Identify SQLi and NoSQLi vulnerabilities in web applications and ORM-backed services.
npx skills add https://github.com/chatbotkit/rook --skill hunt-sqli-chatbotkit
Please help me install this Agent Skill. Skill: hunt-sqli Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-sqli Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-sqli-chatbotkit
This Skill provides a focused framework for identifying and validating SQL injection and NoSQL injection vulnerabilities across modern ORMs and data-backed services, consolidating proven patterns from public bug bounty reports into actionable guidance.
Identify a target with user-controlled inputs and run the injection hunting workflow to confirm and enumerate injectable fields.
High-intent search queries and answers about installing and using this skill.
To test for SQLi and NoSQLi vulnerabilities, identify user-controlled inputs flowing into ORM queries and apply boolean-based and time-based payload probes to detect injection points. This methodology covers reconnaissance, payload crafting, and verification across modern web and API endpoints.
Finding injection points in API endpoints requires mapping user input fields that influence SQL or NoSQL queries. You can use structured hunting workflows that apply targeted payload patterns and interpret response signals to confirm data exposure vulnerabilities in admin interfaces.
Yes, this SQLi hunting workflow is designed for bug bounty reporting. It consolidates proven patterns from public bug bounty reports into a step-by-step methodology covering reconnaissance, payload verification, and responsible disclosure to produce reproducible test reports.
Yes, you can use boolean and time-based payloads to detect NoSQLi. The Skill provides specific payload patterns and detection signals for NoSQL backends, guiding when and how to interpret response delays and boolean conditions to verify injection vulnerabilities safely.
To safely validate SQL injection findings, the workflow provides safe validation techniques and tooling guidance to reproduce and verify findings. It focuses on interpreting response signals from non-destructive boolean and time-based probes rather than extracting actual data.
You need to test for NoSQLi alongside SQLi when targeting modern stacks where user inputs flow into NoSQL databases. The workflow covers both SQL and NoSQL backends, ensuring comprehensive vulnerability discovery across diverse web, mobile, and service applications.
pdparchitectAudit Okta tenants for authentication, MFA, and API misconfigurations.
qa-amanGenerate a complete vulnerability report with standardized sections from a finding input.
jokken79Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.
cmndcntrlcyberProvide security payloads and bypass techniques for web application penetration testing.
