skills.rest
pdparchitect
pdparchitectCOMMUNITY
Explore all skills by this author →
Website𝕏@pdpGitHub

hunt-sqli

Detect SQL and NoSQL injection vulnerabilities using error-based, boolean-based, and time-based blind techniques.

13|2|Updated Jun 1, 2026
Search Tags:#security#vulnerability#auditing#nosql#pentesting#sqli
One-click install
npx skills add https://github.com/pdparchitect/rook --skill hunt-sqli-pdparchitect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-sqli
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-sqli
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-sqli-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the complex, multi-step process of identifying and verifying SQL and NoSQL injection vulnerabilities, which are often missed by automated scanners due to their reliance on specific tech stacks and non-standard injection vectors.

Core Features & Use Cases

  • Multi-Stack Detection: Identifies vulnerabilities across traditional SQL (MySQL, PostgreSQL, MSSQL) and modern NoSQL (MongoDB) databases.
  • Advanced Methodology: Implements error-based, boolean-based, and time-based blind injection testing, including modern ORM-bypass techniques.
  • Use Case: Use this skill to audit a target's search, filter, or reporting endpoints for injection flaws, ensuring you have a reproducible proof-of-concept before reporting.

Quick Start

Use the hunt-sqli skill to audit the search endpoint on the target domain for potential SQL injection vulnerabilities.

Frequently Asked Questions about hunt-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for SQL injection vulnerabilities across different database backends?▼

To test for SQL injection vulnerabilities across diverse database backends, you systematically apply error-based, boolean-based, and time-based blind injection techniques against input vectors to verify input validation flaws.

Can automated scanning detect NoSQL injection flaws in MongoDB applications?▼

Automated scanning often misses NoSQL injection flaws in MongoDB applications due to reliance on specific tech stacks. Detecting them requires systematic testing of input vectors using tailored injection techniques to verify vulnerabilities.

What is the best way to audit web application APIs for ORM bypass injection?▼

The best way to audit web application APIs for ORM bypass injection is to systematically test input vectors using advanced methodologies, including error-based and blind techniques, to identify and verify input validation flaws.

Does this approach work for finding injection vulnerabilities in microservices?▼

Yes, this approach works for finding injection vulnerabilities in microservices. It applies to security auditing of web applications, APIs, and microservices to detect input validation flaws across SQL and NoSQL implementations.

How do I generate a reproducible proof-of-concept for SQL injection?▼

To generate a reproducible proof-of-concept for SQL injection, you audit the target's search, filter, or reporting endpoints using systematic testing techniques to identify and confirm the vulnerability before reporting.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

framework-spring

Audit Spring Boot actuator endpoints and configuration for security misconfigurations.

Community
Advanced
enderphan94enderphan94
1

exploit-scan

Convert verified security vulnerabilities into executable proof-of-concept code and attack narratives.

Community
Advanced
zebbernzebbern
34

SQL Injection Testing

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced
summarybotngsummarybotng
2

security-testing

Scan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.

Official
Advanced