sql-injection-stacked

What problem does it solve?

This Skill helps penetration testers exploit stacked query SQL injection and second-order injection vulnerabilities to gain unauthorized access, manipulate data, and execute commands on target systems.

Core Features & Use Cases

• Stacked Query Exploitation: Execute multiple SQL statements via semicolons for data manipulation, command execution (e.g., xp_cmdshell), and file operations across various database systems (MSSQL, PostgreSQL, Oracle).
• Second-Order Injection: Exploit vulnerabilities where input is stored and later used unsafely in a different query context.
• Database Support: Provides specific payloads and techniques tailored for MSSQL, PostgreSQL, MySQL, and Oracle.
• Use Case: A penetration tester identifies a SQL injection vulnerability and uses this Skill to execute xp_cmdshell on an MSSQL server to gain OS-level access, or to write a webshell to the server.

Quick Start

Use the sql-injection-stacked skill to attempt to execute 'whoami' on the target database.