offensive-sqli - SQL Injection Offensive Testing & Exploitation Skill
Performs SQL injection testing across web apps, APIs, WebSockets, and multiple databases, covering detection, exploitation, WAF bypass, and cloud attack path assessment.
Tags
Updated: 2026-06-30SQL injectionoffensive securityweb application securityWAF bypassdatabase exploitationbug bountypenetration testing
Capabilities
What this skill does
- Detect SQL injection vulnerabilities
- Enumerate database schema and version
- Extract data via UNION injection
- Extract data via blind injection
- Bypass WAF with encoding techniques
- Execute OS commands via SQLi
- Test NoSQL and GraphQL injection
- Read and write files via SQLi
- Escalate privileges via database exploitation
- Automate testing with SQLmap Ghauri
- Track ORM CVE vulnerabilities
- Assess cloud-specific SQLi attack paths
- Test WebSocket and API injection
Inputs
- Target web application URL
- HTTP request captures
- API endpoints
- WebSocket connections
- Database type information
- SQLmap configuration
Outputs
- SQL injection vulnerability reports
- Extracted database schema information
- Extracted data records
- WAF bypass payload configurations
- Privilege escalation findings
- Remediation recommendations
Requirements
- Authorization for security testing
- SQLmap installed
- Ghauri installed
- Network access to target
- Burp Suite for request capture