exploit-sqli
SQL Injection Detection & Exploitation
Authorization Warning
DANGER: SQL injection testing can damage or destroy data in production databases. Always ensure you have:
- Written permission from the target application owner
- Isolated testing environment
- Backups of affected systems
- Legal compliance with local regulations
Never test SQL injection on production databases without authorization.
Prerequisites
Required tools that must be installed on your system:
- sqlmap -
pip install sqlmaporgit clone https://github.com/sqlmapproject/sqlmap
More from crazymarky/pentest-skills
exploit-xss
Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.
15recon-fingerprint
Web fingerprinting and WAF detection using wafw00f, whatweb, nuclei, and httpx. Use this skill when user needs to identify web technologies, detect WAF/CDN, analyze server headers, or fingerprint web applications and frameworks.
15recon-dir-scan
Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumerate files, find backup files, or map application structure through path fuzzing.
14recon-port-scan
Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts.
14exploit-file-download
任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。
14recon-subdomain
Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, perform DNS enumeration, gather DNS records, or find hidden subdomains of a target domain.
13