OWASP TOP 10: #3 INJECTION ATTACK

 WHAT IS INJECTION ATTACK?

WHAT IS INJECTION ATTACK?

An injection attack is a cyberattack that occurs when an attacker inserts malicious code into a program. The attacker exploits vulnerabilities in the program to gain unauthorized access to data or manipulate the system. 

In this type of attack, an attacker exploits the failure of the web application to filter data provided by users before it inserts that data into a server-side interpreted HTML file. Exploits web sites that allow an attacker to inject data into an application in order to execute XPath queries.

TYPES OF INJECTION ATTACKS:

SQL injection

The attacker includes an SQL statement in data sent via a web form, comment field, or query string. 

CRLF injection

The attacker injects an unexpected CRLF (Carriage Return and Line Feed) character sequence. 

Mail command injection

The attacker injects malicious code via email messages. 

Prompt injection

The attacker exploits the fact that LLM applications do not clearly distinguish between developer instructions and user inputs. 

HOW INJECTION ATTACKS WORK?

The attacker provides malicious data as input to the program. 

The program interprets the data as executable commands.

The attacker can then execute unauthorized commands, access data, or manipulate the system's operations. 

MITIGATION:

To mitigate injection attacks, the primary strategy is to implement strict input validation and sanitize user inputs by using parameterized queries, properly designed stored procedures, and enforcing data type restrictions, alongside utilizing a web application firewall (WAF) to further filter malicious input and regularly conducting security audits to identify potential vulnerabilities. 

KEY MITIGATIONS:

Encoding/Escaping:

Properly encode special characters in user input to prevent them from being interpreted as malicious commands. 

Web Application Firewall (WAF):

Deploy a WAF to filter incoming traffic and detect malicious patterns in user input before it reaches the application. 

XML Injection:

Validate XML input against a defined schema to prevent malicious XML structures from being injected.