sqlmap

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Key Features

• Full support for a wide range of databases: MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix.
• Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.
• Direct database connection: sqlmap can connect directly to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.
• And much more...

Basic Usage

sqlmap -u "http://www.example.com/vuln.php?id=1"

Common Options

• --dbs: Enumerate databases
• --tables: Enumerate tables
• --columns: Enumerate columns
• --dump: Dump data
• --os-shell: Get an interactive OS shell

sqlmap is a powerful and versatile tool that is an essential part of any penetration tester's toolkit.