What problem does it solve?
APIs frequently pass user input into database queries, shell commands, and server-side HTTP requests without proper validation, creating injection flaws that automated scanners often miss. This Skill provides a structured, authorized testing workflow to identify and confirm SQL injection, NoSQL injection, OS command injection, and SSRF across API parameters, headers, and request bodies.
Core Features & Use Cases
- Multi-vector injection testing: Covers SQLi (error-based, union-based, time-based), MongoDB NoSQL operator injection, OS command injection, and SSRF with cloud metadata and filter-bypass payloads.
- Confirmation guidance: Emphasizes out-of-band verification, time-based baselining, and commonly missed sinks like JSON body fields, HTTP headers, and second-order injection points.
- Use Case: During an authorized assessment of an e-commerce API, you test the product search endpoint for SQLi, bypass login via NoSQL operator injection, and extract AWS instance metadata through an SSRF flaw in the webhook URL parameter, then document findings with CVSS severity and remediation steps.
Quick Start
Test the login and search endpoints of my authorized target API for SQL injection, NoSQL injection, and SSRF, and report any confirmed findings with remediation advice.
