detecting-injection
Detects various injection vulnerabilities including SQL injection, LDAP injection, XPath injection, and code injection. Use when analyzing database queries, dynamic code generation, or investigating injection attacks.
When & Why to Use This Skill
This Claude skill automates the detection of critical injection vulnerabilities, including SQL, LDAP, XPath, and code injection. It streamlines security audits by tracing user input, verifying sanitization mechanisms, and assessing exploitability in database queries and dynamic code generation to prevent unauthorized data access and system compromise.
Use Cases
- Automated Security Auditing: Scan source code to identify SQL injection patterns and unsafe database query constructions in legacy or new applications.
- Secure Code Review: Analyze dynamic code generation and template rendering to prevent server-side template injection (SSTI) and unsafe eval() executions.
- Vulnerability Assessment: Trace user-controlled input through application logic to find unsanitized data sinks and identify potential bypass opportunities in validation layers.
- Compliance and Best Practices: Verify the implementation of parameterized queries and input validation logic to ensure alignment with OWASP security standards.
| name | detecting-injection |
|---|---|
| description | Detects various injection vulnerabilities including SQL injection, LDAP injection, XPath injection, and code injection. Use when analyzing database queries, dynamic code generation, or investigating injection attacks. |
Injection Detection
Detection Workflow
- Identify injection points: Find database query construction, locate dynamic code generation, identify template rendering, map all user input usage
- Trace user input: Use
xrefs_toto trace data, follow input to injection points, check for sanitization, identify bypass opportunities - Check sanitization: Verify input validation, check for parameterized queries, assess escaping mechanisms, look for whitelist/blacklist usage
- Assess exploitability: Can attacker inject malicious content? What's the impact of injection? Are there mitigations?
Key Patterns
- SQL injection: string concatenation in SQL queries, dynamic query construction, missing parameterized queries, stored procedure injection
- LDAP injection: user input in LDAP filters, unsafe LDAP query construction, special character handling issues, DN manipulation
- XPath injection: user input in XPath expressions, unsafe XPath construction, XML entity injection, blind XPath injection
- Code injection: eval() or similar dynamic code execution, template injection, server-side template injection (SSTI), deserialization attacks
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, injection_point (function, address, query), source, injection_technique, exploitable, attack_scenario, payload_example, mitigation.
Severity Guidelines
- CRITICAL: SQL injection with full database access
- HIGH: Other injection with data access
- MEDIUM: Limited injection impact
- LOW: Potential injection with minor impact
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies