injection

Files (46)

• SKILL.md
• INDEX.md · reference/
• injection-principles.md · reference/
• ldap-injection-quickstart.md · reference/
• nosql-injection-advanced.md · reference/
• nosql-injection-cheat-sheet.md · reference/
• nosql-injection-quickstart.md · reference/
• nosql-injection-resources.md · reference/
• os-command-injection-cheat-sheet.md · reference/
• os-command-injection-quickstart.md · reference/
• bash-symbolic-only-bypass.md · reference/scenarios/code-injection/
• php-preg-replace-e-modifier.md · reference/scenarios/code-injection/
• python-eval-format-string.md · reference/scenarios/code-injection/
• cassandra-cql.md · reference/scenarios/nosql/
• elasticsearch-script-injection.md · reference/scenarios/nosql/
• mongo-aggregation-pipeline.md · reference/scenarios/nosql/
• mongo-operator-injection.md · reference/scenarios/nosql/
• mongo-syntax-injection.md · reference/scenarios/nosql/
• mongo-type-confusion.md · reference/scenarios/nosql/
• mongo-where-jsinjection.md · reference/scenarios/nosql/
• redis-ssrf-gopher.md · reference/scenarios/nosql/
• auth-bypass.md · reference/scenarios/sql/
• boolean-blind.md · reference/scenarios/sql/
• error-based.md · reference/scenarios/sql/
• header-injection.md · reference/scenarios/sql/
• out-of-band.md · reference/scenarios/sql/
• per-dbms-mssql.md · reference/scenarios/sql/
• per-dbms-mysql.md · reference/scenarios/sql/
• per-dbms-oracle.md · reference/scenarios/sql/
• per-dbms-postgres.md · reference/scenarios/sql/
• second-order.md · reference/scenarios/sql/
• stacked-queries.md · reference/scenarios/sql/
• time-based-blind.md · reference/scenarios/sql/
• union-based.md · reference/scenarios/sql/
• waf-bypass.md · reference/scenarios/sql/
• where-clause-filter-bypass.md · reference/scenarios/sql/
• double-render-quote-free-bypass.md · reference/scenarios/ssti/
• sql-injection-advanced.md · reference/
• sql-injection-quickstart.md · reference/
• ssti-advanced.md · reference/
• ssti-cheat-sheet.md · reference/
• ssti-quickstart.md · reference/
• ssti-resources.md · reference/
• xpath-injection-quickstart.md · reference/
• xxe-cheat-sheet.md · reference/
• xxe-quickstart.md · reference/

SKILL.md (first lines)

# Injection

Test for injection vulnerabilities across all input vectors. Covers SQL, NoSQL, Command, SSTI, XXE, and LDAP injection.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **SQL Injection** | In-band (union, error), Blind (boolean, time), Out-of-band |
| **NoSQL Injection** | Operator injection, JavaScript injection, aggregation pipeline |
| **Command Injection** | OS command separators, blind techniques, out-of-band |
| **SSTI** | Template engine detection, sandbox escape, RCE chains |
| **XXE** | Entity expansion, SSRF via XXE, blind XXE, parameter entities |
| **LDAP/XPath** | Filter manipulation, authentication bypass |

## Workflow

1. Identify injection points (parameters, headers, cookies, JSON fields)
2. Detect injection type with minimal probes
3. Exploit with context-appropriate payloads
4. Escalate (data extraction, RCE, file read)
5. Capture evidence and write PoC

## Reference

- `reference/sql-injection*.md` - SQL injection techniques
- `reference/nosql-injection*.md` - NoSQL injection techniques
- `reference/os-command-injection*.md` - OS command injection
- `reference/ssti*.md` - Server-side template injection
- `reference/xxe*.md` - XML external entity injection
- `reference/ldap-injection-quickstart.md` - LDAP filter injection: detection, auth bypass, blind boolean extraction via `(description=PREFIX*)` chaining
- `reference/xpath-injection-quickstart.md` - XPath injection (CWE-643): lxml/Java/Node sinks, `' or '1'='1' or 'a'='b` boolean oracle, blind char-by-char extraction recipe

From transilienceai/communitytools, MIT.

More from transilienceai/communitytools