{
  "id": 15965056,
  "title": "SQL Injection with SQLmap on Kali: From Login Form to Database",
  "url": "https://urgent.news/2026/10/21/sql-injection-with-sqlmap-on-kali-from-login-form-to-database",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T22:45:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/emuzinun/sql-injection-with-sqlmap-on-kali-from-login-form-to-database-48lp"
  },
  "original_language": "en",
  "account": "SQLmap is a powerful open-source tool for automating SQL injection testing. Essentially, if a web application neglects to filter user input before sending it to the database, SQL injection attacks become possible. These attacks involve targeting login forms, search boxes, or URL parameters to manipulate the database.\n\nFor demonstration purposes, we'll use a self-hosted instance of the Damn Vulnerable Web Application (DVWA) running via Docker. To begin, ensure Docker is installed and running, then launch DVWA with the command `docker run --rm -d -p 80:80 vulnerables/web-dvwa`. After accessing the application via your browser at `http://localhost/login.php` and logging in as \"admin\" with the password \"password\", navigate to the SQL injection page by selecting it from DVWA's left menu.\n\nSQLmap requires the session cookie to act as if the application is logged in. Retrieve this cookie from your browser's developer tools and transmit it along with the target URL, security level, and database specifications when executing `sqlmap`. Use the `-u` flag for the URL, `--cookie` for the session cookie, `--dbs` to enumerate databases, and `--batch` to automate the process.\n\nUpon identifying the DVWA database, list the available tables using `-D` followed by the database name. The `users` table is expected to contain username and password fields. To extract the stored user data, execute `sqlmap` again with the `-T` flag pointing to the target table, and use `--dump` to extract the information. SQLmap will automatically attempt to crack MD5 hashes using a dictionary attack, revealing potential login credentials in the process. Always ensure you have authorization before conducting any such tests on live systems.",
  "summary": "The Sqlmap tool is an open-source tool that automates SQL injection testing. It can handle what's done manually with a few commands. SQL injection: simply put, if a web application sends the input it takes from the user straight to the database without filtering it, you can write SQL code there. It could be a login form, a search box, a URL parameter, etc. The application runs that code and the…",
  "key_points": [
    "SQLmap automates SQL injection testing on vulnerable web applications.",
    "Demonstrates SQL injection on Damn Vulnerable Web Application (DVWA) via Docker.",
    "Extracts user data from DVWA's users table using SQLmap."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}