AppBreakup
Submit an app
sqlmap logo

sqlmap

Open-source command-line tool that detects and exploits SQL injection flaws in authorised tests.

Open sourcePenetration testing tools

Updated · AppBreakup editorial · Windows, macOS, Linux

Visit sqlmapSee 5 alternatives

Is sqlmap free?

Yes, free and open source

License:
GPLv2 (commercial licence available)

Checked on sqlmap's site Nov 8, 2026

Switch from sqlmap to

All 5
Verified facts
4 of 4
Alternatives ranked
5
Approved reviews
0
Visits sent from here
0

About sqlmap

sqlmap is a free, open-source penetration-testing tool that automates finding and exploiting SQL injection vulnerabilities in web applications. Pointed at a URL or a captured request, it tests parameters with five techniques (boolean-based blind, time-based blind, error-based, UNION query and stacked queries), fingerprints the database behind the app, and can then enumerate databases, tables and columns and dump data to show what an attacker could reach. Where the backend permits, it can also read and write files and run operating-system commands. It supports more than 40 database systems, from MySQL, PostgreSQL, Oracle and SQL Server to cloud warehouses such as Snowflake and Redshift. It is a Python command-line tool that runs on Windows, macOS and Linux and ships with security distributions such as Kali. The project has been developed for about 20 years and is licensed under GPLv2, with a separate commercial licence for companies embedding it in proprietary products. Use it only on systems you are authorised to test.

Best for: Pentesters and security teams confirming and measuring SQL injection risk during authorised tests.

Pros and cons

What works

  • Free and open source under GPLv2
  • Supports 40+ database backends and five injection techniques
  • Goes beyond detection to show real impact through enumeration and data extraction
  • Extensive documentation covering every option

Why people leave

  • Command line only, no graphical interface
  • Only covers SQL injection, not other web vulnerability classes
  • Can be noisy and heavy on target systems if options aren't tuned

sqlmap vs Burp Suite, ZAP and Metasploit

From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.

AttributesqlmapBurp SuiteZAPMetasploit
PricingOpen sourceFree plan + paidOpen sourceOpen source
Verified price—$499 (Burp Suite Professional)——
Free planFree appYes, Community EditionFree appFree app
Open sourceYesNoYesYes
Self-hostableNoNoNoNo
PlatformsWindows, macOS, LinuxWindows, macOS, LinuxWindows, macOS, LinuxLinux, macOS, Windows

Top sqlmap alternatives

See all 5
  1. 1Burp Suite logo
    Burp Suite

    Full web security proxy and scanner that finds SQL injection along with many other flaw types.

    68.8
  2. 2ZAP logo
    ZAP

    Free, open-source web app scanner with a GUI that covers SQL injection and much more.

    64.8
  3. 3Metasploit logo
    Metasploit

    Broader exploitation framework for pivoting beyond the web app once you have a foothold.

    61.8
  4. 4Caido logo
    Caido

    Lighter modern web security proxy for manual testing of injection points.

    59.4
  5. 5Acunetix logo
    Acunetix

    Commercial web vulnerability scanner that finds SQL injection among many other flaws, with reports and scheduling.

    57.5

Why people left sqlmap

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from sqlmap, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of sqlmap
Your rating of sqlmap

Never shown publicly. A work email helps us verify you.

What did you use it for, and what was good or bad? At least 40 characters.

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

sqlmap: common questions

What is sqlmap?

sqlmap: Open-source command-line tool that detects and exploits SQL injection flaws in authorised tests. Best for pentesters and security teams confirming and measuring SQL injection risk during authorised tests. Available for Windows, macOS and Linux.

Is sqlmap free?

Yes. sqlmap is free, open-source software.

Is sqlmap open source?

Yes. The source code is on GitHub at sqlmapproject/sqlmap.

What platforms does sqlmap run on?

sqlmap is available for Windows, macOS and Linux.

What are the best alternatives to sqlmap?

The highest-ranked sqlmap alternatives right now are Burp Suite, ZAP and Metasploit. See the full ranked list for pricing, platforms and verified facts.

sqlmap vs Burp Suite: what's the difference?

sqlmap is free and open source; Burp Suite is free with paid plans. sqlmap is open source and Burp Suite is not. Both run on Windows, macOS and Linux.

See all 5 sqlmap alternatives