vapt-inject

Injection Testing

When Invoked

The user runs /vapt inject <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Prerequisites

Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered endpoints and parameters
• If VAPT-SCAN.md exists -> extract parameter-accepting URLs
• If no context -> run minimal endpoint discovery (crawl homepage links, check robots.txt)

Phase 1: Parameter Discovery

1.1 Endpoint Crawling

# Extract links from homepage
curl -sL <url> | grep -oP 'href="[^"]*"' | sed 's/href="//;s/"//' | sort -u

# Extract form actions and input names
curl -sL <url> | grep -oP '<form[^>]*action="[^"]*"'
curl -sL <url> | grep -oP '<input[^>]*name="[^"]*"'

1.2 Parameter Identification

If arjun is installed:

arjun -u <url> -m GET,POST

Fallback: Extract parameters from:

• URL query strings
• Form fields (GET and POST)
• JSON request bodies (from API endpoints)
• HTTP headers (Host, Referer, X-Forwarded-For)
• Cookie values

Compile a target list: [{url, method, parameter, location}]

Phase 2: SQL Injection Testing

2.1 Detection

If sqlmap is installed:

# Test a single URL with parameters
sqlmap -u "<url>?param=value" --batch --level 3 --risk 2 --threads 4

# For POST data
sqlmap -u "<url>" --data "param=value" --batch --level 3 --risk 2

Pro mode uses higher levels:

sqlmap -u "<url>?param=value" --batch --level 5 --risk 3 --threads 10 --tamper=space2comment

Fallback (curl-based detection):

Test each parameter with these payloads and compare responses:

• Single quote ' (error-based detection)
• Boolean conditions: OR 1=1 vs OR 1=2
• Time delays: SLEEP(3) or WAITFOR DELAY
• UNION probes: UNION SELECT NULL

Compare response length and time to baseline. Significant differences indicate potential injection.

2.2 Confirmation

If a potential SQLi is detected:

1. Verify with a true/false comparison
2. Confirm the DBMS type if possible
3. Do NOT extract sensitive data -- just prove the vulnerability exists
4. Record the payload, injection point, and evidence