skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

injection-checking

Routes injection testing workflows to specialized skills based on input sink type.

Updated Jun 5, 2026
Search Tags:#routing#xss#injection#penetration testing#web security#ctf#sqli
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill injection-checking-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: injection-checking
Source: https://github.com/lNwNl/Praxis/tree/main/skills/injection-checking
Command: npx skills add https://github.com/lNwNl/Praxis --skill injection-checking-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When attacker-controlled input reaches a dangerous interpreter, testers often struggle to decide which injection class applies first. This Skill acts as a category router that maps input flow to the correct deep-topic injection testing workflow. ## Core Features & Use Cases - Sink-Based Routing: Identifies whether input reaches HTML/JS, SQL, templates, URL fetchers, XML parsers, or shell, then directs to the matching skill (XSS, SQLi, SSRF, XXE, SSTI, CMDi, NoSQL, and more). - Extended Coverage: Links to 18 specialized injection topics including JNDI, CRLF, deserialization, request smuggling, prototype pollution, and type juggling. - Extra Injection Types Reference: Includes a companion document covering SSI, LDAP, XPath, LaTeX injection, encoding bypass, and PHP variable overwrite with detection probes and payloads. - Use Case: During a web CTF challenge, you find a login form reflecting input. Use this router to determine whether the sink is SQL, LDAP, or XPath, then jump directly to the right exploitation methodology. ## Quick Start Analyze how user input flows through the target application and route me to the appropriate injection testing workflow based on the final sink.

Frequently Asked Questions about injection-checking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose between XSS, SQLi, and SSTI when testing a web input field?▼

Identify the final sink of the input first. If it renders in a browser context choose XSS, if it enters a database query choose SQLi, and if it is evaluated by a template engine choose SSTI. This router maps each sink to its dedicated testing skill.

What injection types does this router cover?▼

It routes to eighteen topics including XSS, SQLi, SSRF, XXE, SSTI, command injection, NoSQL, deserialization, JNDI, CRLF, expression language, request smuggling, prototype pollution, type juggling, HTTP parameter pollution, XSLT, and CSV formula injection, plus a reference for SSI, LDAP, XPath, and LaTeX injection.

How do I test for LDAP injection in a login form?▼

The companion reference covers LDAP filter metacharacters like *, (), &, and |. Try authentication bypass with inputs like admin)(&) or wildcard extraction of passwords character by character using patterns like (&(uid=admin)(password=a*)).

Does this skill contain exploitation payloads itself?▼

The router itself only maps sinks to topic skills, but its companion document includes detection probes and payloads for SSI, LDAP, XPath, and LaTeX injection. Detailed payload sets live in each linked deep-topic skill.

When should I not start with this injection router?▼

Skip it when the issue is clearly not injection-class, such as file access vulnerabilities, which are handled by the related file-access-vuln category. Use it only when input reaches a dangerous interpreter or execution environment.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

prototype-pollution

Detect prototype pollution vulnerabilities in JavaScript applications via unsafe object merging.

Community
Advanced
0x0pointer0x0pointer
13

web-exploit

Chain advanced injection techniques to exploit web application vulnerabilities.

Official
Advanced
0X6C78790X6C7879

pattt-readme-loader

Resolve on-disk PayloadsAllTheThings README files into payload suggestions with source metadata.

Community
Advanced
Corvalis-LLCCorvalis-LLC
6

security-scan

Scan Node.js codebases for security vulnerabilities and output a JSON report.

Official
Advanced