SQL Injection Testing
Core Posture
Treat SQLi as query-structure control. Identify which input affects SQL syntax, logic, timing, errors, or backend query behavior, then confirm with minimal, bounded evidence.
Priority Patterns
- Search, filters, reports, dashboards, analytics, admin lists, and CSV/JSON conversion.
- API parameters, array parameters, JSON bodies, GraphQL filters, headers, and User-Agent.
- Blind/time-based paths with no visible output.
- SQLi-to-RCE or file read through database features, stacked queries, or privileged functions.
- Second-order SQLi through stored fields later used in admin or reporting queries.
Assessment Loop
- Inventory query-like inputs and compare response differences, errors, timing, and result counts.
- Identify database hints from errors, behavior, syntax, and stack traces.
- Confirm injection with harmless boolean, error, or timing tests.
- Explore impact only enough to determine data sensitivity, auth boundary, or execution potential.
- Check whether filters, arrays, JSON, GraphQL, and headers reach the same query builder.
High-Value Cues
| Cue |
Ask |
| Search/filter |
Does syntax alter result count or timing? |
| Arrays/JSON |
Are nested values interpolated unsafely? |
| Admin/report |
Does low-role input reach privileged query paths? |
| Blind path |
Can timing confirm control? |
| DB feature |
Can SQLi read files, write files, or execute code? |
Variant Playbook
- Test strings, numbers, arrays, repeated parameters, JSON values, sort/order fields, and headers.
- Compare boolean true/false, syntax error, time delay, and out-of-band behavior.
- Test transport-encoded inputs only when the application or client decodes them before query construction; compare equivalent raw and decoded values, comment styles, database-specific syntax, and type confusion.
- Check stored inputs later rendered in reports, exports, admin search, or background jobs.
Confirmation Discipline
Strong evidence shows controlled SQL logic, timing, error, data extraction, file access, or execution path. Rule out generic errors, WAF blocks, and response differences unrelated to query behavior.
References
Read references/advanced-methodology.md only when the task needs deeper query-surface inventory, application-decoded input checks, blind SQLi confirmation, second-order checks, SQLi-to-RCE/file-read review, or remediation guidance.
1---2name: sqli3description: Advanced SQL injection testing methodology for bug bounty and application security work. Use when testing or reviewing SQLi, blind SQLi, time-based SQLi, error-based SQLi, second-order SQLi, GraphQL or API filter SQLi, search/report/admin SQLi, JSON or array parameter SQLi, header-based SQLi, SQLi-to-file-read, SQLi-to-RCE, and workflows where user-controlled input reaches database queries or query builders unsafely.4---56# SQL Injection Testing78## Core Posture910Treat SQLi as query-structure control. Identify which input affects SQL syntax, logic, timing, errors, or backend query behavior, then confirm with minimal, bounded evidence.1112## Priority Patterns1314- Search, filters, reports, dashboards, analytics, admin lists, and CSV/JSON conversion.15- API parameters, array parameters, JSON bodies, GraphQL filters, headers, and User-Agent.16- Blind/time-based paths with no visible output.17- SQLi-to-RCE or file read through database features, stacked queries, or privileged functions.18- Second-order SQLi through stored fields later used in admin or reporting queries.1920## Assessment Loop21221. Inventory query-like inputs and compare response differences, errors, timing, and result counts.232. Identify database hints from errors, behavior, syntax, and stack traces.243. Confirm injection with harmless boolean, error, or timing tests.254. Explore impact only enough to determine data sensitivity, auth boundary, or execution potential.265. Check whether filters, arrays, JSON, GraphQL, and headers reach the same query builder.2728## High-Value Cues2930| Cue | Ask |31| --- | --- |32| Search/filter | Does syntax alter result count or timing? |33| Arrays/JSON | Are nested values interpolated unsafely? |34| Admin/report | Does low-role input reach privileged query paths? |35| Blind path | Can timing confirm control? |36| DB feature | Can SQLi read files, write files, or execute code? |3738## Variant Playbook3940- Test strings, numbers, arrays, repeated parameters, JSON values, sort/order fields, and headers.41- Compare boolean true/false, syntax error, time delay, and out-of-band behavior.42- Test transport-encoded inputs only when the application or client decodes them before query construction; compare equivalent raw and decoded values, comment styles, database-specific syntax, and type confusion.43- Check stored inputs later rendered in reports, exports, admin search, or background jobs.4445## Confirmation Discipline4647Strong evidence shows controlled SQL logic, timing, error, data extraction, file access, or execution path. Rule out generic errors, WAF blocks, and response differences unrelated to query behavior.4849## References5051Read `references/advanced-methodology.md` only when the task needs deeper query-surface inventory, application-decoded input checks, blind SQLi confirmation, second-order checks, SQLi-to-RCE/file-read review, or remediation guidance.
yafet-dev