sqlmap scan traffic: 63 injection probes against one parameter

Sixty-three requests to one parameter in 44 seconds, nearly all of them stamped User-Agent: sqlmap/1.10.2#stable (https://sqlmap.org): this sqlmap PCAP records the open-source injection tool working through the cat parameter of testphp.vulnweb.com, a site that exists to be scanned. Where a human tester sends a few hand-crafted probes with pauses between them, the tool sends a dense sequence of probes from several injection techniques. A-Packets rebuilds every request, so the rapid sequence of an automated scan reads clearly, and the payloads themselves name which injection families sqlmap tried.

Recognising this shape matters because an automated injection scan is both a common precursor to a real breach and one of the easier things to spot in a capture or a web log, if you know what its payloads look like. This report, built from a scan run in the A-Packets lab, walks through the four payload families visible here and the two signals, the request rate and the user agent, that give an automated scan away.

Dozens of requests to one parameter in seconds

Every request in the capture targets the same endpoint, /listproducts.php, and the same parameter, cat. Nobody browses a catalogue like that: sixty-plus requests to one query parameter in under a minute, each varying only the injected value, is automation. The HTTP sessions view lists them in order, so you can watch the scan move from broad detection to the payloads that confirmed a hit.

42 more requests in the interactive report.

Open the HTTP view →

The quickest confirmation is the user agent. Almost every request carries sqlmap/1.10.2#stable (https://sqlmap.org), which names the tool and its version outright. sqlmap sends this by default; an attacker who wants to hide passes --random-agent to borrow a browser string instead, so you cannot rely on the user agent alone. It is a gift when present; when it is missing, the payload families below still give the scan away.

The four payload families sqlmap cycles through

sqlmap does not send one kind of injection; it works through a catalogue of techniques to find which the target is vulnerable to, and the decoded payloads in this capture show four of them side by side. Reading them is the most reliable way to recognise the tool.

Boolean-based blind. Pairs of requests like cat=1 AND 9466=9466 and cat=1 AND 5341=9251 test a condition that is always true against one that is always false. If the page differs between the two, the parameter is injectable and the attacker can extract data one true/false question at a time. The tell is the pairing of a tautology with a contradiction using large random numbers.

Time-based blind. Requests such as cat=1 AND (SELECT 4533 FROM (SELECT(SLEEP(5)))MiXo) ask the database to pause five seconds if a condition holds. sqlmap sends a SLEEP(0) baseline and a SLEEP(5) test and measures the response delay. This technique works even when the page shows no visible difference, which is why it is sqlmap's fallback, and the SLEEP() call in a query string is unmistakable.

Error-based. Payloads using EXTRACTVALUE(…, CONCAT(0x5c, …)) deliberately trigger a database error whose message contains the data the attacker wants, smuggled out through the error text. The hexadecimal markers sqlmap wraps around its output, strings like 0x7162626b71, are a signature: the tool uses them to find its own data reliably in the response.

UNION-based. A run of ORDER BY 1, ORDER BY 10, ORDER BY 11 probes how many columns the query returns, the prerequisite for a UNION SELECT that grafts the attacker's chosen data onto the application's output, the same end state the manual SQL injection sample reaches by hand. When sqlmap finds the column count, it switches to UNION to pull data quickly.

The five-second tests that actually delayed this server

All 63 requests receive HTTP 200, so status codes cannot rank the outcomes; timing can. The response to the request in frame 130 takes 5.144658 seconds, a structurally identical zero-delay request in frame 134 takes 0.141953 seconds, and the repeated five-second request in frame 138 takes 5.142992 seconds. Subtract the baseline and both tests delayed the server by five seconds: the database executed the injected SLEEP, twice, on demand. Wireshark's http.time field on each exchange shows the same numbers.

The contrast with the earlier probes is just as telling. Stacked-statement variants also contain SLEEP(5), yet their responses arrive in about 0.14 seconds: those syntaxes failed, and a rule that matches only the function name would lump them together with the expression that worked. The boolean pair in frames 27 and 31 answers in about 0.145 and 0.144 seconds, because timing is not their signal; their evidence is in the page content, compared after removing the reflected payload text, where a stable marker such as the product list beats a whole-page checksum.

Everything in this capture is the discovery phase of the sqlmap techniques: each probe asks whether one expression changes the server's behaviour, and the hex markers in the error payloads are the tool's own delimiters, not database values. No request asks for schema names, account fields or table contents, so the finding is an injectable parameter with a working time-based channel, not a dump.

How sqlmap hides, and why the target matters more than the tool

The payloads in this capture are undisguised, but sqlmap has a toolbox for evading defences, and knowing it keeps a defender from over-trusting signature detection. The --random-agent option replaces the telltale user agent with a browser string; --tamper scripts rewrite each payload to slip past web application firewalls, for example by inserting comments, changing case, or encoding characters; and --delay and --safe-url slow and space the requests to stay under rate thresholds. A scan run with these does not match the clean signatures above, which is exactly why the durable defence is a target that cannot be injected rather than a filter that recognises today's payloads.

That reframes what a capture like this tells a defender. Finding sqlmap traffic confirms someone is actively trying; finding a response that changes with a controlled predicate or delay, as the SLEEP(5) pair does here, proves an injectable parameter, which is the serious finding. From there the attacker can extract data, so a confirmed sqlmap hit against a live application requires containment and a search of the logs for the extraction requests that would follow. Parameterised queries remove that outcome regardless of how many tamper scripts the attacker stacks.

Detecting and slowing automated injection

The underlying defence is the one for any injection: parameterised queries and a least-privilege database account, so that even a tool that tries every technique finds nothing to leverage. A target built that way defeats sqlmap regardless of how many payloads it sends. That is the fix; the rest is detection and friction.

Operationally, the signals are the ones this capture shows. The burst of requests to one parameter is the strongest: alert on a high rate of requests that vary only a single query parameter, which catches the tool even with a disguised user agent. The payload signatures, SLEEP(, UNION SELECT, ORDER BY climbing through integers, EXTRACTVALUE and the hex markers, are searchable in web logs and in a capture with filters like http.request.uri contains "sleep". Rate limiting and a web application firewall slow the scan and make it louder, and blocking the source after a threshold cuts it off, though an attacker can rotate addresses. The default sqlmap user agent, when it appears, is worth a block on its own.

In MITRE ATT&CK terms this is reconnaissance and exploitation of a public-facing application, T1190, often automated as part of T1595, Active Scanning. A scan that found an injectable parameter is usually followed by data extraction, so a confirmed hit against a live application warrants a search for extraction and follow-on access. This is the automated counterpart to the manual SQL injection sample. For the broader set of attacks visible in traffic, see top threats found in PCAP analysis, or upload a capture of your own.