Malware

sqlmap

sqlmap is a tool used to automate exploitation of SQL injection vulnerabilities. The provided content explicitly states that sqlmap can be used to automate exploitation of SQL injection vulnerabilities. It appears in the context of intrusion activity where multiple threat actors used SQL injection against external websites, extranet web servers, and public-facing applications for initial access. No additional high-confidence details on specific malware behavior, persistence, payload delivery, targeted industries, associated threat actors directly using sqlmap, or indicators of compromise are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1595.002Vulnerability ScanningEvidence1

Kill chain по MITRE ATT&CK: Vulnerability Scanning (T1595.002, Reconnaissance) → Exploit Public-Facing Application (T1190, Initial Access)

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

T1190Exploit Public-Facing ApplicationEvidence30

The adversary executes automated SQL injection campaigns targeting Brazilian SaaS, CRM, support, education, and financial web applications... this time-based SQLi vector enables privilege escalation: the attacker triggers xp_cmdshell on SQL Server. | The operation’s primary at-scale access vector is an authentication-override weakness in Palo Alto Networks GlobalProtect, tracked as CVE-2026-0257... recovered output contains assigned VPN addresses... confirming unauthorized network access.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

This command provides us with a virtual shell, allowing us to execute single commands... <?php system($_GET['cmd']); ?>

Persistence

2 techniques

T1078Valid AccountsEvidence1

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

T1505.003Web ShellEvidence2

Asking how sqlmap would be used to upload a potential web shell to a target server.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

Stealth

2 techniques

T1070.004File DeletionEvidence1

Risk 3 - запросы с OR в контексте UPDATE / DELETE , которые способны модифицировать или удалить данные.

T1078Valid AccountsEvidence1

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

Using Sqlmap, it was also possible to read password hashes of user accounts. These are MD5 hashes of the passwords without any further salt value.

T1110Brute ForceEvidence1

Credential Access - Brute Force (T1110): встроенный брутфорс извлечённых хешей паролей по словарям

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

The files include offensive security tooling (sqlmap, masscan, nmap, hping, tcpdump, ngrok, gost, microsocks, frpc/frps, impacket)...

Collection

2 techniques

T1213Data from Information RepositoriesEvidence4

A post presented SQL database files and identified the target as Pakistan Railways... Another post claimed a breach of a Pakistan Government SQL Server... Additional material referenced the Pakistan Military Accounts Department, including a claimed 88-page PDF containing stolen data.

T1213.006DatabasesEvidence1

Collection - Databases (T1213.006): перечисление схем, извлечение данных из таблиц, полный дамп содержимого

Command and Control

3 techniques

T1090ProxyEvidence1

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

T1090.001Internal ProxyEvidence1

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

T1105Ingress Tool TransferEvidence1

After gaining access to the server, the attackers installed the tools they needed at different times. Specifically, the following commands for third-party installations were identified on one of the servers: apt install traceroute apt-get install nmap apt-get install screen git clone https://github.com/sqlmapproject/sqlmap.git

Impact

1 technique

T1565Data ManipulationEvidence2

SQL injections may result in information modification, sensitive data leakage and unauthorized command executions in underlying database systems.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

It’s protected by a WAF that filters suspicious requests. For this reason we will use tampers... It randomizes the casing of your payload, which can help bypass WAFs.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attack websiteNews

Mar 20, 2015

Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

Automated SQL injection exploitation tool.

mitre attackNews

Jan 25, 2026

Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

An automated SQL injection exploitation framework used to detect and exploit SQLi vulnerabilities in web applications.

mitre attackNews

Mar 18, 2026

Exploit Public-Facing Application, Technique T1190 - Enterprise | MITRE ATT&CK®

Open-source tool used to automate detection and exploitation of SQL injection vulnerabilities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

sqlmap