skills.rest
anshumanbh
anshumanbhCOMMUNITY
Explore all skills by this author →
GitHub

injection-testing

Validate input-based injection vulnerabilities using crafted payloads and observed responses.

281|61|Updated Oct 5, 2025
Search Tags:#automation#injection#web-security#payloads#security-testing#dast#vulnerability-testing
One-click install
npx skills add https://github.com/anshumanbh/securevibes --skill injection-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: injection-testing
Source: https://github.com/anshumanbh/securevibes/tree/main/packages/core/securevibes/skills/dast/injection-testing
Command: npx skills add https://github.com/anshumanbh/securevibes --skill injection-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes references (resource) components.

What problem does it solve?

This Skill helps security testers systematically validate a broad range of input-driven vulnerabilities (SQL, NoSQL, OS command, LDAP, XPath, SSTI, and XSS) by automating crafted payloads and response analysis, reducing manual trial-and-error time and complexity.

Core Features & Use Cases

  • Automated payload generation for time-based, error-based, and boolean-based injections across SQL, NoSQL, and LDAP.
  • XSS and SSTI detection through reflective and payload-based testing with safe red team practices.
  • Orchestrated testing workflows with baseline comparisons, response hashing, and redaction of sensitive data.
  • Use Case: A security tester wants to validate an API's input fields and confirm if vulnerabilities exist without manual crafting for every endpoint. Run the script to identify vulnerable points and generate evidence.

Quick Start

Run the reference validation script against your target URL using a parameter name and a payload type suitable for your environment. Example: python reference/validate_injection.py --url "http://target/api/search" --param "q" --value "test" --types "sqli_time,sqli_error,xss" --output results.json

Frequently Asked Questions about injection-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate injection vulnerability testing across SQL, NoSQL, and XSS?▼

Injection vulnerability testing automates detection of input-based flaws by sending crafted payloads to target endpoints and analyzing responses. This Skill uses time-based, error-based, and boolean-based techniques across SQL, NoSQL, OS command, LDAP, XPath, SSTI, and XSS injection types to identify vulnerable parameters without manual trial-and-error.

What does an injection testing workflow require to validate vulnerabilities?▼

Injection testing requires accessible target endpoints, a VULNERABILITIES.json file with suspected findings, and parameter names to test. The Skill generates and applies payloads, compares baseline responses, and documents evidence of successful injection techniques to confirm vulnerability presence.

Can I use injection testing to validate an API's input fields for multiple vulnerability types?▼

Yes. Injection testing validates APIs across multiple vulnerability types—SQL, NoSQL, LDAP, XPath, SSTI, XSS—in a single orchestrated workflow. You specify parameter names, payload types, and the target URL; the Skill applies crafted payloads and generates a results report with detected vulnerabilities.

What are the limitations of time-based and error-based injection detection?▼

Time-based techniques rely on measurable response delays, which can be inconsistent over network noise or slow servers. Error-based detection depends on verbose error messages being returned; if the application suppresses errors, detection fails. Boolean-based and reflection techniques offer alternatives when these conditions aren't met.

How does injection testing reduce manual security testing effort?▼

Injection testing automates payload crafting, delivery, and response analysis across multiple injection types and endpoints. Instead of manually testing each parameter with different payloads, the Skill orchestrates systematic testing workflows with baseline comparisons and sensitive-data redaction, eliminating repetitive trial-and-error.

What's the difference between reflected XSS and SSTI detection in injection testing?▼

Reflected XSS detection tests for payload echoes in HTTP responses to confirm script injection. SSTI detection tests for server-side template expression execution. Both use payload reflection and response analysis, but SSTI targets template engines while XSS targets browser rendering contexts.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

exploiting-broken-function-level-authorization

Detect and test Broken Function Level Authorization vulnerabilities in APIs.

Official
Advanced
hainamchunghainamchung
54

security-auditor

Assess architecture, threat models, and controls to prioritize security audit findings.

Community
Advanced
giosuetedeschi-specgiosuetedeschi-spec

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs to detect IDOR, injection, and authentication bypasses.

Community
Advanced
Security-Phoenix-demoSecurity-Phoenix-demo
63

opengrep-rule-generator

Generate and analyze opengrep/semgrep SAST rules for security vulnerabilities.

Official
Advanced