Prerequisites. This lesson assumes you have completed the [SQL injection](/#/), [NoSQL injection](/#/), and [command injection](/#/) lessons, and that you are comfortable with HTTP request/response basics — complete the [HTTP Fundamentals](/#/) lesson if you have not already. The lab exercises for LDAP injection and XPath injection additionally require a working Burp Suite setup and an external authorised lab (a PortSwigger Web Security Academy lab or a local DVWA). HPP and SMTP injection can be observed with any intercepting proxy or a test email inbox.
You have already met [SQL injection](/#/), [NoSQL injection](/#/), and [command injection](/#/). Strip away the syntax and they are one flaw wearing different clothes: untrusted data is concatenated into a string that some interpreter then parses as code. Change the interpreter and you get a new injection class — same shape, new grammar.
This lesson covers four classes the SQL-centric path skips but that you will still meet on real targets:
- LDAP injection — the interpreter is a directory-service search filter (corporate logins, address books).
- XPath injection — the interpreter is an XML query over an XML-backed store.
- HTTP Parameter Pollution (HPP) — the "interpreter" is the query-string parser itself, and the bug is ambiguity rather than a metacharacter.
- Email / SMTP header injection — the interpreter is a mail header block, and the metacharacter is the same newline you met in [CRLF injection](/#/).
Authorised targets only. Breaking out of directory filters, subverting XML queries, polluting parameters, and forging mail headers are active attacks on a live service. Use only a lab you own or an app you are explicitly authorised to test — a PortSwigger Web Security Academy lab, a local DVWA, or your own app with an LDAP directory, an XML store, or a contact/mail form. Review [Hacking Ethics and Authorization](/#/) first. NovaCart teaches the SQL/NoSQL cases natively, so this lesson requires an external authorised lab for these four classes.
In this lesson you will:
- See the unifying injection model — data interpreted as code in some grammar — and how it generalises past SQL.
- Learn the metacharacters and breakout payloads for LDAP filters, XPath queries, HPP, and mail headers.
- Identify which interpreter parses an input on a lab and craft the breakout.
- Take away the single fix that closes the entire injection family: escape/parameterise for the specific interpreter and validate by type.
Click Continue when you are ready.