SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.

SKILL: SQL Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Advanced SQLi techniques. Assumes basic UNION/error/boolean blind fundamentals known. Focuses on: per database exploitation, out of band exfiltration, second order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework specific exploitation (ThinkPHP, Django GIS), load the companion [SCENARIOS.md](./SCENARIOS.md). 0. RELATED ROUTING [ghost bits cast attack](../ghost bits cast attack/SKILL.md) when the backend is Java with Jackson and your SQL keywords are WAF blocked — Jackson's charToHex table is indexed by ch & 0xFF , so a Unicode character like 丰 (U+4E30) resolves to hex digit 0 inside a \uXXXX escape sequence, letting you smuggle UNION , SELECT , 1 , etc. without the WAF ever seeing them 1. QUICK START Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: SMB out of band exfiltration via LOAD FILE + UNC paths (Windows MySQL) KEY injection / URI injection / non parameter injection points INSERT/DELETE/UPDATE statement injection differences ThinkPHP5 array key injection ( updatexml error based) Django GIS Oracle utl inaddr.get host name CVE ORDER BY / LIMIT injection techniques Advanced Reference Also load [SQLMAP ADVANCED.md](./SQLMAP ADVANCED.md) when you need: SQLMap tamper scripts matrix and WAF bypass tamper chain recipes (space2comment, between, charencode, etc.) technique , risk / level combinations and second url for second order injection os shell / os pwn OS level exploitation via SQLMap INSERT/UPDATE/DELETE injection patterns with data exfiltration examples GraphQL + SQL injection (batched queries, nested field injection, mutation injection) DB specific advanced functions: PostgreSQL dollar sign quoting, MSSQL linked servers, Oracle DBMS PIPE/DBMS SCHEDULER If you have only confirmed a suspicious SQL sink, do not load extra payload skills first; complete first pass validation here. First pass payload families Situation Start With Why Login or boolean branch ' or 1=1 Fast signal on auth or conditional checks Numeric parameter 1 or 1=1 Avoid quote dependency ORDER BY / sorting 1,2,3 then 1 desc Good for structural probing Visible SQL errors ' then DBMS specific error probes Error text gives DBMS clues No visible output time based payloads Stable fallback for blind targets Heavy filtering / WAF polyglot or whitespace free variants Expands parser confusion surface Small, stable first pass set DBMS routing hints Clue Likely DBMS Good Next Move You have an error in your SQL syntax MySQL try SLEEP() and @@version Microsoft OLE DB Provider MSSQL try WAITFOR DELAY PG:: / PostgreSQL PostgreSQL try pg sleep() ORA prefix Oracle pivot to out of band or XML features SQLite errors, local apps SQLite focus on boolean/UNION and file backed behavior 1. DETECTION — SUBTLE INDICATORS Most SQLi is found by behavioral differences , not errors: Signal Meaning Page loads differently with ' vs '' String context injection point Numeric: 1 vs 1 1 vs 2 1 returns same Arithmetic evaluated 1=1 vs 1=2 in condition changes result Boolean based injection SELECT with ORDER BY N: column count enumeration UNION prep Time delay: '; WAITFOR DELAY '0:0:5' Blind/time based 500 error on ' , 200 on '' Unhandled exception = SQLi Different HTTP response size Boolean blind indicator Critical : test in ALL parameter types — URL query, POST body, JSON fields, XML values, HTTP headers (X Forwarded For, User Agent, Referer, Cookie values). 2. DATABASE FINGERPRINTING Error based fingerprint : inject ' and read error message format. MySQL errors differ from Oracle/MSSQL. 3. UNION BASED DATA EXTRACTION Column count determination : Column type detection (NULL is safest): Database specific string concat (required when column accepts only int): 4. BLIND INJECTION — INFERENCE TECHNIQUES Boolean Blind (conditional response difference) Time Based Blind (no response difference) 5. OUT OF BAND (OOB) EXFILTRATION — CRITICAL Use when blind injection has no time/boolean indicator, or when batch queries can't return data inline. MSSQL — OpenRowSet (requires SQLOLEDB, outbound TCP) Use port 80 or 443 to bypass firewall egress restrictions. Oracle — UTL HTTP (HTTP GET with data in URL path) Oracle's UTL HTTP supports proxy — can exfil through corporate proxy! Oracle — UTL INADDR (DNS exfiltration — often bypasses HTTP restrictions) Attacker sees: HASH VALUE.attacker.com DNS query → read password hash. Oracle — UTL SMTP / UTL TCP MySQL — DNS via LOAD FILE (Windows + UNC path) MySQL — INTO OUTFILE (in band filesystem write) 6. ESCALATION — OS COMMAND EXECUTION MSSQL — xp cmdshell (if enabled, or if sysadmin) MySQL — UDF (User Defined Functions) Write malicious shared library to filesystem, then CREATE FUNCTION ... SONAME . Oracle — Java Stored Procedures 7. SECOND ORDER INJECTION Concept : User input is stored safely (parameterized), but later retrieved as trusted data and concatenated into a new query without re sanitization. Example attack flow : 1. Register username: admin' 2. Application safely inserts this into users table 3. Password change function fetches username from session (trusted!) and builds: 4. Comment strips the condition → updates admin's password Key insight : Any application function that reads stored data and uses it in a new DB query is a second order candidate. Review: password change, profile update, admin action on user data. 8. PARAMETERIZED QUERY BYPASS SCENARIOS Parameterized queries do NOT prevent SQLi when: 1. Table/column names are user controlled — params can't parameterize identifiers: Mitigation: whitelist validate table/column names. 2. Partial parameterization — some fields concatenated, others parameterized: 3. IN clause with dynamic count (common mistake in ORMs): 4. Second order — data retrieved from DB assumed clean, re used in query without params. 9. FILTER EVASION TECHNIQUES Comment Injection (break keywords) Case Variation URL Encoding Whitespace Alternatives String Construction (bypass literal string detection) 10. DATABASE METADATA EXTRACTION MySQL MSSQL Oracle PostgreSQL 11. STORED PROCEDURE ABUSE MSSQL — sp OAMethod (COM automation) Oracle — DBMS LDAP (outbound LDAP = DNS exfil) 12. QUICK REFERENCE — INJECTION TEST STRINGS 13. WAF BYPASS MATRIX Technique Blocked Bypass Space filtered SELECT FROM SELECT/ / // /FROM , SELECT%0a %0aFROM Comma filtered UNION SELECT 1,2,3 UNION SELECT FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c Quote filtered 'admin' 0x61646D696E (hex), CHAR(97,100,109,105,110) OR/AND filtered OR 1=1 <code & 124;& 124;1=1</code , &&1=1 , DIV 0 = filtered id=1 id LIKE 1 , id REGEXP '^1$' , id IN (1) , id BETWEEN 1 AND 1 SELECT filtered Use handler (MySQL), PREPARE +hex, or stacked queries information schema filtered mysql.innodb table stats , sys.schema table statistics Additional WAF bypass patterns: Polyglot: SLEEP(1)/ ' or SLEEP(1) or '" or SLEEP(1) or " / Routed injection: 1' UNION SELECT 0x(inner payload hex) where inner payload is another full query hex encoded Second Order: inject into storage, trigger when data is used in another query later PDO emulated prepare: when PDO::ATTR EMULATE PREPARES=true , stacked queries work even with parameterized looking code 14. WAF BYPASS MATRIX No Space Bypass No Comma Bypass Polyglot Injection Routed Injection Second Order Injection PDO / Prepared Statement Edge Cases Entry Point Detection (Unicode tricks)

sqli-sql-injection