Welcome to Injection & Cross-Site Scripting

Injection attacks and Cross-Site Scripting (XSS) are among the most common vulnerabilities in web applications.

What is an Injection Attack?

Injection attacks occur when untrusted input is sent to an interpreter as part of a command or query.

Types of Injection Attacks

• SQL Injection - Exploits a database by injecting malicious SQL queries.
• Command Injection - Executes arbitrary commands on the host system.
• LDAP Injection - Manipulates LDAP queries to bypass authentication.

SQL Injection Example

An attacker can modify SQL queries to bypass authentication.

SELECT * FROM users WHERE username = 'admin' --' AND password = 'password';

What is Cross-Site Scripting (XSS)?

XSS allows attackers to inject malicious scripts into web pages viewed by users.

Types of XSS

• Stored XSS - The malicious script is permanently stored on the target server.
• Reflected XSS - The script is reflected off a web server and executed in a user’s browser.
• DOM-based XSS - The script is executed in the user’s browser by modifying the page’s DOM.

Preventing Injection & XSS

• Use parameterized queries.
• Implement proper input validation.
• Escape special characters in user input.
• Use Content Security Policy (CSP) to prevent XSS.

Tools for Detecting Injection & XSS

• Burp Suite - Web vulnerability scanner.
• SQLmap - Automated SQL injection tool.
• OWASP ZAP - Web application security scanner.

Summary

Injection and XSS attacks are critical web security risks. Secure coding practices help prevent these threats.