Dependencies

Dependencies

sqlmap is developed in Python, a dynamic, object-oriented, interpreted programming language. This makes sqlmap a cross-platform application which is independent of the operating system. sqlmap requires Python version 2.7 or 3.x, and works out of the box with nothing more than a standard Python installation - no third-party libraries are needed for the core detection, enumeration and exploitation features against web targets.

The optional dependencies below are only relevant to specific features.

Operating-system takeover (Metasploit)

sqlmap relies on the Metasploit Framework for some of its out-of-band operating-system takeover features (--os-pwn, --os-smbrelay, --os-bof). You can grab a copy of the framework from its download page and point sqlmap at it with --msf-path. For the SMB relay / out-of-band takeover techniques, sqlmap also uses the Impacket library.

Direct database connection (-d)

When connecting directly to a database server with the -d switch (bypassing the web application entirely), sqlmap ships a dependency-free, pure-Python wire-protocol client (dbwire, bundled under extra/dbwire/). Thanks to it, -d works out of the box, with no external library, against PostgreSQL, MySQL, Microsoft SQL Server, Sybase, Firebird, MonetDB, Vertica, ClickHouse, CrateDB, Presto and Cubrid.

For any other database management system - or when you prefer to use a native/optimized driver - install the corresponding Python binding:

• Microsoft SQL Server / Sybase: python-pymssql
• MySQL: python-pymysql
• PostgreSQL / CrateDB: python-psycopg2
• Oracle: python-oracledb
• Microsoft Access: python-pyodbc
• Firebird: python3-firebirdsql
• IBM DB2 / Informix: python ibm-db
• HSQLDB / InterSystems Cache: JayDeBeApi + JPype
• MonetDB: pymonetdb
• Apache Derby: pydrda
• Vertica: vertica-python
• Presto: presto-python-client
• MimerSQL: mimerpy
• ClickHouse: clickhouse_connect
• Cubrid: CUBRID-Python
• SAP HANA: hdbcli

SQLite requires nothing extra - it is handled through Python's standard-library sqlite3 module.

You can always run sqlmap.py --dependencies to have sqlmap report exactly which (if any) third-party libraries are missing for the features you intend to use.

Graphical user interface (--gui)

The optional graphical user interface (--gui) uses Python's standard-library tkinter module (tkinter and tkinter.ttk). It is included with most Python installations, but on some GNU/Linux distributions it is packaged separately (e.g. python3-tk on Debian/Ubuntu).

SQL shell / OS shell history (Windows)

Optionally, if you are running sqlmap on Windows, you may wish to install the pyreadline library in order to take advantage of the sqlmap TAB completion and history support features in the SQL shell and OS shell. Note that these functionalities are available natively via the standard Python readline library on other operating systems.