This is strange... because there *is* a specific type of attack called an "SQL injection attack" which is often tested for.

So, their use of the word "injectamos" makes it sound like they *might* be implicitly talking about "SQL injection attacks"... but on the other hand, the context sounds like they're just talking about attacks in general, so the generic phrase "we perform attacks on the application" might be safer.