hand
- you need to demonstrate real impact by enumerating or exfiltrating data within the injected user's reach

## When to avoid
- you want to attack systems you do not own or have written authorization to test - that is illegal
- you need a general-purpose web vulnerability scanner covering XSS, CSRF, and other flaw classes
- you need a defensive tool that fixes or parameterizes queries rather than detecting injection
- you require a GUI-driven scanning workflow rather than a command-line tool

## Facets
- artifact type: cli-tool
- maturity: stable
- function: penetration-testing, security, database, search-engine
- domain: security, penetration-testing, databases, web-development
- platform: python, windows, cross-platform, cli
- tags: sql-injection, pentesting, database-takeover, appsec, webappsec, exploitation, vulnerability-scanning, linux, macos

## Member repositories
- sqlmapproject/sqlmap (main) score 75

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:12:07.336482+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:24:56.907673+00:00, confidence not recorded.
  - readme: https://github.com/sqlmapproject/sqlmap (fetched 2026-08-28T04:12:07.336482+00:00, sha c2d335f36389)
  - homepage: http://sqlmap.org (fetched 2026-08-29T07:47:00.267489+00:00, sha 746ff4f6f97e)
  - registry_pypi: https://pypi.org/pypi/sqlmap/json (fetched 2026-08-29T07:47:00.276837+00:00, sha 1aac053a9553)
- Data as of 2026-08-30T08:39:29.467469+00:00.