Identify SQLi and NoSQLi vulnerabilities in target applications.
npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-sqli-grivera82
Please help me install this Agent Skill. Skill: hunt-sqli Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-sqli Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-sqli-grivera82
SQL injection remains a critical vulnerability class across modern web apps, and security professionals need comprehensive guidance to identify, reproduce, and chain SQLi/NoSQLi findings for effective remediation.
$regex, $where), ORM-bypass injections, and second-order SQLi in popular stacks.Run through the recommended workflows to begin hunting SQLi/NoSQLi on a target, adapting payloads to the observed backend (MySQL, PostgreSQL, MongoDB, or ORM-generated SQL).
High-intent search queries and answers about installing and using this skill.
ORM-based injections bypass traditional SQLi defenses by exploiting ORM abstraction layers. You identify these injection vectors by testing ORM-specific syntax and chained operations across modern stacks to build reproducible proofs.
Finding NoSQL injection patterns requires testing MongoDB operators like $regex and $where. You inject these operators into target application inputs to identify vulnerabilities and validate data extraction across diverse environments.
Validating second-order SQLi requires tracing input storage and subsequent execution to reproduce findings. You use robust validation patterns and real-world examples to build a reproducible proof for your bug bounty submission.
This SQLi hunting methodology works for ORM-based injections, NoSQL injections, and second-order SQLi. It provides practical payloads and validation patterns adapted for diverse environments and modern web application stacks.
AndyAnh174Assess web applications for SQL injection vulnerabilities across database systems.
Mikacr1138Generate impact-first bug bounty reports with CVSS 3.1 scoring and pre-submit checklists.
vitoropereiraDetect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.
roderikIdentify security vulnerabilities in source code using CodeQL static analysis.