[MUSIC]
You may have heard of the large Equifax breach that occurred in 2017
that exposed data of roughly 140 million people.
Attackers exploited a vulnerability in Apache Struts which is CVE-2017-5638,
which allows remote attackers to execute arbitrary commands when
specially crafting user-controlled data in HTTP headers.
At the very least, it is fascinating to understand how attackers can exploit
application vulnerabilities in order to perform malicious activities.
But on a more important level, it helps those of us who work on creating and
maintaining application code to protect the users who use our applications.
We want to keep in mind the fundamental idea of attack surface, and
the name of the game is to reduce this attack surface.
We also want to be aware of the fact that we should always be thinking
about how our applications handle user-controlled data.
So that we can put guards in place
to minimize security issues with our applications.
By the end of this module,
you will have a fundamental understanding of injection problems in web applications.
You'll be able to discuss and describe the three most common types of injection
problems, SQL injection, Cross-site scripting, and Command injection.
In order to drive home these concepts, you'll be able to work
on exploiting a SQL injection vulnerability in the WebGoat application.
You'll be able to formulate plans to mitigate injection problems in your
applications.
We have a lot to cover.
So let's start then.