Cracken + SQLMap
Cracken runs SQLMap to probe each parameter for SQL injection, confirm it across blind, error, and union techniques. It dumps the database it breaks into.
Connecting SQLMap
- Connect with
No credentials — runs on your own Tentacle
- Cadence
Runs on demand — installed per Tentacle, then invoked during an operation
- Requires
Linux or macOS Tentacle
What Cracken gets from SQLMap
Confirmed injection points with the vulnerable parameter
Injection type/technique (boolean-blind, time-based, UNION, error-based) and the payload
The back-end DBMS and its version
Enumerated databases, tables and columns
Dumped rows from the database
How Cracken uses SQLMap
- 01
Point Cracken at an injectable request
- 02
Cracken runs SQLMap
- 03
Dump and take over
- 04
Confirm the Tentacle is ready
Frequently asked questions
Do I need to install SQLMap?
No. Cracken installs SQLMap on a Tentacle — a Kali container running on your own infrastructure — and drives it directly during an operation.
Does Cracken actually exploit the SQL injection or just flag it?
Cracken confirms the injection by exploiting it — enumerating the database and dumping data through SQLMap — so you get a proven takeover, not an alert.
“…we've been continuously validating … the efficacy of Cracken with our own pen tests, like external pen test findings. Just being sure that we could recreate those with Cracken. It's been going good so far…”
Attack with real SQLMap context.
See how Cracken runs SQLMap on a Tentacle you host, and proves what it finds end to end.