It depends how the code is being injected. If they’re using a an output filter on the web server, they could do it before the encryption stage. See http://ngin

It depends how the code is being injected. If they’re using a an output filter on the web server, they could do it before the encryption stage. See http://nginx.org/en/docs/http/ngx_http_sub_module.html http://nginx.org/en/docs/http/ngx_http_sub_module.html & https://httpd.apache.org/docs/2.4/filter.html https://httpd.apache.org/docs/2.4/filter.html