skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

sqli-sql-injection

Identify SQL injection vulnerabilities and generate DB-specific exploitation evidence.

241|28|Updated May 20, 2026
Search Tags:#sql injection#waf bypass#second-order injection#oob exfiltration#vulnerability reporting#database fingerprinting#blind exploitation
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill sqli-sql-injection-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sqli-sql-injection
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/sqli-sql-injection
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill sqli-sql-injection-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you identify and exploit SQL injection paths while producing DB-specific, verifiable attack evidence instead of relying on generic guesses.

Core Features & Use Cases

  • Detection & validation: Systematically confirms SQLi using behavioral signals across parameter types (query, JSON, headers, cookies) and supports error-, boolean-, and time-based inference paths.
  • Data extraction & OOB exfiltration: Guides UNION-based extraction and blind inference, plus out-of-band exfiltration techniques for major databases (e.g., Oracle UTL_HTTP/UTL_INADDR, MSSQL OpenRowSet, MySQL LOAD_FILE UNC).
  • Escalation and second-order coverage: Covers second-order injection flows, statement-context variants (INSERT/UPDATE/DELETE), and OS-level escalation options with DB-specific routing.

Quick Start

Use the sqli-sql-injection skill to assess a suspected SQL injection on a target endpoint by running DB fingerprinting, selecting the correct inference method, and extracting the most actionable evidence for reporting.

Frequently Asked Questions about sqli-sql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I confirm SQL injection vulnerabilities across different parameter types like JSON and headers?▼

SQL injection validation systematically confirms SQLi using behavioral signals across URL, body, JSON, headers, and cookies. It matches payload strategies to the SQL sink context and DBMS behavior for reliable evidence.

What is the best way to extract data when blind SQL injection blocks direct error output?▼

Blind exploitation uses error-, boolean-, and time-based inference paths to extract data when direct output is blocked. It also supports out-of-band exfiltration techniques like Oracle UTL_HTTP and MySQL LOAD_FILE UNC.

How do I handle second-order injection and statement-context variants in INSERT or UPDATE flows?▼

Second-order injection coverage handles statement-context variants across INSERT, UPDATE, and DELETE flows. It routes payloads based on DB-specific behavior to target filtering, sorting, and reporting workflows.

Does this approach provide database fingerprinting and DBMS-specific payload routing for vulnerability reporting?▼

Yes, database fingerprinting identifies the target DBMS to enable per-database routing. It provides statement-verb payload guidance and generates verifiable attack evidence tailored for vulnerability reporting.

Can I use out-of-band exfiltration for MSSQL and Oracle during SQL injection testing?▼

Yes, OOB exfiltration support covers major databases including MSSQL OpenRowSet and Oracle UTL_INADDR. It enables data extraction when standard in-band and blind inference methods are restricted.

What should I do when standard SQL injection payloads fail against WAF bypass scenarios?▼

WAF bypass requires matching payload strategies to the exact SQL sink context and DBMS behavior. The workflow validates injection paths using behavioral signals and adapts payloads for OS-level escalation when needed.

Related Skills

Explore More Legal & Compliance Skills→
hoanghn61hoanghn61

injection

Probe web endpoints for SQL, NoSQL, OS command, SSTI, XXE, and LDAP injection vulnerabilities.

Community
Advanced
PurpleAILABPurpleAILAB
60

vulnerability-base

Standardize smart contract vulnerability reporting with severity classification and quality checklists.

Official
Intermediate
NickCrewNickCrew
29

owasp-top-10

Identify OWASP Top 10 security vulnerabilities in web applications.

Community
Advanced
lNwNllNwNl
2

sqli-sql-injection

Detect and exploit SQL injection with DBMS-specific UNION, boolean, and time-based techniques.

Community
Advanced