🧭 Attack Guide

Context-aware guided attack paths. Select your scenario and follow the steps.

How to use: Identify your injection type, pick the matching guide, and follow each step. Every step generates context-specific payloads you can copy directly.

⚡ Union Injection Guide

RECOMMENDED

Full guided flow: column detection → visible cols → DB fingerprint → schema enum → data extraction.

in-bandvisible output

👁 Boolean Blind Guide

Extract data character-by-character when only true/false page differences are visible.

blindpage diff

⏱ Time-Based Blind Guide

Use sleep-based conditionals to extract data when no page difference is visible.

blindlatency

🔓 Auth Bypass Guide

Login bypass methodology: quote injection, OR operator subversion, comment truncation.

authlogin

💥 Error-Based Guide

Exploit verbose SQL errors to extract data. EXTRACTVALUE, UPDATEXML for MySQL; CAST for PostgreSQL/MSSQL/Oracle.

errorsverbose

📁 File Ops Guide

Check privileges → verify secure_file_priv → read sensitive files → write webshell.

RCEFILE priv

🔍 Discovery Engine

ADVANCED

8-module toolkit: Request parser → Polyglot gen → Context detection → DBMS fingerprint → Response diff → Timing calibration → WAF detection → Export.

comprehensiveall DBMSexport

🎯 Param Discovery

NEW

Paste your Burp body and get time/error/boolean sweep payloads for every parameter automatically.

sweepall params

🔬 Payload Corrector

NEW

Select your failure mode, get a root-cause diagnosis and corrected payloads for 23 scenarios.

debugfix

🔍 Quick Discovery Payloads

Test these first to identify injection and DBMS type

🔓 Authentication Bypass

Generate custom auth bypass payloads based on your injection context.

⚙ Payload Generator

Injection Field

SQL Context

Known Username (optional)

Comment Style

📖 All Auth Bypass Payloads

⚡ Union Injection

Build union-based payloads step by step.

⚙ Environment Config

Prefix / Injection Point

Comment Style

Column Count

Visible Column Index (1-based)

Target Database Name

Target Table Name

1. Column Detection

2. Find Visible Cols

3. Fingerprint

4. Schema Enum

5. Data Extraction

ORDER BY method: Increment until the page returns an error - the last successful number is your column count. Then confirm with UNION SELECT.

UNION NULL method: Try with increasing NULLs until no error.

👁 Blind SQL Injection

Boolean-based and time-based blind injection payload generators with character extraction support.

Boolean-Based

Time-Based

Char Extractor

💥 Error-Based Injection

Extract data through verbose SQL error messages.

⚙ Generator

DBMS

Extract Expression

Prefix

Comment

Target Table

Web Root (for webshell write)

Complete exploitation chain: Each DBMS generates the full sequence - Fingerprint → Enumerate DBs → Tables → Columns → Extract Data → Privileges → File Read → RCE/Webshell. Set Target Table and Web Root for targeted payloads.

📖 Error-Based Library

🎯 Universal DB Enumeration Helper

9-step dynamic guide: Step 0 = Param Discovery, Steps 1-7 = Full Enumeration, Step 8 = Burp Body Chain. Works with ANY DBMS.

How it works: Fill the config strip → advance through 9 steps (0-8). Step 0 discovers injectable params. Step 8 generates full Burp-ready body strings. Steps 1-7 enumerate the database.

Prefix

Comment

DBMS

Total Columns

Visible Col (1-based)

Target DB

Target Table

Extract Cols

Target URL

📋 Burp Body (for Step 0 & Step 8)

🎯Param Disc

🔍Detect Cols

👁Visible Col

🧬Fingerprint

🗂List DBs

📋List Tables

🔤List Cols

💥Extract

📋Burp Body

🗄 DB Enumeration Query Builder

Build INFORMATION_SCHEMA queries for any injection scenario.

⚙ Context Config

Injection Prefix

Comment

Total Columns

Visible Column (1-based)

Target Database

Target Table

🎯 Parameter Discovery

Paste your Burp body and get time/error/boolean sweep payloads for every parameter automatically.

Workflow: Copy body from Burp → paste below → select DBMS → click a parameter chip to mark it as injection target → fire sweeps A→B→C → confirm injectable param.

⚙ Configuration

DBMS

Prefix

Comment

Sleep Duration (s)

Full Form Body (from Burp Repeater)

🔍 SQLi Discovery Engine

Systematic parameter discovery, polyglot generation, DBMS fingerprinting, response analysis, and WAF detection - all in one place.

1. Request Parser

2. Polyglot Gen

3. Context Detect

4. DBMS Fingerprint

5. Response Diff

6. Timing

7. WAF Detect

8. Export

🧙 Smart Guide

📥 Request Parser & Parameter Extractor

Paste a raw HTTP request (Burp/ZAP), curl command, URL, or parameter string. The engine extracts and prioritizes all injection points.

Input Format

Target DBMS

Paste Request / URL / Parameters

🧙 Smart Exploitation Guide
Paste your error message → Auto-detect injectable param & DBMS → Guided exploitation chain → Webshell/Reverse Shell

📍 Step 0: Paste Error Response (Auto-Detect Injectable Parameter)

START HERE

Paste the error message or response containing your marker (/*P1*/, /*P2*/, etc.)

Your Original Parameters (from polyglot generator)

⚡ Quick Actions

⚡ Payload Amplifier

Paste a working payload → Auto-detect syntax → Generate complete exploitation chain in the exact same format.

How it works: You found a payload that works? Paste it here. The Amplifier will analyze its syntax (DBMS, injection type, prefix, suffix, comment) and generate hundreds of payloads in the exact same format for enumeration, file ops, webshell, and reverse shell.

📥 Paste Your Working Payload

START HERE

Working Payload (any type: UNION, Error-based, Blind, Stacked, etc.)

Override DBMS (optional)

Override Injection Type (optional)

Your Kali IP (for shells)

🔬 Payload Corrector

Select your failure mode, get a root-cause diagnosis and corrected payloads for 23 scenarios.

⚙ Failure Context

Failure Mode

DBMS

Superuser?

Prefix

Comment

Column Count (0=unknown)

Target Table

Target Columns (comma-separated)

Full Form Body (from Burp)

Current Payload (that failed)

Response / Error Text

How to use:
1. Select the failure mode that matches your situation
2. Fill in the relevant context (DBMS, table, columns)
3. Paste your form body for parameter sweep payloads
4. Click Generate Correction to get targeted payloads for all 23 scenarios

🚀 RCE Paths

Command execution via SQL injection - PostgreSQL, MSSQL, MySQL UDF, SQLite ATTACH.

PostgreSQL

MSSQL

MySQL UDF

SQLite

📁 File Operations

Full guided workflow: privilege check → read files → write proof → deploy web shell with reverse shell.

⚙ Injection Context - configure once, used everywhere

Injection Prefix

Total Columns

Visible Column (1-based)

Comment

Target Host (URL / IP)

Web Root

Attacker IP

Attacker Port (nc)

Step 0 - Verify Privileges

Step 1 - Read Files

Step 2 - Write Test

Step 3 - Web Shell

Step 4 - Rev Shell

Run in order. You need: FILE privilege ✓ + secure_file_priv empty or accessible ✓. If both pass, proceed to Step 1.

Interpreting results:
super_priv → Y = superuser
privilege_type = FILE → FILE privilege confirmed
secure_file_priv → empty string = read/write anywhere | path = restricted | NULL = file ops disabled

🔑 Privilege Enumeration

Enumerate database user privileges, roles, and configuration.

⚙ Payload Config

Total Columns

Visible Column (1-based)

Known Username (optional)

🗺 SQLMap Command Generator

Build fully-featured sqlmap commands from a guided form. Copy and run directly.

💻 Generated SQLMap Command

sqlmap -u "http://target.com/page.php?id=1" --batch

🔥 Quick-Fire SQLMap Patterns

📡 Stacked Queries & Out-of-Band

Stacked (batched) query injection and OOB data exfiltration via DNS/HTTP channels.

Stacked Queries

OOB - DNS

OOB - HTTP

ORDER BY

Second-Order

SQLite

⚙ Stacked Query Generator

DBMS

Prefix

Comment

Injected Statement

Sleep Duration (s)

🔧 HTTP Header Injection

SQL injection through HTTP headers: User-Agent, X-Forwarded-For, Referer, Cookie, and custom headers.

⚙ Header Payload Generator

DBMS

Injection Type

Target Header

Custom Header Name

Extract Expression

Sleep Duration (s)

📖 Header Injection Library

🛡 WAF Bypass Transformer

Apply one or more bypass transforms to any payload. Stack multiple techniques for deeper evasion.

⚙ Bypass Engine

Input Payload

Apply Bypass Techniques (stack multiple)

📖 WAF Bypass Reference

🔤 Encoder / Decoder Suite

Real-time encoding and decoding for payload obfuscation and WAF evasion.

Input String

URL Encode

-

URL Decode

-

Base64 Encode

-

Base64 Decode

-

Hex Encode (0x…)

-

Hex Decode

-

CHAR() Encode

-

Double URL Encode

-

HTML Entities

-

MySQL Hex String

-

Unicode Escape (\uXXXX)

-

ROT13

-

🔏 Hash Identifier

Identify hash types by length and pattern. Then crack with Hashcat or John.

🔍 Paste Hash to Identify

Hash Value

📖 Hash Reference Table

⚡ Hashcat Quick Commands

📚 Full Payload Library

Searchable, categorized collection of all SQLi payloads across all attack types and databases.

📖 Quick Reference

MySQL/MariaDB cheat sheet + DBMS comparison table + operator precedence.

🔬 PortSwigger Web Security Academy

Official SQLi learning path - click any topic to open lab directly.

🧬 Advanced Payload Scenarios

Second-order, JSON/XML context, HTTP headers, ORDER BY, MSSQL, Oracle, MySQL, PostgreSQL, SQLite specialised payload sets.

🌐 External Resources & Live Sources

Curated SQLi wordlists, tools, practice labs, and reference links.