From the course: Secure Coding in Java

Injection attacks - Java Tutorial

From the course: Secure Coding in Java

Start my 1-month free trial

Injection attacks

- [Trainer] There are a class of attacks that continually show up on the last top 10. I'm not sure the scariest part of this is the fact that they can be devastating for a company or its customers, or the fact that release after release of the last top 10. These attacks continually show up. Injection attacks are relatively simple to understand. Part of why they're so easy to execute. You have to have some form of interpreted code on the path. One of the most common is SQL injection. However, it isn't even close to the only one, the bad actor leverages user input or requests, but maliciously forms it to cause the application to produce unexpected results. Once the maliciously formed input reaches the application, it is interpreted as routine input, which in turn allows its malicious behavior to be expressed. The unanticipated behavior can be a plethora of things. Examples in the wild I have seen, include dumping an entire database or parts of it, including sensitive user data. I have seen attacks that have been devastating, but no one knew they were happening. Let's go through some of the more common injection attacks in Java programs real quick. We will go into some of these in more detail later. Now, SQL injection is by far the most common, both for their prevalence and applications and ease to script against the attack itself. For enterprise systems and others that rely on LDAP. This can be a common point of injection taxes well, as the queries themselves are again interpreted. Well cross XSS scripting, isn't really Java and said JavaScript, a lot of full stack developers need to understand the risks to web based applications. In a similar vein carriage return line feed, or CRLF injection, applies to web applications and not specifically Java, but nonetheless it is common error seen in the wild and one that you need to be aware of. The last one comes mainly from the enterprise world of Java, and that is XPath injection. When you use dynamic XML queries using XPath, you can be susceptible to XPath injection. Now there are several other injection attacks. We won't really discuss much in this course, but I wanted to give you a quick rundown of them. SMT and IMAP or email injection attacks, allow a malicious user to inject SMTP commands or IMAP commands that are interpreted by the end SMTP/IMAP system. These attacks can be used to send spam through your relay or worse yet disclose sensitive information about your system. Code injection attacks actually leveraged the applications user to execute additional applications. If the user has sufficient permissions or those permissions can be elevated, the bad actor can compromise the system as a whole. OS command injection, targets executing available commands on the host operating system. Through the application runtime, the bad actor will execute commands on the OS that may give them full access to the system. Host header injections apply again to web applications. And they're usually seen in password reset or cash heavy applications. The abuse of Host header injections usually inputs corrupt or abusive data into the system that can cause many of these functions to break or leak data.

Contents