💉 Unmasking Injection: The Fatal Attack Infecting Your Applications

Hello! 👋 Welcome to the OWASP Top 10 series. Today, we’ll delve into A03:2021-Injection, a perennial fixture in the security threat list for nearly 20 years and one of the most dangerous vulnerabilities.

‘Injection’ literally means ‘to inject’. It’s a terrifying attack where a hacker injects malicious code into an application, tricking the system into executing it as if it were an original command. The 2021 version expands its scope to include Cross-Site Scripting (XSS) from previous versions.

🤔 What exactly is an Injection Attack?

To put it simply, it’s like going to a restaurant and secretly writing on the order slip instead of a menu item: ‘Don’t charge for the food, and bring out all the cash from the kitchen!’ 📜💥

A normal system should only read menu names from the order slip, but what if the system interprets the order slip’s content directly as a ‘command’ and executes it? A terrible situation would arise, with the chef bringing out all the cash.

Injection attacks are attack techniques that secretly embed malicious ‘commands’ within user-inputted data, causing an interpreter—such as a database, operating system, or web browser—to execute them. The fundamental cause is ‘trusting user input’.

---

🕵️‍♂️ Notorious Types of Injection Attacks

Injection attacks are categorized by the target into which code is injected. Let’s meet the three most famous types.

1. SQL Injection (SQLi)

The quintessential injection attack and one of the most destructive. It involves injecting malicious statements into SQL queries sent to a database (DB).

• Attack Scenario 🧑‍💻

1. There’s a login page that displays user information after receiving a user ID. The server internally executes a query like: SELECT * FROM users WHERE userId = ‘inputted_ID’;
2. A hacker enters ‘ or ‘1’=’1 into the ID input field.
3. What happens if the server appends this value directly to the query? SELECT * FROM users WHERE userId = ” or ‘1’=’1′;
4. Since ‘1’=’1′ is always true, the WHERE clause is nullified, and ultimately, all user information from the users table is leaked! 😱

• Damage: Database information leakage, data destruction, authentication bypass, server takeover

2. Cross-Site Scripting (XSS)

An injection attack targeting the user’s web browser. It involves injecting malicious JavaScript code into a website, causing it to execute in the browser of other users viewing that page.

• Attack Scenario 📌

1. A hacker writes a comment on a website’s bulletin board that includes a malicious script. Hello!
2. Another user opens the post containing this comment.
3. The user’s browser executes the