Skip to content

Injection Testing (/test-injection)

Comprehensive injection testing covering all injection classes from OWASP A03:2025 and PortSwigger Academy. The legacy /test-injection entrypoint is now a thin router. Real dispatch should prefer the dedicated sub-skills:

  • /test-injection-sqli
  • /test-injection-xss
  • /test-injection-ssti-xxe
  • /test-injection-cmdi
  • /test-injection-misc
/test-injection <target_url> [specific_type] [engagement_dir]

Scope Routing

When dispatched with --scope, the router hands control to the matching dedicated sub-skill. Without --scope, the router preserves backward compatibility and runs the same scopes sequentially.

Scope Sections Tools Focus
sqli /test-injection-sqli sqlmap SQL/NoSQL/SOQL injection with WAF-adaptive tamper chains
xss /test-injection-xss dalfox Reflected, stored, and DOM-based XSS including Markdown processors
ssti-xxe /test-injection-ssti-xxe -- Template injection, XML attacks, edge-side includes
cmdi /test-injection-cmdi commix OS command injection across all entry points
misc /test-injection-misc -- Minor injection classes, deserialization detection

WAF Detection

STEP 0 (WAF fingerprinting) runs for all scopes except misc. Detected WAF type drives payload selection, tamper chains, and TLS evasion strategy.

Coverage

This skill tests the following vulnerability classes:

  • SQL Injection -- Error-based, UNION-based, blind boolean, blind time-based, second-order SQLi. Includes ORDER BY / sort parameter injection and authentication endpoint testing.
  • Cross-Site Scripting -- Reflected XSS (context-aware breakout), stored XSS (POST + GET verification via curl), and DOM-based XSS triggers. Mermaid diagram injection and Kramdown processor configuration injection.
  • Server-Side Template Injection -- Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Thymeleaf, ERB, Slim, Jade/Pug, Handlebars, EJS, Mako detection and exploitation.
  • OS Command Injection -- Inline execution, pipe injection, backtick substitution, $() subshell, newline injection. Dedicated testing on file/export parameters and image processing endpoints.
  • XML External Entity -- Classic XXE, blind OOB XXE, XXE via file upload (DOCX/XLSX/SVG), XXE on webhook and XML-accepting endpoints.
  • NoSQL Injection -- MongoDB operator injection ($gt, $regex, $where), JSON body injection.
  • LDAP Injection -- Filter injection, wildcard abuse.
  • Expression Language Injection -- Java EL, Spring SpEL, OGNL.
  • Log/CRLF Injection -- Header injection via CRLF sequences.
  • XSLT Injection -- Server-side XSLT processing exploitation.
  • XPath Injection -- Authentication bypass, data extraction.
  • ESI Injection -- Edge Side Include tag injection on CDN/cache layers.
  • PHP Advanced -- Type juggling, filter chain, wrapper exploitation.
  • Formula/CSV Injection -- DDE payloads in exported CSV/Excel files.
  • Email Header Injection -- CRLF in email fields for header injection.
  • SSI Injection -- Server-Side Includes directive injection.
  • ExifTool RCE -- CVE-2021-22204 via crafted image metadata.
  • Image Transform Argument Injection -- Rails ActiveStorage / ImageProcessing argument injection.
  • Git Argument/Flag Injection -- Exploiting unsanitized git command arguments.
  • Regex Injection via HTTP Headers -- ReDoS and regex bypass patterns.
  • JSON Schema Code Injection -- Exploiting JSON schema validation engines.
  • SOQL Injection -- Salesforce Object Query Language injection.
  • Polyglot Payloads -- Multi-vulnerability simultaneous testing.

Key Sections

Section Letter Description
WAF Fingerprinting STEP 0 Detects Cloudflare, AWS WAF, Akamai, ModSecurity, Sucuri, Imperva, F5, Barracuda. Selects wordlists, sqlmap tamper chains, and TLS evasion strategy per WAF.
Auth Endpoint Injection STEP 0a Tests login/register/password-reset forms for SQLi, XSS, and CRLF. Extracts form field names from HTML before sending payloads.
Parameter Collection STEP 0b Collects all injectable parameters from discovery sources (api-endpoints.txt, injectable-params.json, resource-map.json).
Adaptive Payload Gen STEP 0c When static payload lists fail, generates context-specific payloads based on response analysis.
SQL Injection A Error-based, UNION, blind boolean, blind time-based. Includes sqlmap with WAF-adaptive tamper chains.
ORDER BY Injection STEP 1c Dedicated testing for sort/order parameters -- frequently missed and high-value.
Hidden Parameter Injection STEP 1d Tests ?debug=1, ?admin=1, ?test=1, and other hidden flags on every endpoint.
XSS B Context-aware payload selection (HTML body, attribute, JS string, URL). Stored XSS verification via curl (POST payload, GET check).
Stored XSS Verification STEP 2e Mandatory POST + GET verification workflow for all stored XSS candidates.
SSTI C Template engine fingerprinting via arithmetic expressions ({{7*7}}). Engine-specific escalation payloads.
CMDi D All 8 timing variants tested before concluding "not vulnerable." Dedicated file/export parameter testing (STEP 4b).
XXE E Classic, blind OOB, file upload vectors (DOCX/XLSX/SVG). Webhook and XML endpoint testing (STEP 6b).
NoSQLi F MongoDB operator injection, JSON body manipulation.
LDAP Injection G Filter injection, wildcard abuse.
Expression Language H Java EL, Spring SpEL, OGNL detection chains.
Log/CRLF I Header injection, XSLT (I2), XPath (I3), deserialization detection (I4).
ESI Injection J Edge Side Include on CDN/cache infrastructure.
PHP Advanced K Type juggling, filter chains, wrapper exploitation.
Formula/CSV L DDE payloads in exported data.
Email Header M CRLF in email fields.
SSI Injection N Server-Side Includes directives.
Mermaid Injection O XSS via Mermaid diagram rendering.
ExifTool RCE P CVE-2021-22204 via image metadata.
Image Transform Q Rails ActiveStorage argument injection.
Git Injection R Unsanitized git command arguments.
Regex Injection S ReDoS via HTTP headers.
Kramdown/Markdown XSS T Markdown processor configuration injection.
JSON Schema Injection U JSON schema validation engine exploitation.
SOQL Injection V Salesforce Object Query Language.
Polyglot Payloads Z Multi-vulnerability simultaneous testing.

Model and Thinking Budget

Scope Model Rationale
sqli Opus (high) Creative reasoning needed for blind SQLi confirmation, WAF bypass strategy, response analysis
xss Opus (high) Context-aware breakout requires understanding HTML/JS parsing, DOM analysis
ssti-xxe Sonnet Procedural template fingerprinting and XXE payload delivery
cmdi Sonnet Systematic timing-based testing across 8 variants
misc Haiku Lightweight checks for minor injection classes

Kill Switch

Extended Timeout

/test-injection has a 60-minute timeout (vs. 45 minutes for other skills) due to the breadth of injection classes tested.

Limit Value
Timeout 60 minutes
Max requests 500 (warning at 400)
Rate on 429 3 consecutive 429s trigger stop
Stealth stealth_curl() with jitter scaled by JITTER_MULT

AI Decision Points

Three [AI-DECISION] markers in this skill:

  1. Blind SQLi Confirmation -- Analyze whether time delay indicates genuine blind SQLi or network latency. Compare to baseline. Only report if consistent across 3 repetitions.
  2. XSS Context Detection -- Determine XSS context (HTML body, attribute, JS string, URL) from response. Select breakout payload accordingly.
  3. SSTI Evaluation -- Evaluate if template expression result (e.g., 49) is actual template evaluation or coincidental static content. Verify with different arithmetic expressions.

Knowledge Packs and Cheatsheets

Resource Path
SSTI knowledge pack helpers/knowledge-ssti.md
XXE knowledge pack helpers/knowledge-xxe.md
CMDi knowledge pack helpers/knowledge-cmdi.md
SQLi cheatsheet helpers/cheatsheet-sqli.md
XSS cheatsheet helpers/cheatsheet-xss.md
SSTI cheatsheet helpers/cheatsheet-ssti.md
XXE cheatsheet helpers/cheatsheet-xxe.md
CMDi cheatsheet helpers/cheatsheet-cmdi.md
Research terms helpers/research-terms.md
Exemplars helpers/exemplars.md

External payload files from PayloadsAllTheThings and SecLists are used for fuzzing wordlists, including XSS vectors (Jhaddix, BruteLogic), SQLi tamper lists, and CRLF intruder payloads.

WAF-Adaptive Strategy

Detected WAF XSS Strategy SQLi Strategy TLS Evasion
None Full wordlists, standard payloads Standard payloads, sqlmap default Standard curl
Cloudflare Unicode bypass, event handlers Double-encoding, comment injection Python requests (different JA3)
ModSecurity Obfuscated event handlers, template literals Comment injection (/*!50000 SELECT*/) Rotate TLS 1.2/1.3
Akamai Double-encoding chains, base64 Triple URL encoding, case alternation Chromium/pyppeteer
AWS WAF Short payloads, parenthesis-free handlers BENCHMARK time-based, hex encoding Rotate TLS versions
Imperva DOM-based, eval(atob(...)) CHAR() encoding, CONCAT() obfuscation Python requests
F5 BIG-IP Encoded payloads, String.fromCharCode Hex-encoded strings, EXEC for MSSQL Rotate TLS versions

Safety

  • SQLi: SELECT/SLEEP()/BENCHMARK() only. Never INSERT/UPDATE/DELETE/DROP.
  • XSS: alert(document.domain) or console.log() only. Stored payloads cleaned after evidence collection.
  • CMDi: whoami/id/hostname/sleep only.
  • All findings require a working, reproducible PoC before reporting.