SQL injection hunting
Treat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
- SQL injection - Boolean and error first. Blind time second. OAST last. Never dump a customer table.
Disclosures
- Unauthenticated SQL-injection exposure in an archive interface - SQL injection
- Blind SQL-injection signal in a public search surface - Blind SQL injection
Playbooks
- SQL injection hunting - Treat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.
Workflows
- Owned-row SQLi discriminator - Boolean/error probe on a record you created, then a unique canary. No tenant dumps, no --batch spray.
Payloads
- SQL Injection - Detection first (error/boolean/time), then extraction (union). Confirm and exploit with sqlmap once a candidate responds. Grouped: auth bypass, boolean, error, UNION, time-based, and a stacked/WAF variant.
Bypasses
- SQLi filter / quote bypass - Get injection working when quotes, spaces or keywords are filtered. Confirm and weaponise with sqlmap's tamper scripts once a candidate responds.
Questions
Is sqlmap --batch OK on a bounty?
Usually no. Tight -p, risk 1, owned row. A dump of another tenant is out of scope and often a ban.
What is enough evidence?
Control vs syntax probe, then boolean on a record you created, or one OAST callback. Not a table dump.
This page is the linked pack hunt_brief("sqli") returns on the MCP connector. Authorized testing only.