blind-sqli-extraction

What problem does it solve?

This Skill solves the challenge of extracting sensitive data from web applications with confirmed boolean or timing-based blind SQL injection vulnerabilities, where no direct query output is returned to the user, making standard UNION or error-based extraction impossible.

Core Features & Use Cases

• Oracle Identification: Validates usable injection points by confirming reliable differences between true and false conditions via response body, status code, size, or timing signals.
• WAF Bypass Techniques: Provides patterns to evade common web application firewall blocks for quotes, whitespace, SQL keywords, and functions using encoding, case mixing, and alternative syntax.
• Efficient Data Extraction: Uses LIKE character-by-character narrowing for strings and DIV bisection for integers to minimize the number of requests needed to retrieve database version, user privileges, schema data, and application information.
• Use Case: During an authorized penetration test of a customer-facing web app with a confirmed blind SQLi vulnerability, use this Skill to extract the database version, current user privileges, and table names from the backend MySQL database without triggering WAF alerts.

Quick Start

Use the blind-sqli-extraction skill to extract the database version and current user from the confirmed blind SQL injection point on the target web application.