domains / families / security / exploiting-api-injection-vulnerabilities

exploiting-api-injection-vulnerabilities

separate

Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, or assessing API input validation.

When to use

• Testing API endpoints that accept user input for database queries, system commands, or external requests
• Assessing APIs that interact with SQL databases, NoSQL stores (MongoDB, Redis), LDAP directories, or external URLs
• Evaluating input validation and parameterized query usage across all API endpoints
• Testing for SSRF where API parameters accept URLs or hostnames that trigger server-side requests
• Identifying injection points in headers, path parameters, query strings, and JSON/XML request bodies

When not to use

• Unauthorized testing
• Testing without written authorization

Skill page

Source