Discovering SQL vulnerabilities with Python tools

In this section, we will learn how to test whether a website is vulnerable to SQL injection using the sqlmap penetration testing tool as an automated tool for finding and exploiting SQL injection vulnerabilities that inject values into the query parameters.

Introduction to SQL injection

SQL injection is a technique that is used to steal data by taking advantage of a non-validated input vulnerability in query parameters.

With this code injection technique, an attacker executes malicious SQL queries that control a web application's database. Therefore, if an application has a SQL injection vulnerability, an attacker could read the data in the database, including confidential information and hashed passwords.

For example, consider the following PHP code segment:

$variable = $_POST['input'];
mysql_query('INSERT INTO `table` (`column`) VALUES ('$variable')');

If the user enters 'value...