injection-checking

Classifying an injection vulnerability involves determining where attacker-controlled input reaches a dangerous interpreter, using sink-focused routing logic to distinguish between browser, database, template engine, or system command execution environments.

The best way to route web security injection flaws is using a decision tree based on the ingestion point and the sink to select the most accurate deep-topic skill, preventing wasted effort by avoiding guessing between injection families.

Sink-focused routing logic for payload classification works by mapping how attacker-controlled input reaches a dangerous interpreter, routing the vulnerability to the correct workflow based on whether the sink is browser, database, server-side requests, or XML parsing.

Yes, this injection triage process covers attack surface analysis for less common categories including SSI, LDAP, XPath, and LaTeX-related injection, alongside mainstream types like XSS, SQLi, SSRF, XXE, SSTI, and command injection.

Yes, you can use the decision tree to distinguish between NoSQL injection and SQLi by analyzing how attacker-controlled input reaches the dangerous interpreter, routing database-driven flaws to the correct deep-topic skill based on the specific sink.