payload-reference-sqli

Classify SQL injection payloads by clause and database engine.

Updated Jul 30, 2026
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill payload-reference-sqli
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: payload-reference-sqli
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/payload-reference-sqli
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill payload-reference-sqli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured, defensive framework for assessing SQL injection vulnerabilities, ensuring that security testing remains safe, authorized, and non-destructive.

Core Features & Use Cases

  • Contextual Taxonomy: Organizes injection payloads by SQL clause (SELECT, INSERT, etc.) and database engine to ensure accurate, safe testing.
  • Safe Canary Strategy: Implements differential behavior testing to confirm vulnerabilities without extracting data or modifying database content.
  • Policy Enforcement: Integrates with mandatory authorization and scope-gating workflows to prevent unauthorized or high-risk testing activities.

Quick Start

Use the payload-reference-sqli skill to identify the appropriate safe canary strategy for a suspected injection in a WHERE clause on a MySQL database.

Frequently Asked Questions about payload-reference-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely test for SQL injection without modifying the database?

SQL injection testing can be performed safely using a differential canary strategy. This methodology confirms vulnerabilities through non-destructive behavioral analysis, ensuring no actual data extraction or database modification occurs during the assessment.

What is differential analysis in SQL injection pentesting?

Differential analysis in SQL injection pentest is a safe validation methodology that identifies injection vectors by comparing non-destructive behavioral responses. It uses contextual taxonomy organized by SQL clause and database engine to confirm vulnerabilities without extracting data.

How do I identify SQL injection vectors across different database engines?

Identifying SQL injection vectors across multiple database engines requires a contextual taxonomy. This organizes payloads by specific SQL clauses like SELECT or INSERT, ensuring accurate and safe testing tailored to the target database environment.

Do I need explicit authorization to run a SQL injection vulnerability assessment?

Yes, SQL injection vulnerability assessment requires strict adherence to authorization and scope validation. Policy-gated execution workflows are mandatory to prevent unauthorized, unsafe, or high-risk testing activities during the security analysis.

Can I use standard SQL injection payloads for testing a MySQL WHERE clause?

Testing a MySQL WHERE clause requires selecting the appropriate safe canary strategy from a contextual taxonomy. This ensures the SQL injection assessment matches the specific SQL clause and database engine for accurate, non-destructive differential testing.