SQL injection hunting
Treat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.
Playbooks
- SQL injection hunting - Treat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.
Payloads
- Polyglots - Single strings that fire across multiple contexts - ideal for one-shot fuzzing when you don't yet know the sink. The 0xsobky XSS polyglot survives most encoding contexts; the SQLi polyglot triggers error/union/boolean at once.
- SQL Injection - Detection first (error/boolean/time), then extraction (union). Confirm and exploit with sqlmap once a candidate responds. Grouped: auth bypass, boolean, error, UNION, time-based, and a stacked/WAF variant.
- NoSQL Injection - MongoDB and friends. Use operator injection in JSON bodies and bracket notation in query strings to bypass auth or exfiltrate via boolean/regex conditions.
- JWT Attacks - Probe weak verification. Confirm with jwt_tool. Try alg:none, RS256→HS256 key confusion, and kid path/SQL injection; crack HS256 secrets offline.
Bypasses
- WAF evasion (Cloudflare / Akamai / AWS) - Get a payload past signature-based WAFs. The JSON-SQLi and encoding-layer tricks below still bypass major WAFs; stack transforms with the Transform bench on /utils/.
- SQLi filter / quote bypass - Get injection working when quotes, spaces or keywords are filtered. Confirm and weaponise with sqlmap's tamper scripts once a candidate responds.
Checklists
- SQL injection - Boolean and error first. Blind time second. OAST last. Never dump a customer table.
Tools
- sqlmap - The definitive automatic SQL injection and database takeover tool. Deep detection and exploitation across many DBMSes.
- gf - A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.
- ghauri - SQL injection detection and exploitation tool with a lighter footprint than sqlmap. Still a lab/owned-row tool on bounty programs: tight -p, no --batch spray.
Workflows
- Owned-row SQLi discriminator - Boolean/error probe on a record you created, then a unique canary. No tenant dumps, no --batch spray.
Related disclosures
- Unauthenticated SQL-injection exposure in an archive interface - SQL injection
- Blind SQL-injection signal in a public search surface - Blind SQL injection
- MOVEit Transfer SQL injection - SQL injection
Questions
Is sqlmap --batch OK on a bounty?
Usually no. Tight -p, risk 1, owned row. A dump of another tenant is out of scope and often a ban.
What is enough evidence?
Control vs syntax probe, then boolean on a record you created, or one OAST callback. Not a table dump.
This page is the public form of hunt_brief("sqli") on the MCP connector. Authorized testing only.