[SQLi]

Perhaps one way would be to keylog the person.

You might want to try ratting him which will be better than a keylogger and I think Cyber has a ratting help service.

Infecting the administrator with a RAT will by no means be any better than a normal keylogger when all he wants is their password. A RAT might even have a higher detection rate which increases the risk of Skill getting caught. Correct me if I'm wrong.