vuln-sqli

Validate SQL injection vulnerabilities through manual probing and proof-level data extraction.

Updated Jul 30, 2026

Search Tags:#sql-injection #pentesting #vulnerability-assessment #authorized-testing #database-security #security-validation

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-sqli

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vuln-sqli
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-sqli
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-sqli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured, safe, and authorized framework for validating SQL injection vulnerabilities, preventing the common pitfalls of manual testing and accidental data exposure.

Core Features & Use Cases

Manual Probing: Guides users through error-based, boolean-based, and time-based detection techniques to confirm injection points without destructive payloads.
Proof-of-Concept Extraction: Safely extracts only the database version, current user, and database name to confirm the vulnerability without accessing sensitive production data.
Safety Guardrails: Enforces strict authorization checks and prevents unauthorized data dumping or system command execution.

Quick Start

Use the vuln-sqli skill to probe the target parameter id on the authorized endpoint for potential SQL injection vulnerabilities.

Frequently Asked Questions about vuln-sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate SQL injection vulnerabilities safely on authorized targets?▼

You can validate SQL injection vulnerabilities on authorized targets using manual probing techniques, including error-based, boolean-based, and time-based detection, to confirm injection points without executing destructive payloads.

Can I extract database information during a SQL injection test without exposing sensitive data?▼

Yes, you can extract proof-of-concept data by querying only the database version, current user, and database name to confirm the SQL injection vulnerability while preventing unauthorized data dumping or exposure of sensitive production records.

What techniques are used for manual SQL injection probing in a vulnerability assessment?▼

Manual SQL injection probing utilizes error-based, boolean-based, and time-based detection techniques to systematically identify and confirm injection points on authorized endpoints during a security validation assessment.

Do I need authorization to test endpoints for SQL injection risks?▼

Yes, strict authorization checks and adherence to defined scope are mandatory before testing endpoints for SQL injection risks, ensuring all vulnerability validation remains non-destructive and compliant with authorized security assessment workflows.

What limitations apply when confirming a SQL injection vulnerability?▼

Limitations include the prohibition of unauthorized data dumping and system command execution, restricting validation to non-destructive testing methodologies that confirm DBMS type and injection feasibility without altering the target database.