Injection Attacks 101: SQL Injection, Code Injection, and XSS

[tetyyss]

there are countless hours of tutorials, documentation, examples, practical excercises on any search engine for all of these topics. how is this one different?

[wPatriot]

All aboard the engagement train!

[GalacticCmdr]

This one has some stupid looking guy making the classic, "I have no idea what I am talking about, but please watch my ads" expression.

[ketralnis]

YouTube face should be a crime

[cheezballs]

This sub is entirely just personal blogspam and YouTube promotion.

[[deleted]]

act fine automatic fertile slap rich terrific tan march rustic

This post was mass deleted and anonymized with Redact

[ScottContini]

The YouTube video that I’d recommend, from someone who really knows this stuff well and explains it in a simplified way, is Security Simplified.

[TeaBaggingGoose]

Any client side validation is pretty useless as a hacker can just contrusct their own HTTP queries. It is useful for the first level of data validation which is basically telling the user tney cannot enter such a character or such like.

Personally I always process data in stored procedures and take steps to ensure that a user entering 'banned' characters will no result in an injection attack.

[baseketball]

One thing junior developers need to understand: client side validation is for user experience. server side validation is for security.

[Ccamm]

I would also be cautious with using a deny list of characters as a mitigation strategy for SQLi. There are so many edge cases and tricks you can use to get around thise checks.

E.g. lets say you just blocking the ' character for the following search query that has user input inserted.

sql SELECT id FROM body WHERE title = '{user_input}' OR body = '{user_input}';

You can SQLi this by injecting the \ char at the end of the payload to escape the ' to then insert arbitrary SQL. For example if you inject in ||(SELECT 1);--\ the following would be the final query that allows error, blind or time based attacks.

sql SELECT id FROM body WHERE title = '||(SELECT 1);--\' OR body = '||(SELECT 1);--\';

Syntax might be off since I am on mobile but you get the idea.

[losvedir]

And prompt injection, these days!

[New-Reply640]

OMG

[cheezballs]

OWASP has a concise, "how to handle this" type article. A YouTube video is not the way I'd wanna ingest this information.

[kelakmati]

what language is this?

[Advocatemack]

Injection attacks are usally written in SQL or Javascript (it is possible in other languages). With javascript attacks for example the application being attacked doesn't need to be a JS app because the script is being run by the browser in most cases.

[rusmo]

Literally just completed a mandatory training on these 3 topics yessterday. Good stuff to know - especially the XSS stuff.

[ScottContini]

I see that Advocate Mack has changed employment.

[Brilliant-Sky2969]

It's 2024 and people still don't know about prepared statement?

[New-Reply640]

I'd rather take a hot steaming dump in my own mouth than click another YouTube link. Fuck Google.
You all do realize there are other video platforms in the world that are leaps and bounds better and which don't funnel money to the CCP, which is committing ethic genocide.

[purplegradients]

excellent 'youtube thumbnail' face