hunt-sqli SKILL.md skillA
hunt-sqli from galact-byte/galact-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add galact-byte/galact-skills/hunt-sqli@git:20260806.1b94651Pins git:20260806.1b94651 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- galact-byte/galact-skills
- Path
skills/hunt-sqli/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260806.1b94651, committed Aug 6, 2026
- Size
- 4,061 bytes
- Repository stars
- 7
- License
- a license file GitHub does not identify
在授权渗透测试中挖掘 SQL/NoSQL 注入（SQLi、NoSQLi，含 WAF 绕过、盲注、堆叠查询、类型混淆注入）。当用户输入拼进 SQL/NoSQL 查询时使用——典型场景：id/搜索/排序/过滤参数、数组键当 SQL 片段、PHP 类型混淆、MongoDB `$where`/`$regex`、堆叠查询到 xp_cmdshell。适用目标类型 Web / REST API。触发场景包括用户说"测下 SQL 注入""这个参数能不能注入""盲注/时间注入试试""NoSQL/MongoDB 注入看一下"。输出：注入点 + 类型 + 证据的 finding（含 killed 记录）。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# hunt-sqli · SQL/NoSQL 注入猎杀 只解决**注入到查询语句一类**（SQL 与 NoSQL）。核心是对每个参数按**错误型 → 布尔盲 → 时间盲**递进判活，识别数据库类型，必要时绕 WAF。判定靠**可控的响应差异/时延/报错**，只做**只读证明**（`sleep`/布尔差异/版本号），不 dump 真实数据、不改写数据。 注入可读写数据库甚至 RCE，敏感且可能破坏。默认只做**判活与最小证明**（拿到 DB 版本/布尔可控/时延），不 `DROP`/`UPDATE`/不批量导出真实数据。payload、绕过、真实报告见 `reference.md`。 ## Scope（授权范围） **先确认授权。** 落实：授权目标、允许深度（仅判活 / 允许读 schema / 禁止写与批量 dump）、是否允许时间盲注（会拖慢目标）。任一不清楚就停下问。 ## Goal 判定参数是否可注入查询，识别 DB 类型与注入类型（错误/布尔/时间/堆叠/NoSQL），给出可复现 PoC 与最小证明，不动真实数据。 ## Workflow `scope-check → recon → hunt → validate → report`。 ### 1. scope-check - **动作**：写 `evidence/scope.txt`（allow_time_blind / allow_schema_read）。 - **命令**：`bash tools/recon.sh <target> --scope-only`。 - **终止条件**：scope 明确，否则 KILL。 ### 2. recon - **动作**：枚举进查询的参数——`id`/搜索/排序（`order`/`sort`）/过滤/分页，JSON body（NoSQL），数组参数（`a[]=`）。 - **输出**：`recon/endpoints.json`。 - **命令**：`bash tools/recon.sh <target>`。 - **终止条件**：至少 1 个候选参数。 ### 3. hunt - **动作**：对每个参数按 `reference.md` 递进：①错误型（`'`、`"`、`)` 触发 SQL 报错）②布尔型（`' AND 1=1` vs `' AND 1=2` 响应差异）③时间型（`' AND SLEEP(6)`、`;WAITFOR DELAY`、`pg_sleep`）④NoSQL（`[$ne]`/`[$gt]`/`$where`）。以差异/时延判活。 - **输出**：`candidates.json`。 …
Read the whole file at its exact version.
How to install
mdr add galact-byte/galact-skills/hunt-sqli@sha256:390fd70d29430911The line at the top of this page pins the label git:20260806.1b94651, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_5c6y6bugyhp3mhbc)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 6, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4061 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
galact-byte/galact-skills · 7 stars · license a license file GitHub does not identify · pushed 2026-10-12 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_5c6y6bugyhp3mhbc GET https://markdownregistry.com/api/v1/resolve?ref=galact-byte/galact-skills/hunt-sqli GET https://markdownregistry.com/api/v1/blob/390fd70d294309116caa72afb065f36348d5f043b481c213438e5eef57f2220b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from galact-byte/galact-skills
Every file in galact-byte/galact-skills