[MUSIC] Hey everyone, welcome to module 2. In the previous modules we talked
about cross site scripting attack, which is a subset of
injection attacks in general. Where the attacker is getting their code
to be executed by the user's browser by simply appending the code
that was already written, and executing some potentially
malicious JavaScript. In this module, we're going to continue
talking about injection attacks. By the end of this module,
you'll be able to discuss and describe the three most common
types of injection problems. SQL or Structured Query Language
injections, cross-site scripting, and command injection. You will be able to work on exploiting a
SQL injection vulnerability in the WebGoat application. You'll also be able to formulate plans
to mitigate injection problems in your application. Now, injection attacks, the way OWASP and WebGoat classify them,
happen to be on the back end. That's why SQL injection or
injection attacks in general are separated from cross-site scripting,
and they each have their own categories. Injections acts are very powerful. In this module,
we're going to consider XML entity and SQL as our two types of injection attacks. We'll practice exploiting with the aim
of finding and fixing vulnerabilities. There are many types of injection attacks,
but once you get a hang of one of them,
you can can kind of get the rest. We will target the two kinds
of injection attacks, XML and SQL injection, because there
are prebuilt lessons in WebGoat. We'll be working along those lessons. We have a lot to cover,
so let's get started.