sqli-sql-injection

Name: sqli-sql-injection
Availability: InStock
Author: yliken

Identify and exploit SQL injection vectors across multiple DBMS.

5|1|Updated Apr 20, 2026

Search Tags:#database #web-security #sql-injection #pentesting #sqli #second-order #oob-exfiltration

Ready to run

npx skills add https://github.com/Yliken/ai4 --skill sqli-sql-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sqli-sql-injection
Source: https://github.com/Yliken/ai4/tree/main/skills/sqli-sql-injection
Command: npx skills add https://github.com/Yliken/ai4 --skill sqli-sql-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SQL injection remains a critical risk for data security, and this Skill provides a comprehensive playbook of techniques, payloads, and scenarios to identify, understand, and validate SQLi weaknesses across diverse database systems.

Core Features & Use Cases

Extensive payload families covering error-based, boolean-blind, time-based, and out-of-band exfiltration techniques.
DBMS-specific exploitation guidance, including ThinkPHP, Django GIS, and common RDBMS variants, with operational pathways for both initial access and persistence checks.
Second-order injection and parameterization bypass scenarios to assess real-world application weaknesses and risk exposure.

Quick Start

Provide a target URL and payload and run an initial boolean-based test such as ' OR 1=1-- to confirm an injection vector.

Frequently Asked Questions about sqli-sql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for SQL injection using boolean-based payloads?▼

You can confirm a SQL injection vector by running an initial boolean-based test, such as providing a target URL with the payload ' OR 1=1--. This technique helps validate input handling flaws in data retrieval paths.

Can I exploit SQL injection across different database management systems?▼

Yes, SQL injection techniques can be applied across multiple DBMS variants. The Skill provides DBMS-specific exploitation guidance, covering common RDBMS platforms as well as frameworks like ThinkPHP and Django GIS.

How does out-of-band exfiltration work in SQL injection testing?▼

Out-of-band exfiltration is an advanced SQL injection technique used to retrieve data when direct response methods fail. It is included among the payload families to validate security controls and assess real-world risk.

What SQL injection techniques are available for blind vulnerabilities?▼

For blind SQL injection vulnerabilities, you can apply boolean-blind and time-based techniques. These payload families allow data extraction without direct visual feedback by observing application behavior or response delays.

Do I need special precautions when running SQL injection tests on production systems?▼

Yes, safe testing practices are required to avoid production impact when validating SQL injection vectors. This ensures that exploiting authentication, sorting, and reporting paths does not disrupt real-world services.