Injection Testing (FIND/EXPLOIT — input reaches an interpreter)

Overview

Injection happens when input crosses into a language an interpreter executes — SQL, a shell, a template engine, an XML/LDAP/XPath parser. This skill proves it dynamically; the code-level patterns live in security-code-audit/references/database.md and api-backend.md.

Core principle: Find where input changes the structure of a command, not just its data. A working injection is a tiny structural payload that changes the interpreter's behavior.

Applies when / Skip when

• Applies when: untrusted input can reach an interpreter — SQL/NoSQL DB, OS shell, template engine, or XML/LDAP/XPath parser.
• Skip when: a given sink type is absent → that injection class is N/A.
• If N/A: name the absent interpreters (e.g. "no SQL → SQLi N/A") and test only the sinks that exist. Partial applicability is normal here.