injection

Detect injection vulnerabilities across SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath surfaces.

Updated Apr 23, 2026
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill injection-yukiito1999
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: injection
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/injection
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill injection-yukiito1999

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Injection vulnerabilities spanning SQL, NoSQL, OS command, SSTI, XXE, and LDAP/XPath are identified and mitigated to prevent bypasses and data loss.

Core Features & Use Cases

  • Detects multi-vector injection surfaces across databases, templates, and command interfaces.
  • Provides actionable payloads and workflows for authentication bypass, data exfiltration, and remote code execution.
  • Applies to web apps, APIs, and template rendering engines to map risks and remediation.

Quick Start

Test a target with structured, multi-vector injections and capture evidence of bypasses, data leakage, and potential RCE

Frequently Asked Questions about injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for SQL injection and NoSQL injection vulnerabilities in web applications?

To test for SQL injection and NoSQL injection, apply multi-vector payloads to authentication flows and data endpoints to detect bypasses and data leakage. This approach provides actionable test vectors and detection methods for reproducible security testing across database surfaces.

Can I detect Server-Side Template Injection (SSTI) and XXE vulnerabilities using a single testing approach?

You can detect SSTI and XXE vulnerabilities using a single multi-vector approach that targets template rendering engines and XML processing surfaces. It applies structured payloads to map risks of executable code and data exfiltration across web apps and APIs.

What is the best way to identify OS command injection and LDAP injection surfaces?

The best way to identify OS command and LDAP injection surfaces is by applying structured test vectors across command interfaces and XPath queries. This maps potential remote code execution and authentication bypass risks through reproducible payload workflows.

How does multi-vector injection testing work for authentication bypass and data exfiltration?

Multi-vector injection testing works by systematically applying payloads across SQL, NoSQL, LDAP, and template endpoints to capture evidence of authentication bypass and data exfiltration. It provides structured workflows to detect security bypasses and executable code risks.

Do I need prior payload knowledge to test template processing and data endpoints for injection risks?

You do not need prior payload knowledge to test template processing and data endpoints, as the approach provides actionable payloads and detection methods. It maps remediation steps and risks across template rendering engines and command interfaces for reproducible testing.