Strix•SQL 注入
Strix SQL 注入测试手册,覆盖 union、blind、error-based 与 ORM 绕过技巧;触发名:strix-sql-injection
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-sql-injection --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# SQL Injection SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect. ## Attack Surface **Databases** - Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle - Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins **Integration Paths** - ORMs, query builders, stored procedures - Search servers, reporting/exporters **Input Locations** - Path/query/body/header/cookie - Mixed encodings (URL, JSON, XML, multipart) - Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements) - Query builders: `whereRaw`/`orderByRaw`, string templates in ORMs - JSON coercion or array containment operators - Batch/bulk endpoints and report generators that embed filters directly ## Detection Channels **Error-Based** - Provoke type/constraint/parser errors revealing stack/version/paths **Boolean-Based** - Pair requests differing only in predicate truth - Diff status/body/le
- Attack Surface
- Detection Channels
- DBMS Primitives
- MySQL
- PostgreSQL
- MSSQL
- Oracle
- Key Vulnerabilities
- UNION-Based Extraction
- Blind Extraction
- Out-of-Band
- Write Primitives
- ORM and Query Builders
- Uncommon Contexts
What does the Strix•SQL 注入 skill do?
Strix SQL 注入测试手册,覆盖 union、blind、error-based 与 ORM 绕过技巧;触发名:strix-sql-injection
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-sql-injection --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.