Deepen SQLi guidance: DBMS fingerprinting, injection coverage, read-only impact proof#84
Open
letztek wants to merge 1 commit into
Open
Deepen SQLi guidance: DBMS fingerprinting, injection coverage, read-only impact proof#84letztek wants to merge 1 commit into
letztek wants to merge 1 commit into
Conversation
…read-only impact proof Strengthen the SQL injection sections so a hunter finds and confirms more real injections instead of stopping at a single error or sleep. - bug-bounty: add a stack->DBMS fingerprint table (pick the matching blind probe or the bug reads as a clean target), an injection-point checklist (sort/ORDER BY columns, headers, cookies, second-order, JSON keys), and a read-only confirm -> prove-impact flow. OS-RCE escalation demoted to a single scope-conditional note. - security-arsenal METHODOLOGY_CHEATSHEET: add a "prove it's real & readable" step plus a conditional escalation line. - web2-vuln-classes: add the DBMS fingerprint table and a read-only proof one-liner to the SQL injection section. - security-arsenal: add a fingerprint + prove-readable-data payload block. Emphasis throughout: reading a credentials/config table is already a valid finding; DB->OS escalation is conditional and usually out of BBP scope. Read-only proof preferred; nothing destructive added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Deepens the SQL injection guidance so it covers finding and confirming more real injections, not just detecting one. Four skills touched, additive only (60 lines, no deletions):
skills/bug-bounty/SKILL.mdsort/ORDER BYcolumns, headers, cookies, second-order, JSON keys), read-only confirm → prove-impact flowskills/security-arsenal/METHODOLOGY_CHEATSHEET.mdskills/web2-vuln-classes/SKILL.mdskills/security-arsenal/SKILL.mdWhy
SLEEP(5)at an MSSQL backend (which needsWAITFOR DELAY) makes a real blind injection read as a clean target. The fingerprint table maps common tech signals (.asp/IIS → MSSQL,.php→ MySQL, Java/Python → PG/Oracle) to the right probe.ORDER BY/sort=columns (can't be parameterized), headers/cookies used in lookups, and second-order paths.boolean → ORDER BY → UNION → one valueflow proves the injection is real and the data is readable — cutting error-only false positives and catching blind cases that a single'misses.Scope discipline
Reading a credentials/config table is treated as a valid standalone finding — no RCE required. DB→OS escalation (
xp_cmdshell/COPY … FROM PROGRAM/INTO OUTFILE) is kept to a single conditional note: only when the DB account is sysadmin/superuser and host exploitation is in program scope. Read-only proof is preferred throughout; nothing destructive is added.