Check for SQL Injection Vulnerabilities

SQL injection remains one of the most dangerous and common web application vulnerabilities, consistently ranking in the OWASP Top 10. A successful SQL injection attack can dump entire databases, bypass authentication, modify or delete data, and in some cases execute operating system commands on the database server.

The test_injection skill sends carefully crafted payloads to application inputs and analyzes the responses for signs of SQL injection. It tests various injection techniques including error-based, blind, time-based, and union-based injection across form fields, URL parameters, headers, and JSON body parameters.

Any application that interacts with a database is a potential target. Even applications using ORMs can be vulnerable if raw queries are used anywhere in the codebase. Testing for SQL injection should be part of every security assessment, every code review of database-touching code, and every pre-deployment checklist. The cost of finding and fixing a SQL injection vulnerability is trivial compared to the cost of a database breach.