Identify Application’s Entry Point

Identify methods used and where they are used; Identify the Injection point

Here I’ve shared practical, hands-on reference lists of every common method for discovering application entry points, how to identify where injection is possible, recommended tools/commands, short payload examples, detection tips, and what evidence to capture. Use it as a checklist in your pentest or to convert to a PDF/checklist (I can make that next).

Identifying Application Entry Points & Injection Points — Tools, Methods, and Examples

1) What we mean by “entry points” and “injection points”

• Entry point: any place the application accepts input from an external actor (web forms, query strings, POST bodies, headers, cookies, JSON, XML, GraphQL, file uploads, WebSocket messages, URL path segments, API endpoints, mobile endpoints, etc.).
• Injection point: an entry point where untrusted input is interpreted by a backend/engine (SQL, OS shell, LDAP, XML parser, template engine, JSON/NoSQL, OS commands, format strings), allowing attacker-supplied payloads to change execution or data.

2) High-level discovery approach (order of operations)

1. Passive mapping: crawl, read JS, inspect docs, enumerate API endpoints.
2. Active mapping: directory fuzzing, parameter discovery, API fuzz, spidering with auth.
3. Context analysis: for every parameter/field determine context (SQL, HTML, JS, JSON, YAML, shell, file path, LDAP, template, XML, XPath).
4. Targeted injection tests: send context-appropriate payloads (short tests first).
5. Confirm & escalate: verify impact, extract sensitive data carefully, capture PoC evidence.

3) Tools & techniques grouped by task

A. Crawling & enumerating entry points

Purpose: list all pages, forms, parameters, API endpoints, WebSockets, and JS-resident endpoints.

Tools & commands:

• Burp Suite (Proxy + Spider + Repeater + Scanner) — proxy while using app, run Burp Spider/Passive scan; use “Site map” to list endpoints. (Burp Pro automates crawling)
• OWASP ZAP — spider + active scanner.
• httpx — probe URLs and enumerate alive endpoints. httpx -l hosts.txt -status-code -title -content-length -silent -o httpx_out.txt
• ffuf / feroxbuster / dirsearch / gobuster — find hidden paths and parameterized endpoints. ffuf -u https://example.com/FUZZ -w /path/common.txt -mc 200,301 -o ffuf_out.txt
• whatweb / wappalyzer — find client-side tech (helps locate frameworks & default pages).
• Subdomain tools (amass, subfinder) — reveal additional entry points on subdomains.
• Burp Extender plugins: ActiveScan++ / ParamMiner / JSON Beautifier — ParamMiner discovers hidden params.
• Crawler scripts: waybackurls, gau (get all urls) from GitHub / Wayback to find archived endpoints. waybackurls example.com | grep api | sort -u > apis.txt
• Browser devtools & Network tab — inspect XHR/fetch calls and WebSocket traffic (listen to websocket frames).
• Mobile analysis: MobSF, jadx, apktool — extract hard-coded URLs/endpoints from apps.

How to use:

• Crawl the app while authenticated (use Burp to maintain session). Save everything to a site map.
• Inspect JS bundles for fetch, axios, GraphQL, WebSocket, EventSource, and API base URLs. Grep JS files: grep -R "fetch(" *.js or grep -R "graphql" *.js.

Evidence to capture:

• Burp site map exports, list of endpoints (CSV), screenshots of API calls, JS snippet screenshots.

B. Parameter enumeration (find parameters you can inject)

Purpose: enumerate GET/POST/JSON/headers/cookies/form fields.

Tools & commands:

• Burp Suite (Intruder, Repeater, Param Miner): ParamMiner discovers hidden parameters by comparing requests/responses.
• ffuf / wfuzz (parameter FUZZing): wfuzz -c -z file,params.txt -d "username=FUZZ&password=pass" --hc 404 [https://example.com/login](https://example.com/login)
• Arjun — attempts to discover GET/POST parameters on endpoints. python3 arjun.py -u "https://example.com/api" -oT arjun_results.txt
• Dirsearch w/ parameter fuzz — find endpoints and param names from patterns.
• Burp Collaborator — to detect blind injection via OOB.

How to use:

• For each endpoint, enumerate possible parameter names and types (strings, integers, arrays, JSON objects).
• Use automated parameter discovery after crawling (Arjun) and compare responses for differences that imply acceptance.

Evidence:

• Param lists, sample requests showing discovered parameters.

C. API, JSON, and GraphQL entry points

Purpose: find endpoints accepting structured payloads.

Tools & commands:

• Burp: intercept POST/PUT requests, view JSON structure.
• GraphQLmap / InQL / Altair / GraphiQL — introspect GraphQL schemas. graphqlmap -u [https://example.com/graphql](https://example.com/graphql)
• Postman — interact and iterate on APIs.
• jq — inspect JSON responses: curl -s ... | jq .
• fuzzer: ffuf with JSON content: ffuf -u https://example.com/api -X POST -H "Content-Type: application/json" -d '{"username":"FUZZ","password":"test"}' -w payloads.txt

How to use:

• Attempt GraphQL introspection query ({ __schema { types { name } } }).
• For REST APIs, enumerate all HTTP methods (OPTIONS, PUT, PATCH, DELETE) and attempt method-specific payloads.

Detection of injection context:

• If values are incorporated into SQL-like statements server-side, time-based responses may indicate SQLi. For JSON/NoSQL (Mongo) injection, special operators like {"$ne": null} can be tested.

Evidence:

• Sample JSON requests/responses; GraphQL schema dumps.

D. File uploads / multipart entry points

Purpose: injection via uploaded files (RCE via web shells, stored XSS).

Tools & commands:

• Burp: intercept multipart upload; modify filename, content-type.
• ffuf to find upload endpoints, curl to test uploads. curl -F "file=@shell.php;type=image/jpeg" [https://example.com/upload](https://example.com/upload)
• ExifTool to analyze uploaded images returned.
• ImageMagick/convert for image payload polyglots.

How to test:

• Test extension bypass (e.g., shell.php.jpg), content sniffing, filename-based injection, double extension, and MIME mismatches.
• Try uploading benign test shell (on scope) or harmless payloads that render back (like SVG with JS) to detect stored XSS.

Evidence:

• Upload request/response, served file URL, screenshot of executed payload.

E. Headers, cookies, and non-URL inputs

Purpose: many apps parse headers / cookies into logs or commands; these can be injection points.

Targets:

• User-Agent, Referer, X-Forwarded-For, Authorization, JWT in cookie or Authorization header.

Tools:

• Burp (modify headers, automate with Intruder).
• curl for single-shot header tests: curl -s -H "User-Agent: test' OR '1'='1" [https://example.com/endpoint](https://example.com/endpoint)
• Fermata or custom scripts to fuzz headers.

How to test:

• Inject payloads into headers & cookies; look for reflected content, logged content (via error pages), or OOB triggers (use Burp Collaborator).

Evidence:

• Requests showing changed header and relevant response behavior or OOB interaction.

F. WebSockets, SSE, and real-time channels

Purpose: many real-time endpoints accept JSON messages that become injection points.

Tools:

• Burp — WebSocket history and manipulation.
• websocat / wscat — connect and send payloads. wscat -c wss://example.com/socket
• Browser devtools — monitor frames.

How to test:

• Modify individual JSON fields within frames with test payloads (XSS, template syntax, NoSQL operators) and observe server response to see whether input is processed.

Evidence:

• WebSocket frame logs, server responses.

G. Client-side & DOM-sourced entry points

Purpose: DOM inputs can be sinks for XSS or data flow to server.

Tools:

• Browser devtools: inspect DOM functions using innerHTML, document.write, eval.
• Burp + dalfox / xsstrike — for XSS detection.
• DOM Invader (Burp extension).

How to test:

• Find sinks by grepping scripts for innerHTML, eval, setTimeout with strings; inject payloads into the source of those sinks (URL hash, fragment, localStorage, postMessage).

Evidence:

• DOM mutation logs and resulting payload execution screenshots.

4) Injection-specific checks by context (payloads & quick tests)

Important: run non-destructive checks first (reflective tests, short payloads). Use time-based or OOB tests only if safe & authorized.

A. SQL Injection

Quick detection payloads:

• ' OR '1'='1
• ' OR 1=1 --
• Time-based: ' OR SLEEP(5) --

Tools: sqlmap (sqlmap -u "https://example.com/search?q=test" --batch --level=3) and manual tests via Burp Repeater.

Detection: DB errors, boolean differences, time delays.

Evidence: db banner, dumped table names (or proof-of-concept extracts).

B. NoSQL injection (MongoDB)

Payloads:

• {"username": {"$ne": null}}
• {"$where":"sleep(5000)"}

Tools: manual via Burp or scripts, NoSQLMap.

Detection: behavioral changes, OOB callbacks.

C. Command Injection

Payloads:

• ; id, && whoami, | ls, backticks id
• Time-based: ; sleep 5

Tools: commix, Burp Repeater, careful manual testing.

Detection: command output included, time delays.

D. XSS (Reflected / Stored / DOM)

Payloads:

• Simple: <script>alert(1)</script>
• Attribute contexts: "><svg onload=alert(1)>
• DOM sinks: location.hash injection

Tools: dalfox, xsstrike, Burp Active Scanner.

Detection: alert popups, DOM execution, event handlers triggered.

E. SSTI (Template injection)

Payloads differ by engine:

• Jinja2: {{7*7}} → 49
• Twig: {{7*7}}
• Mustache: {{...}} (often safe)

Tools: tplmap, Burp for manual payloads.

Detection: template evaluation output (e.g., 49) or error messages.

F. XXE / XML Injection

Tools: Burp with file-based payloads, xxe-payload-list. Leverage OOB (Burp Collaborator) to fetch external DTD.

Payload: external entity referencing attacker domain to cause OOB DNS/HTTP.

Detection: OOB interaction, file disclosure.

G. LDAP / XPath / Format string / Others

• Test with context-appropriate payloads: *)(uid=*))(|(uid=* for LDAP, ' or name() = 'foo' for XPath.
• Use Burp to craft payloads and detect differences.

5) Blind/Out-of-Band (OOB) detection

Use when responses don’t reveal immediate feedback.

• Burp Collaborator — trigger external interactions with DNS/HTTP to detect SSRF/XXE/Blind SQL/OS command injection.
• Interactsh (open-source alternative) — run OOB detectors for blind vulnerabilities.

Example:

• Insert payload referencing uniqueid.burpcollaborator.net into parameter; check Collaborator for DNS or HTTP callbacks.

6) Automation pipelines & combos

Pipeline example:

1. Crawl (Burp Spider / ZAP).
2. Export endpoint list.
3. Parameter discovery (Arjun / ParamMiner).
4. Fuzz JSON & params with ffuf/wfuzz.
5. Feed candidate vulnerable endpoints to targeted tools (sqlmap, commix, dalfox, tplmap).
6. Use parallel to run non-intrusive scans concurrently and throttle per ROE.

7) Detecting the right injection context (practical tips)

Look at Content-Type:

• application/json → JSON/NoSQL context.
• application/xml/text/xml → XXE possible.
• multipart/form-data → file handling.

Observe response differences:

• Type errors / stack traces often reveal server-side parser type.
• Boolean-based differences imply SQL/NoSQL.
• HTML escaping indicates XSS sanitization (test different encodings).
• Check server logs (if you have access) — injection evidence often recorded there.
• Check whether the input is used in queries by searching source (if source available) or looking for predictable query parameters (e.g., id=123 patterns).

8) What to capture as evidence (always)

• Raw HTTP request(s) and response(s) (full headers + body).
• Tool outputs (sqlmap dump snippets, dalfox result, tplmap evidence).
• Screenshots of DOM/executed payloads.
• Burp project snippets and Collaborator OOB logs.
• Exact payload used and time-stamped logs.

9) Safety & rules of engagement

• Always confirm scope and authorization before fuzzing or using time-based/OOB payloads.
• Avoid destructive payloads unless explicitly allowed.
• Throttle scans to avoid DoS.
• Keep logs of all tests and obtain explicit permission for aggressive tests.

10) Quick reference — tool shortlist by purpose

• Crawling/Mapping: Burp, OWASP ZAP, waybackurls, gau, httpx
• Parameter discovery: Arjun, ParamMiner (Burp), wfuzz, ffuf, Burp Intruder
• API/GraphQL: Postman, GraphQLmap, InQL, jq
• Fuzzing: ffuf, wfuzz, Burp Intruder
• SQL/NoSQL: sqlmap, NoSQLMap, Burp Repeater
• Command injection: commix, Burp Repeater
• XSS: dalfox, xsstrike, Burp Scanner
• SSTI: tplmap, Burp Repeater
• XXE/SSRF/Blind: Burp Collaborator, Interactsh, ssrfmap
• File upload analysis: Burp, ExifTool, ImageMagick
• WebSockets: wscat, websocat, Burp WebSockets
• Automation: GNU parallel, python/bash scripts, masscan (for large scope)

11) Example quick test checklist (per endpoint)

For each endpoint:

• Record method, URL, headers, Content-Type.
• Enumerate parameters (GET/POST/JSON/Path/Headers/Cookies).
• Try reflective tests for XSS (<script>alert(1)</script>), note sanitization.
• Try SQLi boolean/time payloads on string/num params.
• Try NoSQL operators on JSON inputs.
• Try command separators on params used in system calls.
• Test for SSTI using {{7*7}} (engine-specific).
• For file endpoints, test MIME/extension bypass and returned file behavior.
• If blind, insert Burp Collaborator payload and check for callbacks.
• Log full request/response and evidence.

Happy Hacking & Keep Following Sakib Haque Zisan !!