skills.rest
ctahok
ctahokCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-sqli

Detect and confirm SQL and NoSQL injection across web parameters.

1|Updated May 25, 2026
Search Tags:#sql injection#sqlmap#waf bypass#nosql injection#blind sqli#union select#mongodb operators
One-click install
npx skills add https://github.com/ctahok/hermes-bug-bounty-skills --skill hunt-sqli-ctahok
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sqli
Source: https://github.com/ctahok/hermes-bug-bounty-skills/tree/main/hunt-sqli
Command: npx skills add https://github.com/ctahok/hermes-bug-bounty-skills --skill hunt-sqli-ctahok

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you reliably identify SQL Injection and NoSQL Injection vulnerabilities, then move from detection to practical exploitation while reducing false positives.

Core Features & Use Cases

  • SQLi Detection Across Contexts: Sends universal probes to test string, numeric, JSON, and header injection points and interprets response behavior to classify likely SQLi context.
  • Injection-Type Identification: Distinguishes error-based, UNION-based, blind boolean, and blind time-based SQLi using specific, repeatable criteria.
  • Data Extraction & WAF Bypass Strategy: Provides per-database exploitation flows (MySQL/PostgreSQL/MSSQL/Oracle) plus time-based extraction patterns and common sqlmap automation flags.

Quick Start

Tell the AI to hunt the endpoint for SQLi by testing every parameter with the universal probes, determining the injection type from response and timing, then producing a concise exploitation-and-validation plan for the suspected database.

Frequently Asked Questions about hunt-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect SQL injection across different web parameters like GET, POST, and JSON headers?▼

Blind SQL injection is identified by distinguishing blind boolean and time-based types using specific, repeatable criteria like response differences and timing delays, ensuring accurate detection without direct database error messages or visible data extraction.

What is the best way to confirm a NoSQL injection vulnerability using MongoDB operators?▼

WAF bypass during SQL injection data extraction requires per-database exploitation flows for MySQL, PostgreSQL, MSSQL, and Oracle, applying time-based extraction patterns and common sqlmap automation flags to retrieve data while evading web application firewall filters.

How do I classify injection types between error-based, UNION-based, and blind SQLi?▼

Injection type classification between error-based, UNION-based, and blind SQLi is achieved by analyzing response differences, timing delays, error leaks, and extracted values to determine the specific exploitation method for the suspected database.

Does sqlmap work for time-based blind SQL injection extraction and WAF bypass?▼

Sqlmap supports time-based blind SQL injection extraction and WAF bypass by utilizing specific automation flags and time-based extraction patterns tailored to the target database, enabling safe data retrieval even when responses lack visible content differences.

Related Skills

Explore More Software Engineering Skills→
gongzeqgongzeq

sqlmap-detect

Run sqlmap against a target URL and report SQL injection vulnerabilities.

Community
Advanced
rene-wagnerrene-wagner

mysql-dump

Create SQL dump files from MySQL databases in Docker containers.

Community
Intermediate
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
ArianHobson333ArianHobson333
7

hunt-sqli

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced