📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills sqlmap-database-penetration-testing
📦
sqlmap-database-penetration-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access
Assess SQL Injection with SQLMap
SQL injection testing needs repeatable checks and strict scope control. This skill guides authorized SQLMap workflows for discovery, enumeration, and reporting.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "sqlmap-database-penetration-testing" from https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-sqlmap-database-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "sqlmap-database-penetration-testing". Authorized tester asks for a safe first SQLMap assessment plan.
Expected outcome:
A scoped test plan with target confirmation, low-impact detection, evidence capture, and reporting checkpoints.
Using "sqlmap-database-penetration-testing". Security engineer asks how to enumerate a confirmed lab injection.
Expected outcome:
A staged workflow covering database discovery, table review, column review, and minimal proof collection.
Using "sqlmap-database-penetration-testing". Instructor asks for a classroom exercise about SQL injection impact.
Expected outcome:
A lab-focused lesson outline with prerequisites, controlled target assumptions, expected observations, and ethics reminders.
Security Audit
Criticalv5 • 7/7/2026 Open versioned report
The static Ruby backtick findings are Markdown false positives, but the skill contains high-risk offensive SQLMap guidance. Confirmed issues include sensitive file access, remote command execution, public target exploitation examples, credential dumping, and evasion guidance.
1
Files scanned
401
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
System password file access
sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
The example directs SQLMap to read /etc/passwd from a target server. That is sensitive file access through exploitation, even if presented as guidance.
Critical
Post-Exploitation Server Control Guidance
The advanced section shows OS shell access, OS command execution, server file reads, and server file writes through SQLMap. These actions can lead to full target host compromise.
The cited section directly includes SQLMap OS shell, OS command, file-read, and file-write operations against a target server.
High
System reconnaissance
sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
The command runs whoami on the target through SQLMap OS command execution. This is post-exploitation command execution guidance.
High
Credential and Sensitive Data Dumping Guidance
The skill lists extracted usernames, passwords, hashes, and sensitive data as deliverables and provides SQLMap dump workflows. This enables unauthorized database data extraction if used outside approved scope.
The text explicitly names credential and hash extraction and shows table, column, and full database dump workflows.
High
Evasion and Unscoped Target Discovery Guidance
The skill includes Google dork target discovery, random user agents, Tor proxying, request delays, and WAF tamper scripts. These tactics are useful for unauthorized discovery and evasion.
The cited lines combine target discovery with anonymity, rate-limit avoidance, user-agent rotation, and WAF tamper guidance.
Medium
System reconnaissance
- Consider `--delay` to avoid triggering rate limits
The advice recommends delays to avoid triggering rate limits. This can reduce operational impact, but it also supports evasion during scanning.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Medium
Hardcoded URL
sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch
The example targets a real external vulnerable website with SQLMap enumeration and dumping commands. That creates network exploitation risk if followed outside clear authorization.
Risk Factors
⚙️ External commands (92)
SKILL.md:17 SKILL.md:37-43 SKILL.md:43-46 SKILL.md:46-52 SKILL.md:52-57 SKILL.md:57-59 SKILL.md:59-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-69 SKILL.md:69-71 SKILL.md:71-74 SKILL.md:74-75 SKILL.md:75-80 SKILL.md:80-82 SKILL.md:82-85 SKILL.md:85-86 SKILL.md:86-91 SKILL.md:91-93 SKILL.md:93-96 SKILL.md:96-98 SKILL.md:98-101 SKILL.md:101-103 SKILL.md:103-106 SKILL.md:106-107 SKILL.md:107-108 SKILL.md:108-113 SKILL.md:113-116 SKILL.md:116-119 SKILL.md:119-122 SKILL.md:122-125 SKILL.md:125-130 SKILL.md:130-133 SKILL.md:133-136 SKILL.md:136-144 SKILL.md:144-145 SKILL.md:145-146 SKILL.md:146-147 SKILL.md:147-148 SKILL.md:148-171 SKILL.md:171-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-182 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197-198 SKILL.md:198-210 SKILL.md:210-211 SKILL.md:211 SKILL.md:212-222 SKILL.md:222-223 SKILL.md:223-224 SKILL.md:224-229 SKILL.md:229-244 SKILL.md:244-247 SKILL.md:247-257 SKILL.md:257-260 SKILL.md:260-267 SKILL.md:267-270 SKILL.md:270-276 SKILL.md:276-279 SKILL.md:279-293 SKILL.md:293-296 SKILL.md:296-308 SKILL.md:308-315 SKILL.md:315-327 SKILL.md:327-332 SKILL.md:332-347 SKILL.md:347-352 SKILL.md:352-361 SKILL.md:361-366 SKILL.md:366-372 SKILL.md:372-377 SKILL.md:377-386 SKILL.md:386-391 SKILL.md:391-400
🌐 Network access (27)
SKILL.md:39 SKILL.md:48 SKILL.md:51 SKILL.md:58 SKILL.md:70 SKILL.md:81 SKILL.md:92 SKILL.md:97 SKILL.md:102 SKILL.md:127 SKILL.md:128 SKILL.md:231 SKILL.md:235 SKILL.md:239 SKILL.md:243 SKILL.md:262 SKILL.md:263 SKILL.md:272 SKILL.md:275 SKILL.md:281 SKILL.md:288 SKILL.md:298 SKILL.md:301 SKILL.md:304 SKILL.md:307 SKILL.md:262 SKILL.md:263
Detected Patterns
System password file accessSystem reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-sqlmap-database-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-sqlmap-database-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). sqlmap-database-penetration-testing security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5BibTeX citation
@techreport{sickn33-sickn33-sqlmap-database-penetration-testing-2026,
author = {sickn33},
title = {sqlmap-database-penetration-testing security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sqlmap-database-penetration-testing security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-sqlmap-database-penetration-testing/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-sqlmap-database-penetration-testing:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Validate Scoped Web Applications
Plan SQLMap checks for a client-approved URL and document injection evidence without exceeding scope.
Confirm Remediation In Staging
Retest a fixed endpoint in a controlled environment and compare current behavior with the prior finding.
Teach Database Attack Concepts
Build lab exercises that explain SQL injection enumeration, impact, and reporting responsibilities.
Try These Prompts
Begin Authorized Check
I have written authorization to test this lab endpoint. Help me plan a low-impact SQLMap check and reporting notes.
Map Database Structure
For an authorized training target, outline the SQLMap sequence to enumerate databases, tables, and columns safely.
Use Captured Requests
I have a scoped HTTP request file from my engagement. Explain how to test the chosen parameter and record evidence.
Plan Advanced Retesting
Within an approved staging environment, help me tune SQLMap options for reliability while minimizing traffic and data access.
Best Practices
- Confirm written authorization and exact scope before any scan.
- Use owned systems, staging environments, or purpose-built training labs.
- Collect the minimum evidence needed and avoid unnecessary sensitive data dumps.
Avoid
- Running scans against unknown domains or search results.
- Dumping credentials when limited proof is enough.
- Using evasion or anonymity options to bypass monitoring.
Frequently Asked Questions
Does this skill run SQLMap automatically?
No. It provides guidance and example workflows. Users must run tools themselves in authorized environments.
Can I use it on public websites?
Only with explicit written permission. Unapproved testing can be illegal and harmful.
What tools does it assume?
It assumes SQLMap is installed and that the user can capture or supply valid HTTP requests.
Does it help with reporting?
Yes. It highlights evidence, database enumeration steps, limitations, and legal scope reminders.
Can it bypass security controls?
The source includes evasion examples. Use such options only when they are explicitly allowed by scope.
Is it suitable for beginners?
It can help beginners in labs, but users need basic web security knowledge and clear authorization.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
8 downloads · 145 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
webapp-sqlmap
38Assess SQL Injection with SQLMap
by AgentSecOps
Manual SQL injection testing is slow and inconsistent. This skill provides structured SQLMap commands, authorization checks, validation steps, and reporting guidance for approved assessments.
Security & Compliance View
📦
exploitation-knowledge
38Assess Exploitation Techniques and Shell Access
by CharlesKozel
Security teams need a structured way to review exploit workflows and understand operational risk. This skill organizes exploitation methods, payload choices, and post-access checks for controlled lab or audit review.
Security & Compliance View
📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Security & Compliance View
📦
senior-security
81Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Security & Compliance View
📦
security-report
78Create Security Assessment Reports
by BytR-Ecosystems
Security findings often become inconsistent reports that are difficult to prioritize. This skill guides structured DOCX reports with risk ratings, evidence, and remediation plans.
Security & Compliance View
📦
security
78Harden Web Security Boundaries
by shreyam1008
Security reviews often miss validation, authorization, session, and secret-handling weaknesses. This skill gives developers a practical defensive checklist for safer web changes.
Security & Compliance View