I want to understand the deep theory behind sqlmap - the decision making of the programm - how is it done? Is there any public paper? (There is still an option to read and understand sqlmap code and use -vvv switch).

I'm searching for a visualisation of sqlmap's decision tree.

Note: I know how SQL injection works and I'm familiar with sqlmap's wiki.

  • Yeah, i know how sql injection works and have read already the wiki. I'm interested how sqlmap decides which database is there and which version. It makes specific payloads to test the database and based on the response it decides which branch it should go further. I'm just curious how it works, but the codebase is really big and complex, so I search for academic paper or something in this direction (which i was unable to find) which would explain it more or less in detail Commented Dec 28, 2018 at 22:41

1 Answer 1


You may want to look at the list of presentations maintained by the sqlmap project. For example, they list sqlmap - Under the Hood and link to the slides. The same talk as presented by the author is no longer available on Youtube (unfortunate, since slide decks often leave out the meat of the discussion). (Of course, there are many other presentations and tutorials on Youtube, but probably less on the deep internals).

  • youtube link is dead! :(
    – Learner
    Commented Jan 4, 2023 at 3:54
  • Thanks, @Slslam, I updated the answer a little but it appears that particular video has vanished off the Internet. Sadly, it's niche content.
    – gowenfawr
    Commented Jan 4, 2023 at 14:38
  • youtube.com/watch?v=9Cman0EHkSU
    – Learner
    Commented Jan 4, 2023 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .