sqlmapproject/sqlmap

Purpose and entry points

sqlmap is a Python penetration-testing CLI that detects and exploits injection flaws, fingerprints database servers, extracts data, and supports DB/file-system/OS takeover workflows. The primary launcher is sqlmap.py; a separate API service entry point is sqlmapapi.py, with API configuration in sqlmapapi.yaml.

Startup, configuration, and shared state

Command-line/config parsing initializes global options, knowledge/state, logging, targets, sessions, and defaults before execution. Core cross-cutting contracts are concentrated in lib/core/option.py, lib/core/data.py, and lib/core/session.py; command-line and config-file adapters are lib/parse/cmdline.py and lib/parse/configfile.py. This shared state is the boundary between setup and all later request/detection/action stages.

Controller orchestration

The controller selects targets and coordinates injection checking, exploitation, result handling, and requested actions. lib/controller/controller.py is the top-level execution coordinator, while lib/controller/checks.py drives detection checks and lib/controller/action.py dispatches post-detection operations. It consumes normalized target/options state and delegates transport, technique engines, and DBMS plugins.

Target ingestion and HTTP transport

Targets may originate from direct URLs and parsed artifacts/API descriptions, then flow through request construction and response comparison. Relevant boundaries include lib/core/target.py, lib/parse/openapi.py, and lib/parse/sitemap.py. The request layer supports HTTP(S), HTTP/2, WebSocket, proxy/auth variants, direct database connections, and out-of-band channels through lib/request/connect.py, lib/request/inject.py, and lib/request/websocket.py.

Detection and extraction engines

Injection execution is organized by technique families: boolean/time inference, error-based extraction, UNION queries, DNS exfiltration, plus non-SQL injection families. Core examples are lib/techniques/blind/inference.py, lib/techniques/error/use.py, and lib/techniques/union/use.py; payload definitions are data-driven in data/xml/payloads/boolean_blind.xml and data/xml/payloads/union_query.xml. Request comparison feeds these engines to distinguish baseline versus injected behavior.

DBMS plugin boundary

Generic enumeration and operations are specialized through a uniform per-DBMS plugin layout: connector, fingerprint, syntax, enumeration, filesystem, and takeover. Generic fallbacks reside in plugins/generic/enumeration.py and plugins/generic/fingerprint.py; representative implementations are plugins/dbms/mysql/connector.py, plugins/dbms/postgresql/enumeration.py, and plugins/dbms/mssqlserver/takeover.py. This boundary isolates vendor SQL dialects and capabilities for numerous database platforms.

Takeover, payload assets, and evasion

After successful access, takeover adapters perform DB-native command execution, UDF deployment, registry/web operations, and shell integration via lib/takeover/xp_cmdshell.py, lib/takeover/udf.py, and lib/takeover/web.py. Supporting SQL procedures and native binaries are packaged under data/procs/mssqlserver/, data/udf/mysql/, and data/shell/. Payload transformation is a pluggable evasion stage using scripts in tamper/, such as tamper/space2comment.py.

Runtime and external dependencies

The project supports Python 2.7 and Python 3.x across platforms. It embeds compatibility/vendor libraries under thirdparty/, including Bottle for the API service (thirdparty/bottle/bottle.py) and SOCKS support (thirdparty/socks/socks.py). Runtime interactions are external target web services, supported DBMS servers, DNS/out-of-band services (lib/request/dns.py, lib/request/interactsh.py), and optionally Metasploit (lib/takeover/metasploit.py).