[Inject] Reflective injection (single-request)

[emmanuelgautier]

Description

In-band, single-request-detectable injection classes — response is enough to confirm the finding (no blind/time-based inference required; that's Enterprise).

Checks to implement

• SQL injection — error-based / boolean
• Command injection — reflected output
• XXE — in-band entity resolution
• CRLF / HTTP response splitting
• LDAP / XPath / header injection
• Open redirect
• Basic SSRF — OAST callback

Tier rationale

Confirmable from the immediate response to a single crafted request.