sqlmapTool
sqlmap is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws.From MITRE ATT&CK
Last reported 3 days ago, by Zscaler ThreatLabz8 reports
ATT&CK techniques
6 of 56 · each with the sentence it comes from- T1059.001PowerShell
“Command and Scripting Interpreter: PowerShell – T1059.001”
- T1059Command and Scripting Interpreter
“Windows Command Shell – T1059.003 Command and Scripting Interpreter”
- T1059.003Windows Command Shell
“Windows Command Shell – T1059.003 Command and Scripting Interpreter”
- T1190Exploit Public-Facing Application
“Exploit public-facing application – T1190”
- T1003OS Credential Dumping
“OS Credential Dumping: NTDS – T1003.003”
- T1003.001LSASS Memory
“OS Credential Dumping: LSASS Memory -T1003.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Inside a Global AI-Assisted Hacking Campaign“The corresponding Dockerfile adds tools including nmap, sqlmap, nuclei, httpx, jadx, apktool, and frida-tools.”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“…pecifically, the actor attempted to exploit CVE-2025-24799, an unauthenticated SQL injection vulnerability in GLPI, using both a PoC and sqlmap to retrieve user information from the database.”
-
The Cybercriminal with Four Faces: Revealing Group-IB’s Investigation into ALTDOS, DESORDEN, GHOSTR and 0mid16B“He targeted victims by utilizing SQL injection tools, such as sqlmap, to conduct reconnaissance on exposed databases, or exploiting vulnerable web servers to gain unauthorized access to sensitive data.”
-
Managing Attack Surface“In addition, prior to the time period of the attack and beyond, the web server logs illustrated repeated successful queries via sqlmap, a freely available open source penetration testing tool used to look for SQL injection vulnerabilities.”
-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“Various penetration testing tools have been identified on the group’s malicious servers, including sqlmap, Acunetix, Beef Framework, X-Ray, Metasploit, ARL (Asset Reconnaissance Lighthouse), and Dirsearch.”
-
Ace in the Hole: exposing GambleForce, an SQL injection gang“GambleForce uses a set of publicly available open-source tools for pentesting: dirsearch, redis-rogue-getshell, Tinyproxy, sqlmap, and Cobalt Strike”
-
APT41 World Tour 2021 on a tight schedule“To search for and exploit vulnerabilities, the group uses popular tools such as Acunetix, Nmap, JexBoss, sqlmap, and fofa.su (a Chinese equivalent of Shodan).”
-
Hackers Are Exploiting a Vulnerability in Billing Software“With help from our partner, we were able to recreate the victim’s environment and validate simple security tools like sqlmap easily obtained sensitive data from the BillQuick server without authentication.”
Thanks — we review every report.