📋 What Is It?
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. Attackers can trick the interpreter into executing unintended commands or accessing unauthorized data.
#3
OWASP Rank
274K
Occurrences
94%
Max Incidence
⚠️ Injection Types
- SQL Injection: Manipulate database queries
- NoSQL Injection: Attack NoSQL databases
- OS Command Injection: Execute system commands
- LDAP Injection: Exploit directory services
- XPath Injection: Manipulate XML queries
- Template Injection: Execute code in templates
🔴 SQL Injection Attack
1. App accepts username input
↓
2. Attacker enters:
↓
3. Query becomes:
↓
4. BREACH: Logged in as admin!
↓
2. Attacker enters:
admin' --↓
3. Query becomes:
SELECT * FROM users WHERE username='admin' --'↓
4. BREACH: Logged in as admin!
❌ Vulnerable Code
# SQL Injection - BAD!
username = request.form['username']
password = request.form['password']
# String concatenation - NEVER DO THIS!
query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
cursor.execute(query)
# OS Command Injection - BAD!
filename = request.args.get('file')
os.system("cat " + filename) # Dangerous!
✅ Secure Code
# SQL - GOOD: Parameterized query
username = request.form['username']
password = request.form['password']
# Use parameterized queries (prepared statements)
query = "SELECT * FROM users WHERE username=? AND password=?"
cursor.execute(query, (username, password))
# Or use an ORM
user = User.query.filter_by(username=username).first()
# OS Commands - GOOD: Input validation + safe APIs
filename = request.args.get('file')
# Whitelist allowed files
if filename not in ALLOWED_FILES:
abort(400)
# Use safe file operations
with open(os.path.join(SAFE_DIR, filename), 'r') as f:
content = f.read()
✓ Prevention Checklist
- Use parameterized queries / prepared statements
- Use ORMs (SQLAlchemy, Django ORM, Hibernate)
- Validate and sanitize all user input
- Use whitelist validation for input
- Escape special characters properly
- Implement least privilege for DB accounts
- Use stored procedures (with caution)
- Avoid dynamic query construction
- Use safe APIs (avoid shell commands)
- Enable WAF with injection rules
🔍 Detection & Tools
Testing Tools:
SQLMap
Burp Suite
OWASP ZAP
Commix
Prevention Tools:
SQLAlchemy
Hibernate
Entity Framework
MyBatis
Static Analysis:
Bandit
SonarQube
Semgrep
🌍 Famous Breaches
- Yahoo (2012): SQL injection exposed 450K accounts
- TalkTalk (2015): SQL injection led to £400K fine
- Heartland Payment (2008): 130M credit cards stolen via SQL injection
- Sony Pictures (2011): SQL injection exposed 1M accounts
💡 Common Payloads
# SQL Injection
' OR '1'='1
admin' --
' UNION SELECT NULL--
'; DROP TABLE users--
# NoSQL Injection
{"$ne": null}
{"$gt": ""}
# Command Injection
; ls -la
| cat /etc/passwd
`whoami`
📜 Compliance
- PCI-DSS 6.5.1
- GDPR Art. 32
- SOC 2 CC6.1
- ISO 27001 A.14.2
- NIST 800-53 SI-10