Injection is where untrusted data is bound into something the server executes, parses, stores, renders, or requests, a database query, an operating-system command, markup, a template runtime, an HTTP message, or an outbound URL. When the data crosses from the data plane into the code plane, the attacker controls part of what the interpreter does.
This tree is organized strictly by the primitive under attack, not by how the input arrives (query string, header, or body, that axis lives under input delivery). Each child names the primitive: database queries, OS commands, markup parsers, template engines, HTTP handling, outbound requests, and more.
Subtopics#
- API: Server code that parses and dispatches structured API requests decides what runs, for whom, and against which backend.
- Command: Application code builds an operating-system command from untrusted input, letting an attacker change which program runs or with what arguments, usually remot...
- Database: Untrusted input altering the query a server sends to its data store, SQL, NoSQL, ORM escape hatches, and directory services.
- Expression evaluation: When an application evaluates an attacker-influenced expression string at runtime, the expression language becomes a code path.
- File: Abuse of how a web application takes in, resolves, includes, or exports files, turning file handling into code execution, disclosure, or downstream interpret...
- HTTP: Exploiting the HTTP message itself: header-value abuse, CRLF response splitting, request smuggling when front and back ends disagree, and HTTP parameter poll...
- Log: Untrusted input written into log lines or fields, letting an attacker forge events, shift fields, and confuse the parsers, aggregators, and SIEM pipelines th...
- Mail: Application-layer email abuse where untrusted input reaches message headers, the body, or the SMTP hand-off and is interpreted as part of the message rather...
- Markup: Injection into server-side markup and XML processing languages: Server-Side Includes, XML parsing, XPath/XQuery/XSLT queries, and XXE entity abuse.
- Realtime: Long-lived channels where message bodies and metadata drive routing, authorization, and sinks, so individual frames carry injection past the HTTP request bou...
- Request forgery: When untrusted input steers an outbound request, an attacker reaches internal services, cloud metadata, and alternative URL schemes.
- Template Engine: Exploiting server-side template injection: detecting the engine, escalating from a template expression to the host language runtime, and the sandbox limits t...