[hack-ita]

Summary

This PR proposes adding a comprehensive, hands-on SQLmap tutorial to the existing README "Links" section as an optional community learning resource.

The goal is to give users an additional practical learning path that complements the official SQLmap documentation, helping beginners understand the tool's workflow while giving more experienced penetration testers a consolidated reference for its features and command-line options.

What makes this resource useful?

Rather than being a short introduction or a generic overview, this is an in-depth, approximately 31-minute technical guide that takes readers from the fundamentals to advanced SQLmap usage.

It covers the practical workflow of an SQL injection assessment, including:

• Installation and setup: Kali Linux, Debian, Ubuntu, Windows, Python/pip and Android/Termux.
• Command reference: A categorized command cheat sheet covering target selection, request handling, detection, injection techniques, enumeration, extraction, evasion and session management.
• Real HTTP request testing: GET and POST parameters, saved requests from Burp Suite, cookies, headers, authentication tokens and JSON-based APIs.
• SQL injection techniques: Boolean-based, Error-based, UNION-based, Time-based, Stacked queries, Inline queries and Second-order SQL injection, including explanations of when each technique is useful.
• Database fingerprinting and enumeration: Identifying DBMS versions, enumerating databases, tables, columns, users, privileges and password hashes.
• Data extraction: Practical examples of selective dumps, conditional extraction, output formats and hash handling.
• Advanced capabilities: SQL shell, operating-system interaction, file operations, proxies, tamper scripts and WAF/filter bypass techniques.
• Troubleshooting and practical considerations: Common detection issues, false negatives, request handling, performance considerations and DBMS-specific limitations.

Practical examples and reproducible labs

An important part of the guide is that it does not simply list commands and options.

It explains what the commands do, shows representative SQLmap output, interprets the results and discusses practical situations in which particular options and techniques are useful.

The examples include two local practice environments:

• A Flask application using SQLite, available at "127.0.0.1:5000".
• A PHP application using MariaDB 10.11, available at "127.0.0.1:8081".

The guide identifies the SQLmap version used for testing (1.10.11), distinguishes commands actually tested in the local environments from illustrative syntax examples, and includes a dedicated local lab so readers can practice without targeting third-party systems.

It also includes defensive considerations and emphasizes that testing must be limited to systems owned by the tester or covered by explicit authorization.

Why add it to the README?

SQLmap offers extensive functionality, and its official wiki and documentation remain the authoritative references for the project's features and options.

This external guide serves a complementary purpose: it organizes many common tasks into a single practical learning path, connects individual options to realistic penetration-testing workflows, and provides examples that help readers understand not only which command to run, but also what to expect from its output and how to interpret it.

It may therefore be useful to users who are learning SQLmap, practitioners who need a quick command reference, and penetration testers looking for practical examples of less commonly used features.

Transparency

The resource is published by HackITA, an independent cybersecurity publication, and is not affiliated with or maintained by the SQLmap project.

This contribution is intentionally limited to one optional entry in the existing README links section. It does not modify SQLmap's source code, dependencies, functionality or official documentation.

We believe it could be a useful supplementary resource for the SQLmap community, while fully respecting the official documentation as the primary source of reference.

Thank you for considering this contribution.

[stamparm]

so, contribution is the backlink to your web site? thank you, pass

[stamparm]

hard to believe that you thought that this will pass