Hi there, in this lesson we are going to cover general concepts of
injection problems and I'll briefly discuss the general idea behind injection attacks.
Then I'm going to do a brief overview of the
three that we're going to cover in this module,
SQL injection, command injection and cross-site scripting.
So after this lesson,
you'll be able to investigate a system for injection problems. Let's dive in.
The general idea behind injection attacks is that there is some untrusted data
as input that gets added to or embedded into a command or query string.
This string is then sent to an interpreter in
this interpreter interprets that string as a commander query.
In other words, there is a mismatch between how the developer sees
this string coming into the interpreter and how the interpreter sees the string.
Specifically, the string being fed into the interpreter is
considered by the interpreter as 100% a command or query.
However it is treated programmatically by the developer as part data and part command.
On top of that,
this string is modifiable by an untrusted party.
For example, here we have as untrusted data,
the parameters login and PWD or password.
The variable login is set to the data of the string some user and the variable PWD is set
to this string which is one single quote or single quote equals one.
Now, it's intended by the developer that the SQL statement should only be
true when the login and password variables match an existing entry.
Here you can see that the developer has created
the SQL statement where it selects the login and password from the table called Members,
where the login data is equal to the login given by
the user and the password is given as the password by the user.
But if we took the input that is set here in this example,
you will get the following SQL query string of selecting this login ID and password from
the members table where the login id is some user
and password equals one or one equals one.
This SQL statement when sent over to the interpreter,
it's always going to result in a true statement.
In summary, there is a mismatch between how the developer sees
a string coming into the interpreter and how the interpreter sees the string.
Now I'm going to talk briefly about SQL injection.
As we saw earlier in that example,
an untrusted or malicious user can inject data into a SQL command.
This can lead to possibly,
the ability to read or write into a database.
Also depending on the construction of the SQL command,
it is very possible that the malicious user can run OS commands.
Now we're going to talk briefly about cross-site scripting.
Cross-site scripting is where a malicious user can inject JavaScript into
a web application and that JavaScript is then interpreted by the victim's browser.
There are three types,
which we'll get into more detail in later lessons.
One is called reflected,
another is called stored and another is called DOM based.
The differences here in general are how the JavaScript is injected and interpreted.
This can lead to account impersonation.
With command injection, this allows a malicious user
to inject an OS command into a command string.
This command string is then run as the web application's user on
the server side with the same privilege as a user of that web application.
To give this a little bit more detail,
in general a web server is run as a specific type of user on the system.
For example, somebody could run an Apache web server as the root user.
If that were the case,
then there was a command string that was vulnerable to command injection that
vulnerability can be taken advantage of such that
the malicious user can fully compromise that system.
In summary, we talked about the general idea behind injection attacks.
And we talked briefly about three kinds.
We're going to chat about in more detail in later lessons.
That's SQL injection, command injection and cross-site scripting. Thank you.