Results for “soql-injection”

SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.

Enforces bulk-safety rules, sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage, and modern Apex idioms for Salesforce development.

Write and debug SOQL queries covering SELECT syntax, filters, sorting, pagination, relationship traversal, and aggregate functions.

Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.

Detect and exploit SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap.

Optimize SQL queries, indexes, and database performance across MySQL, PostgreSQL, SQL Server, and Oracle with execution plan analysis and universal tuning techniques.

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.

Write SOQL queries that group or filter records by date periods using the 13 SOQL date functions, with rules for WHERE vs GROUP BY placement, date-literal comparisons, and fiscal-year restrictions.

Analyze WAF logs from ModSecurity, AWS WAF, or Cloudflare to detect SQL injection attack campaigns, classify injection types, and generate incident reports with OWASP classification.

Tests APIs for injection vulnerabilities including SQL, NoSQL, OS command, LDAP, and SSRF through parameters, headers, and request bodies.

Connect to PostgreSQL, MySQL, SQLite, and SQL Server databases using SQLAlchemy, Pandas, and DuckDB. Read and write tables, manage sessions, and handle connection strings securely.

Configures Salesforce scoping rules to set a default filtered view of records in list views, reports, and SOQL without removing user access.

Use when debugging slow SQL queries, designing database indexes, or rewriting queries for better performance. For EXPLAIN analysis, index strategy, N+1 problem resolution, and query optimization patterns.

Translates natural language data intents into syntactically valid Perfetto SQL queries and executes them against a local trace file using trace_processor.

Creates and manages Cloud SQL instances, databases, and users for MySQL, PostgreSQL, and SQL Server using gcloud CLI commands.

Performs comprehensive SQL code review across all major databases, analyzing security, performance, maintainability, and anti-patterns.

Creates an integration testing plan for .NET data access artifacts during Oracle-to-PostgreSQL database migrations, analyzing a project to identify repositories, DAOs, and service layers that interact with the database, then producing a structured testing plan.

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

Guides database index selection, creation, and maintenance with SQL examples for PostgreSQL and MySQL.

Automates ingestion, normalization, deduplication, and distribution of threat intelligence feeds from STIX/TAXII, open-source, and commercial sources into SIEM platforms for real-time IOC matching and alerting.

Provides PostgreSQL query patterns covering SELECT, JOINs, subqueries, CTEs, window functions, and advanced SQL techniques.

Extracts GraphQL API schemas through introspection attacks, identifies sensitive fields and mutations, and tests for query depth and complexity vulnerabilities.

Analiza datos en bases de datos relacionales con consultas SQL eficientes y legibles, incluyendo joins, window functions, CTEs y subqueries, para extraer insights directamente de la base de datos.

Drizzle Raw SQL

Use for writing, reviewing, debugging, migrating, or testing SQLAlchemy 2.x Core or ORM code involving Engine, Connection, Session, mapped models, select statements, transactions, pooling, results, loading, or AsyncSession. Do not use for raw database SQL with no SQLAlchemy boundary, Alembic migration design, DuckDB relations, or database administration.

SQL patterns for database querying and design

SKILL.md — 硅基生命训练学·索引技能

Integrates Salesforce or external systems with Marketing Cloud Engagement REST and SOAP APIs, covering OAuth 2.0 authentication, journey injection, triggered sends, and Data Extension row operations.

Secure Go backend services against common vulnerabilities. Use when implementing input validation, crypto, or SQL injection prevention in Go.

SQLAlchemy Python SQL toolkit and ORM with powerful query builder, relationship mapping, and database migrations via Alembic

Microsoft SQL Server T-SQL procedural language. Covers stored procedures, functions, triggers, error handling, and SQL Server-specific features. Use for SQL Server database server-side programming. USE WHEN: user mentions "tsql", "T-SQL", "SQL Server procedures", "SQL Server functions", "TRY...CATCH", "THROW", "sp_executesql", "SSMS" DO NOT USE FOR: basic SQL Server SQL - use `sqlserver` instead, PostgreSQL - use `plpgsql` instead, Oracle - use `plsql` instead

Enforces SQL quality gates after every implementation: lint with SQLFluff, validate migrations with Flyway or Liquibase, and run database tests with pgTAP or equivalents.

Documents MariaDB-specific INSERT syntax and behavior, including RETURNING, ON DUPLICATE KEY UPDATE, INSERT IGNORE, and various forms and modifiers, to help write and review INSERT statements.