injection-testing

What problem does it solve?

This Skill helps security testers systematically validate a broad range of input-driven vulnerabilities (SQL, NoSQL, OS command, LDAP, XPath, SSTI, and XSS) by automating crafted payloads and response analysis, reducing manual trial-and-error time and complexity.

Core Features & Use Cases

• Automated payload generation for time-based, error-based, and boolean-based injections across SQL, NoSQL, and LDAP.
• XSS and SSTI detection through reflective and payload-based testing with safe red team practices.
• Orchestrated testing workflows with baseline comparisons, response hashing, and redaction of sensitive data.
• Use Case: A security tester wants to validate an API's input fields and confirm if vulnerabilities exist without manual crafting for every endpoint. Run the script to identify vulnerable points and generate evidence.

Quick Start

Run the reference validation script against your target URL using a parameter name and a payload type suitable for your environment. Example: python reference/validate_injection.py --url "http://target/api/search" --param "q" --value "test" --types "sqli_time,sqli_error,xss" --output results.json