Injection
Untrusted input alters a query or command - SQLi, NoSQLi, command injection, and XSS (a client-side injection).
OWASP rank: 3
Practical checks
- Fuzz every parameter with injection markers
- Confirm SQLi candidates with sqlmap
- Test XSS reflections in each context (HTML/attr/JS)
- Check command injection on features that shell out