sql-injection-testing — Claude Code skill
A skill that walks an agent through SQL injection testing on web apps: spotting injectable parameters, confirming the flaw, and getting past filters. Meant for pentests you are authorized to run.
npx claude-code-templates@latest --skill security/sql-injection-testingWhat sql-injection-testing does
The skill splits the work into phases. Reconnaissance comes first: the agent looks for user-controlled input in URL parameters, form fields, cookies and headers, then probes each one with a quote or a semicolon and watches how the server reacts. Boolean payloads such as OR 1=1 against AND 1=2 confirm that the parameter really reaches a query.
Exploitation is organised by technique. UNION-based extraction starts with ORDER BY to count columns, error-based payloads pull data out of database messages, and blind boolean and time-based variants lean on SLEEP or WAITFOR DELAY when nothing is echoed back. Out-of-band covers DNS and HTTP channels. A separate phase handles login forms, including payloads like admin'-- and ' OR '1'='1 with an explanation of how a comment cuts the password check out of the query. Filter bypass closes the skill: URL and double URL encoding, comments or tabs instead of spaces, mixed case and inline comments inside keywords.
You need a proxy such as Burp Suite, SQLMap installed, and a browser with developer tools. Familiarity with MySQL, MSSQL, PostgreSQL and Oracle syntax matters, since the payloads differ per database. Written authorization for the test is a hard requirement the skill states outright — running it against a system you do not own is not a grey area.
What it helps with
- find parameters that reach a SQL query unsanitised
- confirm injection by comparing true and false conditions
- dump table and column names via UNION or database errors
- get past a login form with a comment in the username field
- slip a payload past quote and whitespace filters
Example prompts for the agent
- Test the
?id=1parameter on this URL for SQL injection and show me the server response - Work out the column count with
ORDER BYand pull the table list frominformation_schema - Bypass the login form on my test instance using an injection in the username field
How to install sql-injection-testing
1claude-code-templates
npx claude-code-templates@latest --skill security/sql-injection-testing2Skills CLI (Vercel)
npx skills add davila7/claude-code-templates --skill sql-injection-testing -a claude-code3Manually: put the files in place
~/.claude/skills/sql-injection-testing/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/sql-injection-testing/
Manually: put the files in place
.agents/skills/sql-injection-testing/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/sql-injection-testing/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install davila7/claude-code-templates sql-injection-testing2Manually: put the files in place
.github/skills/sql-injection-testing/SKILL.mdPlatform CLI
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/sql-injection-testingManually: put the files in place
.devin/skills/sql-injection-testing/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about sql-injection-testing
How do I install sql-injection-testing in Claude Code?
Use the templates command: npx claude-code-templates@latest --skill security/sql-injection-testing. Or run npx skills add davila7/claude-code-templates --skill sql-injection-testing -a claude-code. The skill file then sits at ~/.claude/skills/sql-injection-testing/SKILL.md.
What does sql-injection-testing do?
It runs a SQL injection assessment against a web app: locating injectable inputs, proving the vulnerability, extracting data and bypassing authentication. It also covers filter evasion when quotes or keywords are blocked.
What do I need before running it?
A proxy for editing requests, SQLMap installed, and a browser with developer tools. You also need written authorization for the pentest with the target scope defined.
