Agent skill · security · yaklang
sqli-sql-injection
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
Why this skill is useful
Adds advanced SQL injection techniques and specific exploitation patterns that the AI wouldn't reliably generate on its own.
What it needs
About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: SQL Injection — Expert Attack Playbook AI LOAD INSTRUCTION: Advanced SQLi techniques. Assumes basic UNION/error/boolean-blind fundamentals known. Focuses on: per-database exploitation, out-of-band exfiltration, second-order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real-world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework-specific exploitation (ThinkPHP, Django GIS), load the companion SCENARIOS.md. 0. RELATED ROUTING ghost-bits-cast-attack when the backend is Java with Jackson and your SQL keywords are WAF-blocked — Jackson's charToHex table is indexed by ch & 0xFF, so a Unicode character like 丰 (U+4E30) resolves to hex digit 0 inside a \uXXXX escape sequence, letting you smuggle UNION, SELECT, 1, etc. without the WAF ever seeing them 1. QUICK START Extended Scenarios Also load SCENARIOS.md when you need: SMB out-of-band exfiltration via LOADFILE + UNC paths (Windows MySQL) KEY injection / URI injection / non-parameter injection points INSERT/DELETE/UPDATE statement injection differences ThinkPHP5 array key injection (updatexml error-based) Django GIS Oracle utlinaddr.gethostname CVE ORDER BY / LIMIT injection techniques Advanced Reference Also load SQLMAPADVANCED.md when you need: SQLMap tamper scripts matrix and WAF bypass tamper chain recipes (space2comment, between, charencode, etc.) --technique, --risk/--level combinations and --second-url for second-order injection --os-shell / --os-pwn OS-level exploitation via SQLMap INSERT/UPDATE/DELETE injection patterns with data exfiltration examples GraphQL + SQL injection (batched queries, nested field injection, mutation injection) DB-specific advanced functions: PostgreSQL dollar-sign quoting, MSSQL linked servers, Oracle DBMSPIPE/DBMSSCHEDULER If you have only confirmed a suspicious SQL sink, do not load extra payload skills first; complete first-pass validation here. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/sqli-sql-injection