sqlmap-scan

Test for SQL injection vulnerabilities using SQLMap against an authorized target.

Decision Loop: In-the-Loop (STRICT — target + mode approval required)

Safety — CRITICAL Legal Warning

Before ANY execution, display this warning:

⚠️ คำเตือนทางกฎหมาย (Legal Warning)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SQL injection testing without explicit written authorization is ILLEGAL
in most jurisdictions. SQLMap actively sends malicious payloads to the target.

ยืนยัน (Confirm):
1. คุณได้รับอนุญาตให้ทดสอบเป้าหมายนี้แล้ว (You have authorization to test this target)
2. เป้าหมาย: <target-url>
3. โหมด: <mode>

ดำเนินการต่อ? (Proceed?) [y/N]

Do NOT proceed without explicit user confirmation.

Arguments

Parse the user's input for:

• <target-url> — URL with parameters (e.g., http://target.com/page?id=1) (REQUIRED)
• --mode — Test mode (default: detect)
• --risk — Risk level 1-3 (default: 1)
• --level — Test level 1-5 (default: 1)

Scan Modes

| Mode | Flags | Description | |------|-------|-------------| | detect | --batch --smart | Detect injectable parameters only | | enumerate | --batch --dbs | Enumerate databases after detection | | dump | --batch --dump -D <db> -T <table> | Dump table data (REQUIRES extra confirmation) |

Execution

After user confirmation, run:

# Build command based on mode
case "<mode>" in
  detect)
    sqlmap -u "<target-url>" --batch --smart --risk <risk> --level <level> \
      --output-dir=/tmp/sqlmap-output --forms 2>&1 | tee /tmp/sqlmap-console.txt
    ;;
  enumerate)
    sqlmap -u "<target-url>" --batch --dbs --risk <risk> --level <level> \
      --output-dir=/tmp/sqlmap-output 2>&1 | tee /tmp/sqlmap-console.txt
    ;;
  dump)
    # REQUIRES ADDITIONAL CONFIRMATION for data extraction
    sqlmap -u "<target-url>" --batch --dump -D <db> -T <table> \
      --output-dir=/tmp/sqlmap-output 2>&1 | tee /tmp/sqlmap-console.txt
    ;;
esac

Output Format

Parse the SQLMap output and present:

## ผลการสแกน SQLMap (SQLMap Scan Results)

### ข้อมูลเป้าหมาย (Target Info)
- **เป้าหมาย (Target)**: `<target-url>`
- **โหมด (Mode)**: detect
- **Risk/Level**: 1/1
- **เวลา (Time)**: <timestamp>

### พารามิเตอร์ที่มีช่องโหว่ (Vulnerable Parameters)

| Parameter | Type | Technique | DBMS |
|-----------|------|-----------|------|
| id | GET | boolean-based blind | MySQL 5.7 |
| id | GET | time-based blind | MySQL 5.7 |
| id | GET | UNION query | MySQL 5.7 |

### รายละเอียด (Details)

**Parameter: `id`**
- **Type**: Boolean-based blind
- **Payload**: `id=1' AND 1=1-- -`
- **DBMS**: MySQL >= 5.7
- **CWE**: CWE-89 (SQL Injection)
- **OWASP**: A03:2021 — Injection
- **CVSS**: 9.8 (Critical)

### ฐานข้อมูลที่พบ (Databases Found)
*(enumerate mode only)*
- information_schema
- app_database
- mysql

### สรุป (Summary)
- พารามิเตอร์ที่ทดสอบ (Parameters tested): X
- ช่องโหว่ที่พบ (Vulnerabilities found): Y
- ระดับความรุนแรง (Severity): CRITICAL

### คำแนะนำถัดไป (Next Steps)
1. Report SQL injection findings immediately
2. Use parameterized queries / prepared statements
3. Implement input validation and WAF rules
4. Run `/compliance-report` for framework mapping

Error Handling

• If sqlmap not found: "SQLMap is not installed. Install with: sudo apt install sqlmap"
• If no parameters in URL: "URL must contain query parameters (e.g., ?id=1). Use --forms to test form fields."
• If WAF detected: "WAF/IPS detected. Consider using --tamper scripts or lowering scan speed."