hunt-sqli

Detect SQL injection vulnerabilities by analyzing tech stacks, error messages, and user inputs.

Updated Jun 18, 2026

Search Tags:#sql injection #vulnerability assessment #cybersecurity #web application security #bug bounty

Ready to run

npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-sqli-kisilev13

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-sqli
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/hunt-sqli
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-sqli-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Burp Suite, SQLMap, Burp Suite Proxy, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill provides a methodical approach to identify and understand SQL injection vulnerabilities within applications.

Core Features & Use Cases

Detailed Hunting Methodology: Walks through the steps of identifying vulnerable input vectors and tech stacks.
Targeting High-Value Assets: Helps prioritize high-risk applications such as e-commerce, analytics, and payment systems.
Reproducible Impact Validation: Offers clear guidance on gate checks for report validity, emphasizing data confidentiality and business impact.

Quick Start

Analyze the SQL injection risk on the web application using the 'hunt-sqli' skill and provide evidence of at least one vulnerability using SQL injection testing.

Frequently Asked Questions about hunt-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect SQL injection vulnerabilities in a web application?▼

To detect SQL injection vulnerabilities, analyze the web application's tech stack, error messages, and user inputs. This skill applies methodical hunting methodologies to identify vulnerable input vectors across relational database targets.

Can I use Burp Suite and SQLMap to test for SQL injection?▼

Yes, Burp Suite and SQLMap are required to execute SQL injection test payloads. Burp Suite Proxy intercepts web traffic for analysis, while SQLMap automates the validation of SQL injection vulnerabilities found in user inputs.

What is the best way to prioritize SQL injection testing for high-risk web apps?▼

Prioritize SQL injection testing on high-value assets like e-commerce, analytics, and payment systems. Targeting these high-risk applications maximizes vulnerability assessment impact by focusing on data confidentiality and business impact.

How do I validate SQL injection findings for a bug bounty report?▼

Validate SQL injection findings by applying gate checks for report validity. Reproducible impact validation emphasizes data confidentiality and business impact, ensuring evidence of at least one vulnerability is clearly documented.

Does this SQL injection detection method work on any relational database?▼

Yes, this SQL injection detection applies to any target that uses relational databases. It analyzes tech stacks and error messages universally to identify vulnerabilities within web applications during cybersecurity auditing.

What are the limitations of using SQLMap for web application security testing?▼

SQLMap limitations include reliance on properly configured Burp Suite Proxy traffic to execute payloads. Successful vulnerability assessment requires identifying vulnerable input vectors beforehand, as automated testing alone cannot guarantee finding all errors.