skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

offensive-sqli

Identifies and assesses OWASP Top 10-style SQL injection vulnerabilities in web applications.

1|Updated Apr 27, 2026
Search Tags:#automation#web-security#sql-injection#pentesting#sqli#sqlmap
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-sqli-riparino
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-sqli
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Red/Skills/offensive-sqli
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-sqli-riparino

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a structured approach to testing SQL injection vulnerabilities in web applications, enabling security professionals to identify injectable vectors, assess impact, and guide remediation.

Core Features & Use Cases

  • Comprehensive SQLi coverage: covers error-based, boolean-based blind, time-based blind, NoSQL, GraphQL, and ORM-related injection vectors across databases (MySQL, PostgreSQL, MSSQL, Oracle).
  • Automation-ready workflows: includes guidance on using tooling like sqlmap and related techniques to streamline assessment and reporting.
  • Use Case: For bug bounty or security assessments, map injection points, enumerate databases, and extract accessible data while documenting risk and mitigations.

Quick Start

Use this skill in a controlled lab to start enumerating SQL injection vectors against a target application and document exploitable endpoints.

Frequently Asked Questions about offensive-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SQL injection testing for web applications?▼

Automate SQL injection testing by applying structured workflows and automation tools like sqlmap to identify injectable vectors, enumerate databases, and assess exploitation potential across dynamic web apps.

What types of SQL injection vulnerabilities can I detect during a penetration test?▼

SQL injection testing covers error-based, boolean-based blind, time-based blind, NoSQL, GraphQL, and ORM-related injection vectors across multiple database types including MySQL, PostgreSQL, MSSQL, and Oracle.

Can I use sqlmap to test API endpoints for SQLi vulnerabilities?▼

Yes, you can use sqlmap and related automation techniques to test API endpoints and dynamic web applications for SQL injection vulnerabilities, mapping injection points and extracting accessible data during security assessments.

What is the best way to document SQL injection findings for bug bounty reports?▼

Document SQL injection findings by mapping injection points, enumerating accessible databases, extracting valid data samples in controlled environments, and detailing specific risk impacts alongside recommended remediation steps.

Do I need prior database knowledge to identify SQL injection vectors?▼

Yes, identifying SQL injection vulnerabilities requires knowledge of database types, payload patterns, and query structures to effectively recognize and validate exploit vectors across different database management systems.

Related Skills

Explore More Software Engineering Skills→
gongzeqgongzeq

katana-crawl-web

Crawls authorized web targets to generate deduplicated candidate URLs for vulnerability scanning.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
locdinh209locdinh209

SQL Injection Testing

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced
SkobynSkobyn

hunt-sqli

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced