菜单
Automatic SQL injection and database takeover tool. Use when you suspect a web parameter is vulnerable to SQL injection and need to test, exploit, or enumerate the database.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Automated tool-assisted strategies for blind injection attacks (SQL, NoSQL, command, XPath). Covers when and how to use sqlmap, custom scripting, and binary search optimization to minimize token consumption and execution time. Use when manual blind injection would require >20 sequential requests.
HTTP Request Smuggling (HRS) / Desync attack detection and exploitation. Covers CL.TE, TE.CL, TE.TE detection, payload crafting, and chaining with SSRF/cache poisoning. Use when front-end/back-end architecture is suspected or when HTTP parsing discrepancies exist.
Race condition vulnerability detection and exploitation. Covers time-of-check to time-of-use (TOCTOU), limit bypass, coupon abuse, and multi-endpoint race chains. Use when state-dependent logic (credits, inventory, votes, transfers) exists or CTF challenge involves concurrent operations.
Canonical Nmap CLI syntax, strict staged scanning workflow, and sandbox-safe bounded scan patterns with timeout backoff.
Exact Nuclei command structure, template selection, staged scanning workflow, and bounded high-throughput execution controls with timeout backoff.
Common CTF exploitation patterns, quick wins, and time-saving tricks for web, crypto, pwn, and misc challenges. Use when you are stuck on a CTF challenge or want to rapidly test known patterns.
| name | sqlmap |
| description | Automatic SQL injection and database takeover tool. Use when you suspect a web parameter is vulnerable to SQL injection and need to test, exploit, or enumerate the database. |
| compatibility | Requires sqlmap to be installed on the system. |
| metadata | {"category":"exploitation","tool":"sqlmap"} |
Use this skill when the task involves:
Test a URL parameter for SQL injection:
sqlmap -u "<target>" --batch
Enumerate databases:
sqlmap -u "<target>" --dbs --batch
Dump a specific database:
sqlmap -u "<target>" -D <database> --dump --batch
Test with POST data:
sqlmap -u "<target>" --data="param1=value1¶m2=value2" --batch
| Flag | Description |
|---|---|
-u <url> | Target URL |
--batch | Non-interactive mode (use defaults) |
--dbs | Enumerate databases |
--tables | Enumerate tables |
--columns | Enumerate columns |
--dump | Dump table entries |
-D <db> | Specify database |
-T <table> | Specify table |
-C <col> | Specify column |
--level <1-5> | Test level (higher = more tests) |
--risk <1-3> | Risk level (higher = more dangerous) |
--tamper <script> | Use tamper script to evade WAF |
--batch in automated contexts.--os-shell, --os-pwn, or other takeover features without explicit authorization.--risk and --level values can cause data loss or service disruption.