Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-05.1
Testing for SQL Injection - Oracle
Passed 19 of 22 test cases with the skill, and 18 of 22 without it.
1 fixed18 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
We need to audit a URL parameter on a target web application that appears to run on an Oracle backend. Can you outline a step-by-step CLI workflow using curl and SQLMap to confirm Oracle database presence, test string concatenation syntax, and extract database version or user information?
| Checked | Without skill | With skill |
|---|---|---|
| Workflow includes a curl command searching for ORA- error patterns. | Missed | Passed |
| Workflow includes a curl command testing string concatenation with double pipes. | Passed | Passed |
| Workflow includes a SQLMap command specifying --dbms=oracle. | Passed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-05.1
Testing for SQL Injection - Oracle
Oracle-specific SQL injection testing focuses on exploiting Oracle Database features, syntax, and built-in functions. Oracle's unique characteristics include PL/SQL, dual table, specific error messages, and distinct functions that can be leveraged for detection and exploitation.
#!/bin/bash
TARGET="https://target.com/product?id="
# Oracle-specific payloads
echo "[*] Testing for Oracle database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "ORA-[0-9]{5}"
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.