Input Validation & Injection Testing

This guide treats application input parsers and downstream interpreters as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   List every input source, parser, normalization step, and downstream sink.

2. 02

   Capture valid requests and schema expectations.

3. 03

   Identify server-side queries, templates, commands, directory paths, and serializers.

4. 04

   Use a disposable lab dataset and harmless unique markers.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Test type, length, encoding, delimiter, and structural boundaries one at a time.

2. 02

   Observe whether the marker is interpreted, rejected, normalized, or safely parameterized.

3. 03

   Compare synchronous, asynchronous, import, and export paths.

4. 04

   Do not use destructive statements, operating-system commands, or data extraction.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Monitor parser errors, query errors, rejected characters, and unusual request shapes.
• Correlate application, database, and WAF telemetry without logging secrets.
• Turn confirmed cases into unit and integration tests.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Use parameterized APIs and context-aware output encoding.
• Validate against allowlisted schemas at trust boundaries.
• Separate data from commands and templates.
• Return generic errors while preserving internal diagnostics securely.