sqlmap is a command-line tool that automates detecting and exploiting SQL injection. It doesn't replace understanding how the injection works — you still need to know why a parameter is vulnerable — but once you do, it saves the tedious part: trying payload after payload by hand to confirm it, then building the queries to actually pull data out.
Pointing it at a URL
The simplest case is a GET parameter you suspect is unsanitized:
sqlmap -u "http://target.ctf/page.php?id=1" --batch--batch tells sqlmap to accept its own default answer at every prompt instead of asking interactively — the right choice when you're scripting or just want a fast first pass.
Testing a login form or raw request
For a POST request, capture it from your browser's dev tools or Burp as a raw HTTP request file and hand the whole thing to sqlmap instead of reconstructing the parameters yourself:
sqlmap -r request.txt --batchThis matters for CTFs specifically because login forms and search boxes are common targets, and copying the exact request (headers, cookies, body) avoids subtly breaking something a hand-built request would get wrong.
Enumerating databases, tables, and data
Once sqlmap confirms an injectable parameter, walk down the schema one level at a time:
sqlmap -u "http://target.ctf/page.php?id=1" --batch --dbs
sqlmap -u "http://target.ctf/page.php?id=1" --batch -D ctf_db --tables
sqlmap -u "http://target.ctf/page.php?id=1" --batch -D ctf_db -T users --dump--dbs lists databases, -D db --tables lists a database's tables, and -D db -T table --dump pulls every row — frequently where a CTF flag is sitting in a flags or admin table.
When the default settings miss it
Some challenges need a nudge: a session cookie to reach an authenticated page, or a WAF-like filter that the default payload set doesn't get past.
sqlmap -u "http://target.ctf/page.php?id=1" --batch \
--cookie="PHPSESSID=abc123" \
--level=5 --risk=3--level and --risk (both 1-5) widen the payload set sqlmap tries, including slower and more intrusive techniques — worth reaching for only after the defaults come back empty.
Why it's worth learning
sqlmap won't tell you a parameter is worth testing in the first place, and it won't explain the vulnerability in a writeup for you. What it removes is the mechanical part after you've spotted the suspect input: confirming the injection, figuring out the database type and schema, and extracting the data — turning what could be dozens of manual payloads into one command and a few flags.