SQLMap

v1.8.2sqlmapproject

The reference SQL-injection tool: detect injectable parameters, fingerprint the back-end DBMS, enumerate databases/tables/columns, dump table entries, and read basic server facts (current user, current DB, hostname, DBA status). The range build supports the full flag surface — -u, --data, --cookie, -p, --level, --risk, --technique, --tamper, --dbs, --tables, --columns, --dump, --current-db, --current-user, --hostname, --users, --passwords, --is-dba, --batch, --random-agent — against the scenario's authored web fixtures. Dangerous switches (--os-shell, --os-cmd, --file-write, --tor, --proxy) are refused with a plain message, not silently ignored.

Category: Web application security testing
Package: sqlmap
Runs on: Linux · Windows
Commands: sqlmap, sqlmap.py, python-sqlmap

Every response comes from the authored ChallengeService fixtures. No socket is opened, no request leaves the browser, and switches that would touch the outside world are refused instead of executed.

Install it

The scripts below install the real sqlmapproject package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-sqlmap.sh

Windows installer (PowerShell)

Install-sqlmap.ps1

SQLMap has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Python (pip)

Install the interpreter tooling
```
sudo apt install -y python3-pip
```
Install SQLMap
```
python3 -m pip install sqlmap
```
Use a virtual environment on a shared host so the system Python stays clean.

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install SQLMap
```
sudo apt install -y sqlmap
```

Check it worked

Confirm it landed on PATH
```
which sqlmap
```
Check the version
```
sqlmap --version
```
The range reports 1.8.2.

Remove it

Take it off again
```
python3 -m pip uninstall sqlmap
```

On Windows

Python (pip)

Install Python

winget install --id Python.Python.3.12 -e

Install SQLMap
```
py -m pip install sqlmap
```

Check it worked

Confirm it resolves
```
where sqlmap
```
Check the version
```
sqlmap --version
```
The range reports 1.8.2.

Remove it

Take it off again
```
winget uninstall --id sqlmap
```

Inside the range

Tick it on the launch screen
Under SQLMap's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y sqlmap
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use SQLMap

Reps: Range Targets — swing at the piñataA per-run virtual estate of intentionally-weak boxes. Use nmap, curl, sqlmap, nikto and hydra against the range's own hosts; the target names, credentials, tables and flags change every run, so the walkthrough has to be earned, not memorised.
Reps: Range Targets — swing at the piñata (Windows)The Range Targets estate, worked from a Windows analyst box. Same per-run virtual targets, driven with PowerShell, nmap, sqlmap, nikto and hydra from a Windows console — the names, credentials, tables and flags still change every run.
Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.