Injection Shapes in APIs

SQL/command/NoSQL injection still arrive via JSON fields — parameterize.

Injection Shapes in APIs• Audio Walkthrough

00:00/02:23

Visual · api_injection_shapes

Injection is still concatenation. Original Cyberlium.

JSON is not magic armor against injection.

APIs pass strings into SQL, shells, or queries. Parameterize and allowlist. Local demos only — no sqlmap against shops.

1. Same bug, new costume

Body fields concatenate into SQL → injection. ORM raw strings too.

Topic 10 SQLi lessons still apply.

Command guide

Try these commands — Same bug, new costume

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Injection prevention — https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html OWASP API8 — https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

curl -sS -X POST http://127.0.0.1:8818/search -H "Content-Type: application/json" -d '{"q":"lab"}' | jq .
curl -sS -X POST http://127.0.0.1:8818/search -H "Content-Type: application/json" -d '{"q":"" OR 1=1 --"}' -o /dev/null -w "injection shape HTTP %{http_code}
"
curl -sS -X POST "${API:-http://127.0.0.1:8818}/items" -H "Content-Type: application/json" -d '{"name":"lab-item","tags":["a","b"]}' | jq . 2>/dev/null || true

Primary tools to practice this lesson: curl, jq. Reference sites: Injection prevention (https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html); OWASP API8 (https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.