Techniques

sqlmap is able to detect and exploit five different SQL injection types:

Boolean-based blind: sqlmap replaces or appends to the affected parameter in the HTTP request, a syntatically valid SQL statement string containing a SELECT sub-statement, or any other SQL statement whose the user want to retrieve the output. For each HTTP response, by making a comparison between the HTTP response headers/body with the original request, the tool inference the output of the injected statement character by character. Alternatively, the user can provide a string or regular expression to match on True pages. The bisection algorithm implemented in sqlmap to perform this technique is able to fetch each character of the output with a maximum of seven HTTP requests. Where the output is not within the clear-text plain charset, sqlmap will adapt the algorithm with bigger ranges to detect the output.
Time-based blind: sqlmap replaces or appends to the affected parameter in the HTTP request, a syntatically valid SQL statement string containing a query which put on hold the back-end DBMS to return for a certain number of seconds. For each HTTP response, by making a comparison between the HTTP response time with the original request, the tool inference the output of the injected statement character by character. Like for boolean-based technique, the bisection algorithm is applied.
Error-based: sqlmap replaces or appends to the affected parameter a database-specific error message provoking statement and parses the HTTP response headers and body in search of DBMS error messages containing the injected pre-defined chain of characters and the subquery statement output within. This technique works only when the web application has been configured to disclose back-end database management system error messages.
UNION query-based: sqlmap appends to the affected parameter a syntactically valid SQL statement starting with an UNION ALL SELECT. This techique works when the web application page passes directly the output of the SELECT statement within a for loop, or similar, so that each line of the query output is printed on the page content. sqlmap is also able to exploit partial (single entry) UNION query SQL injection vulnerabilities which occur when the output of the statement is not cycled in a for construct, whereas only the first entry of the query output is displayed.
Stacked queries, also known as piggy backing: sqlmap tests if the web application supports stacked queries and then, in case it does support, it appends to the affected parameter in the HTTP request, a semi-colon (;) followed by the SQL statement to be executed. This technique is useful to run SQL statements other than SELECT, like for instance, data definition or data manipulation statements, possibly leading to file system read and write access and operating system command execution depending on the underlying back-end database management system and the session user privileges.

User's manual

Introduction - Introductory to sqlmap
Techniques - SQLi techniques supported by sqlmap
Features - Brief list of supported features
Download and update - Keep your copy up-to-date
Dependencies - Information about used third-party libraries and tools
History - History from 2006 to 2024
Usage - Exhaustive breakdown of all options and switches together with examples
License - Copyright information

Miscellaneous

FAQ - Frequently Asked Questions
Presentations - Materials from sqlmap team presented at conferences
Screenshots - Collection of screenshots demonstrating some of features
Third party libraries - Detailed information about third-party libraries and tools used by sqlmap