// Web AppSec
AI-Assisted SQLi Hunting: Boolean, Time-Based, and ORM Edge Cases
Modern apps mostly use ORMs, which makes SQLi feel rare — and exactly that complacency is where it still lives. Claude is excellent at pattern-matching ORM gotchas at scale.
Updated 2026-06-059 min readVendor-neutral · primary sources
Classes worth hunting in 2026
- Raw-string ORM calls: Sequelize literal(), Prisma $queryRawUnsafe, SQLAlchemy text().
- Order-by and column-name injection (parameterisation does not apply).
- Second-order SQLi via cached values and audit-log replay.
- JSON-path injection in Postgres jsonb operators.
- NoSQL injection in Mongo operator-style queries — same instinct, different syntax.
Prompt chain
# 1 — find candidates
Scan this repo for raw SQL composition. Specifically list every call to (Prisma $queryRawUnsafe|Sequelize literal|SQLAlchemy text|knex.raw|pg.query with template string). Output file, line, and whether user input reaches the string.
# 2 — exploitability
For each finding, propose: 1) a boolean-based payload, 2) a time-based payload (DB-specific), 3) an out-of-band payload. Note the DB engine you assumed.
# 3 — exfil plan
For the top finding, write a minimal sqlmap tamper script and a manual binary-search exploit for a single column.FAQ
Will Claude write working sqlmap commands?
Yes — including --tamper chains. Keep your scope and authorisation clear in the prompt.
// keep reading
Browse 300+ cybersecurity prompts, 40+ Claude-compatible tools, and daily AI-security intel.