sqlmap

sqlmap is a free, open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws and the takeover of the database servers behind vulnerable web applications. Distributed under the GNU General Public License v2 (GPLv2), it supports dozens of database management systems and implements techniques including boolean-based blind, time-based blind, error-based, UNION query, and stacked-queries SQL injection, along with DBMS fingerprinting, data extraction, file-system access, and out-of-band operating-system command execution.

Origins (2006)

According to the project's own history page, sqlmap began on July 25, 2006, when Daniele Bellucci registered the "sqlmap" project on SourceForge and built its initial skeleton with limited MySQL support; version 0.1 followed in August 2006 with added PostgreSQL support. In September 2006, Bellucci left the project and Bernardo Damele A. G. took it over as lead developer, releasing version 0.2 in December 2006 with an improved DBMS-fingerprinting engine and a new "bisection" inference algorithm.

Growth under Damele and Stampar (2007-2011)

Through 2007, Damele expanded sqlmap rapidly: version 0.3 (January 2007) added Microsoft SQL Server support, UNION-query exploitation, and POST-parameter injection testing. The project was accepted into OWASP's "Spring of Code 2007" program, which funded versions 0.4 (June 2007) and 0.5 (November 2007), the latter adding Oracle support. In December 2009, Miroslav Stampar answered a public call for developers and joined Damele, contributing from version 0.8 release candidate 2 onward; he has since become one of the project's principal maintainers.

Move to GitHub and maturity (2012-present)

On June 26, 2012, sqlmap's development relocated from SourceForge/Subversion to GitHub, with a new homepage at sqlmap.org and a public issue tracker. The project reached stable version 1.0 on February 27, 2016, and closed its 2,000th GitHub issue that same year. sqlmap.org now credits Damele and Stampar as the project's founders and lead maintainers, lists over 130 contributors, and offers the tool under a dual GPLv2/commercial license.

Notoriety and impact

sqlmap is bundled by default in penetration-testing Linux distributions such as Kali Linux and is one of the most widely used SQL injection tools in both authorized security testing and real-world attacks. Wikipedia's entry on the tool states it was used in the 2015 TalkTalk data breach and, alongside Acunetix and DirBuster, in the 2016 compromise of the Illinois State Board of Elections systems, illustrating its dual-use nature.

Note: Wikipedia's infobox names only Daniele Bellucci as "author," while sqlmap's own project history and GitHub AUTHORS file credit Bernardo Damele and Miroslav Stampar as founders/current lead developers -- reflecting Bellucci's role as original creator versus Damele's and Stampar's roles in taking the project from its earliest version to its current form. Specific version "codenames" reported for the most recent (2022-2026) releases could not be independently corroborated and are treated as unverified.

Timeline

• 2006-07-25Daniele Bellucci registers the sqlmap project on SourceForge and implements its initial skeleton with limited MySQL support.
• 2006-08Version 0.1 released; initial PostgreSQL support added.
• 2006-09Daniele Bellucci leaves the project; Bernardo Damele A. G. takes over as lead developer.
• 2006-12-13Version 0.2 released with enhanced DBMS fingerprinting and a new bisection inference algorithm.
• 2007-01-20Version 0.3 released, adding Microsoft SQL Server support, UNION query exploitation, and POST-parameter injection testing.
• 2007sqlmap is accepted into the OWASP Spring of Code 2007 program.
• 2007-06-15Version 0.4 released as the first OWASP Spring of Code 2007 milestone.
• 2007-11-04Version 0.5 released (adds Oracle support), marking the end of OWASP Spring of Code 2007 participation.
• 2009-12-18Miroslav Stampar joins the project as co-developer alongside Bernardo Damele, starting with version 0.8 RC2.
• 2012-06-26Development relocates from SourceForge/Subversion to GitHub; new homepage at sqlmap.org and public issue tracker launched.
• 2015Disputed/unverified beyond Wikipedia mention: sqlmap reportedly used by attackers in the TalkTalk data breach.
• 2016-02-27Stable version 1.0 released.
• 2016Project closes its 2,000th GitHub issue; disputed/unverified beyond Wikipedia mention: sqlmap reportedly used alongside Acunetix and DirBuster in the Illinois State Board of Elections breach.