/injection

name: injection
description: Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.

Injection

Test for injection vulnerabilities across all input vectors. Covers SQL, NoSQL, Command, SSTI, XXE, and LDAP injection.

Techniques

| Type | Key Vectors | |------|-------------| | **SQL Injection** | In-band (union, error), Blind (boolean, time), Out-of-band | | **NoSQL Injection** | Operator injection, JavaScript injection, aggregation pipeline | | **Command Injection** | OS command separators, blind techniques, out-of-band | | **SSTI** | Template engine detection, sandbox escape, RCE chains | | **XXE** | Entity expansion, SSRF via XXE, blind XXE, parameter entities | | **LDAP/XPath** | Filter manipulation, authentication bypass |

Workflow

1. Identify injection points (parameters, headers, cookies, JSON fields) 2. Detect injection type with minimal probes 3. Exploit with context-appropriate payloads 4. Escalate (data extraction, RCE, file read) 5. Capture evidence and write PoC

Reference

• `reference/sql-injection*.md` - SQL injection techniques
• `reference/nosql-injection*.md` - NoSQL injection techniques
• `reference/os-command-injection*.md` - OS command injection
• `reference/ssti*.md` - Server-side template injection
• `reference/xxe*.md` - XML external entity injection
• `reference/ldap-injection-quickstart.md` - LDAP filter injection: detection, auth bypass, blind boolean extraction via `(description=PREFIX*)` chaining
• `reference/xpath-injection-quickstart.md` - XPath injection (CWE-643): lxml/Java/Node sinks, `' or '1'='1' or 'a'='b` boolean oracle, blind char-by-char extraction recipe