Sqli To Data Exfil
Escalate a suspected or confirmed SQL injection into proof-level data exfiltration.
Install
npx skills add vigolium/vigolium --skill sqli-to-data-exfil -g -a claude-code -y- Repository
- vigolium/vigolium1.1k
- Category
- Data and ML
- Updated
- 10d ago
- License
- MIT
- Context cost
- Lightabout 1,444 tokens
- Runs scripts
- No, instructions only
What it does
Escalate a suspected or confirmed SQL injection into proof-level data exfiltration. Use when you spot an SQL error in a response, a record from a prior scan flagged a SQLi pattern, or boolean/time differentials indicate the payload reaches the query parser. Walks from probe → confirm → enumerate → exfil with payload-class-aware techniques (in-band, blind boolean, blind time, blind OAST) and ends by persisting a concrete finding with the leaked sample.
SQLi → Data Exfiltration
You suspect SQL injection somewhere in the target. Your job is to turn that suspicion into proof, a real exfil sample from the database, and persist it as a finding with reproducible evidence. Speculation isn't a finding.
When this skill applies
Trigger this strategy when any of these is true:
- An HTTP record's response contains an SQL error fragment:
SQLITE_ERROR,ORA-,MySQL syntax,PostgreSQL,unclosed quotation mark,mismatched parenthesis,near "X": syntax error. - A prior scan's record body has a
q=...',id=...',search=...payload that triggered a 500 / different content-length / reflected error. - A user-controlled parameter feeds into a
SELECT/WHERE/ORDER BYcontext that the response body or scanner finding directly suggests. - The audit harness produced a finding with CWE-89 / "SQL Injection" / "blind SQLi", even theoretical.
If you only have a generic "fuzz everything" task, stop and pick a record
first (query_records then inspect_record). Do not run this skill blind.
Workflow
1. Anchor on a record
Pick the strongest candidate via query_records filters (status: [500],
search: "SQL", has_params: true) and inspect_record to load its raw
request and the parsed insertion points. Note the insertion point name
and type (URL_PARAM, POST_BODY_PARAM, HEADER, JSON_PATH), payload
encoding differs per type.
remember the chosen insertion point with a key like sqli-target so the
plan survives context churn.
2. Classify the injection
Run two probes with replay_request against the chosen insertion point:
