What problem does it solve?
Security testers often detect signs of SQL injection but struggle to turn a vague signal into concrete, reproducible proof. This Skill provides a structured workflow that walks from a suspicious HTTP record through confirmation, schema enumeration, and a single real exfiltrated sample, ending in a properly documented finding.
Core Features & Use Cases
- Guided probe-to-proof workflow: Anchors on a specific HTTP record, classifies the injection context (string vs numeric), and selects the cheapest verifiable oracle (in-band UNION, blind boolean, blind time, or blind OAST).
- Payload-class-aware enumeration: Pulls context-matched SQLi payloads, fingerprints the database (MySQL, PostgreSQL, SQLite, MSSQL), and walks information_schema or sqlite_master to leak one high-value row.
- Finding persistence and deduplication: Reports exactly one finding per distinct SQLi with CWE-89, severity based on leaked data type, masked evidence, and updates theoretical scanner findings instead of double-reporting.
- Use Case: During an authorized web application assessment, a scan record shows a 500 error with an SQLite syntax message on the q parameter. The Skill replays quote and boolean probes, confirms a UNION oracle, leaks one row from the users table, and files a critical finding with the exact mutated request.
Quick Start
Ask the agent to investigate the suspicious SQL error in the captured /rest/products/search request and prove whether the q parameter is exploitable with a real data sample.
