Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-05.3
Testing for SQL Injection - SQL Server
Passed 11 of 22 test cases with the skill, and 11 of 22 without it.
1 fixed18 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Security engineers often try using SLEEP(5) when testing database injection delays. What is the native MSSQL statement for inducing a 5-second delay in SQL Server execution?
| Checked | Without skill | With skill |
|---|---|---|
| The query uses WAITFOR DELAY with a string literal of '0:0:5'. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-05.3
Testing for SQL Injection - SQL Server (MSSQL)
Microsoft SQL Server-specific SQL injection testing leverages MSSQL's unique features including xp_cmdshell for OS command execution, OPENROWSET for data exfiltration, and specific error messages. MSSQL often runs with elevated privileges, making successful exploitation particularly dangerous.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for Microsoft SQL Server..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "SQL Server|ODBC|mssql|Incorrect syntax"
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.