What problem does it solve? Security researchers need a disciplined, safe method to confirm SQL injection in web applications without dumping data, running destructive payloads, or filing false-positive reports that programs reject. ## Core Features & Use Cases - Multi-surface input mapping: Inventories URL path segments, form/JSON fields, admin filters, and ORM identifier inputs that may shape relational queries. - Safe differential testing: Applies quote/error triads, boolean true/false predicates, and bounded 1-2 second timing probes with controls to prove query control without data extraction. - Negative-control taxonomy: Applies 12 stop-condition categories and a three-way decision split (technically_vulnerable, in_scope, program_reportable) to prevent non-reportable submissions. - Version boundary filtering: Uses OSV/GHSA fixed-version data for sequelize, knex, typeorm, sqlalchemy, django, and hibernate to rule out already-patched ORM attack surface. - Use Case: While testing an authorized bug-bounty target, you notice a numeric path segment like /api/orders/123. Use this Skill to run boolean and timing differentials, confirm query control with controls, and stop before any data extraction. ## Quick Start Use the sqli-hunter skill to test the invite_code parameter on my authorized staging target for SQL injection using safe boolean and timing differentials.
