| name | hunt-sqli |
| description | Investigate authorized SQL injection boundaries on web and API inputs. Use when typed discovery or target-origin evidence identifies query-backed parameters, database-error signals, boolean or timing SQL differentials, SQL-filter behavior, or a suspected injectable login, search, sort, filter, or identifier input. |
Hunt SQL Injection Boundaries
Treat this card as advisory prioritization. Scope, replay contracts, TrafficPolicy, and native
evidence gates remain authoritative.
Workflow
- Select a query-backed input and preserve its method, identity, session, fixed fields, and encoding.
- Run
sqli_differential first; change one input and pair each candidate with a same-shape control.
- Interleave bounded timing pairs. Use
sqli_exploit only after a reproducible differential and
filtered_query_bypass only when target evidence shows filtering.
- Preserve redacted replays, deltas, controls, and evidence references. Report validated
vulnerabilities independently of any challenge objective.
Evidence Gate
Confirm only a new database error absent from control, a reproducible boolean differential, or
repeatable timing above baseline jitter. Vendor fingerprints, isolated errors, length changes, and
one slow response remain observations. Keep contract_missing results suspected.
Stop Conditions
Stop without a replayable query input, stable control, or policy budget, or after minimal proof.
Do not request extraction beyond the authorized native closer; redact credentials and bodies.
