Injection Detection
Detection Workflow
- Identify injection points: Find database query construction, locate dynamic code generation, identify template rendering, map all user input usage
- Trace user input: Use
xrefs_to to trace data, follow input to injection points, check for sanitization, identify bypass opportunities
- Check sanitization: Verify input validation, check for parameterized queries, assess escaping mechanisms, look for whitelist/blacklist usage
- Assess exploitability: Can attacker inject malicious content? What's the impact of injection? Are there mitigations?
Key Patterns
- SQL injection: string concatenation in SQL queries, dynamic query construction, missing parameterized queries, stored procedure injection
- LDAP injection: user input in LDAP filters, unsafe LDAP query construction, special character handling issues, DN manipulation
- XPath injection: user input in XPath expressions, unsafe XPath construction, XML entity injection, blind XPath injection
- Code injection: eval() or similar dynamic code execution, template injection, server-side template injection (SSTI), deserialization attacks
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, injection_point (function, address, query), source, injection_technique, exploitable, attack_scenario, payload_example, mitigation.
Severity Guidelines
- CRITICAL: SQL injection with full database access
- HIGH: Other injection with data access
- MEDIUM: Limited injection impact
- LOW: Potential injection with minor impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-injection3description: Detects various injection vulnerabilities including SQL injection, LDAP injection, XPath injection, and code injection. Use when analyzing database queries, dynamic code generation, or investigating injection attacks.4---5
6# Injection Detection
7
8## Detection Workflow
9
101. **Identify injection points**: Find database query construction, locate dynamic code generation, identify template rendering, map all user input usage
112. **Trace user input**: Use `xrefs_to` to trace data, follow input to injection points, check for sanitization, identify bypass opportunities
123. **Check sanitization**: Verify input validation, check for parameterized queries, assess escaping mechanisms, look for whitelist/blacklist usage
134. **Assess exploitability**: Can attacker inject malicious content? What's the impact of injection? Are there mitigations?
14
15## Key Patterns
16
17- SQL injection: string concatenation in SQL queries, dynamic query construction, missing parameterized queries, stored procedure injection
18- LDAP injection: user input in LDAP filters, unsafe LDAP query construction, special character handling issues, DN manipulation
19- XPath injection: user input in XPath expressions, unsafe XPath construction, XML entity injection, blind XPath injection
20- Code injection: eval() or similar dynamic code execution, template injection, server-side template injection (SSTI), deserialization attacks
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, injection_point (function, address, query), source, injection_technique, exploitable, attack_scenario, payload_example, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: SQL injection with full database access
29- **HIGH**: Other injection with data access
30- **MEDIUM**: Limited injection impact
31- **LOW**: Potential injection with minor impact
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88