Injection
When your input stops being data and becomes code the server runs: SQL injection (UNION, blind, past filters) to read the database, and cross-site scripting (reflected, stored, DOM) to run your script in a victim's browser. Each with a real lab.
- By
- PentestingHere
- Lessons
- 8
- Length
- 230 min
- Published
- 13 Sep 2026
What this path is
The access path was about who you are allowed to be. This one is about what you can make the server's own machinery do with your input. Injection is the family of bugs where something you send, a search term, a form field, a URL parameter, is not kept safely as data but is fed into a query, a command, or a page as if it were code. When that boundary fails, you can read the whole database, or run your script in another user's browser.
Injection is old, common, and still near the top of every risk list, because every application takes input and hands it to something, a database, a template, the page itself. You will learn to spot where input crosses from data into code, and to prove it with SQL injection and cross-site scripting, the two most important members of the family. Every technique lesson ends in a real Academy lab.
Who it is for
- Anyone who finished Access and wants the other pillar of web testing.
- Someone preparing for an entry-level web-application penetration testing exam. This path covers the manual-exploitation skills (SQL injection, reflected/stored/DOM XSS, extracting data, CMS bugs) those exams assess, built on the public OWASP Web Security Testing Guide. It is not affiliated with, or endorsed by, any exam vendor and uses none of their material.
The plan
- What injection is. The one shape every injection bug shares.
- SQL injection: finding it. Making the database hiccup on purpose.
- SQL injection: UNION and extraction. Reading data that was never yours to see.
- Blind SQL injection. Extracting data when the page shows you nothing.
- Reflected XSS. Your script, echoed back and run in a victim's browser.
- Stored XSS. Your script, saved on the server and served to everyone.
- DOM-based XSS. The bug that lives entirely in the page's JavaScript.
- Attacking a CMS. Turning a fingerprinted platform into known, targeted findings.
Before you start
Finish Foundations (especially "what the browser trusts") and ideally the Access path. You need a browser, curl, and an intercepting proxy. A few lessons name sqlmap and payload lists; you will understand every step by hand first. Everything here is practised on this Academy's labs, where you are always in scope, injection payloads against a target you are not authorised to test can corrupt real data, so the scope line matters as much here as anywhere.