Skip to content
Get packs

SQL Injection Testing Playbook

Guides an agent through SQL injection testing methods, payloads, and exploitation for security assessments.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This is a reference playbook that teaches an AI agent how to find and exploit SQL injection flaws in web applications and APIs. Once installed, when asked about SQL injection testing, the agent can follow a structured method: map inputs, probe for injection, identify the database type, enumerate schema and extract data, and write up findings with remediation. It covers many database systems (MySQL, MSSQL, PostgreSQL, Oracle, MongoDB, Neo4j), WAF bypass tricks, cloud-specific attack paths, and commands for the SQLmap and related tools.

Great for

  • Security professionals running authorized penetration tests or bug bounty programs who want a quick reference for SQLi techniques
  • Developers or AppSec engineers who want to understand the attack patterns they must defend against
  • Students learning web application security in lab environments

Skip it if

  • Testing systems you do not own or have written permission to test, since exploitation of others' systems is illegal and can cause real harm
  • Production systems without a agreed scope and rollback plan, because payloads like time-based sleeps, DROP TABLE, file writes and OS command execution can damage data or availability
  • Non-security users looking for general database query help, since the content is oriented toward attacking rather than building applications

Try asking

  • “Walk me through testing this login form for SQL injection, including boolean-based blind detection, in my authorized lab.”
  • “Give me a sqlmap workflow to enumerate databases through a captured request file.”
  • “Which WAF bypass techniques should I try against a MySQL endpoint that blocks UNION SELECT?”
  • “Write a remediation summary for a SQL injection finding in our search API.”
Step-by-step guide: how to use SQL Injection Testing PlaybookInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-sqli.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-sqli.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-sqli.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State your authorization scope and target clearly so the agent keeps testing within bounds and recommends remediation.
  • Ask for detection steps first and escalate to exploitation only when a finding is confirmed in scope.
  • Verify any suggested payloads in a safe lab before running them against a real target, since the file contains destructive examples.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.