Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-05.5
Testing for SQL Injection - MS Access
Passed 21 of 23 test cases with the skill, and 19 of 23 without it.
2 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
I'm conducting an SQL injection assessment on an MS Access database and want to list all table names. I am trying to query 'information_schema.tables'. Will this query work, or what is the correct target table and filter condition in Microsoft Access?
| Checked | Without skill | With skill |
|---|---|---|
| identifies MSysObjects as the system table for enumerating database structure in MS Access | Passed | Passed |
| notes filtering by Type=1 to select user tables | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-05.5
Testing for SQL Injection - MS Access
Microsoft Access SQL injection testing targets Access databases (Jet/ACE engine) often used in legacy or small-scale web applications. Access has limited features compared to enterprise databases but can still be exploited for data extraction and authentication bypass.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for MS Access database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "Microsoft Access|JET Database|ODBC Microsoft Access|\.mdb"
# Access-specific syntax test
test cases passed, vs 19 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.