Injection flaws - Learn Tech From Zero

2.4 Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.

📘CompTIA CySA+ (CS0-003)

1. What Are Injection Flaws?

Injection flaws happen when an application takes untrusted input from a user and sends it directly to an interpreter or database without properly validating or sanitizing it. Attackers can exploit this to execute malicious commands, read sensitive data, or even take over the system.

Think of it as giving a program a “shortcut” to run commands it shouldn’t because it trusts user input too much.

2. Common Types of Injection Flaws

Here are the main types you need to know for the exam:

a) SQL Injection (SQLi)

What it is: Malicious SQL code is inserted into a database query.
Example in IT context: A login form where a user inputs a username and password. If the application doesn’t check the input properly, an attacker can enter SQL code like ' OR '1'='1 to bypass login and access the database.
Impact: Can steal data, modify records, or delete tables.

b) Command Injection

What it is: Attacker sends commands to the host operating system via a vulnerable application.
Example: A web app allows users to ping an IP address. If the input isn’t validated, an attacker can enter 127.0.0.1; rm -rf / to run system commands.
Impact: Can allow full control over the server.

c) LDAP Injection

What it is: Malicious input is used to manipulate LDAP queries.
Example: An internal application querying Active Directory for a username. If unchecked, an attacker can bypass authentication or retrieve sensitive user info.
Impact: Unauthorized access to user accounts or directory data.

d) XML Injection / XPath Injection

What it is: Attackers manipulate XML queries or XPath expressions.
Example: An application querying user info from XML files. Malicious input could extract unauthorized information.
Impact: Data leakage or bypassing authentication.

e) Code Injection

What it is: Attacker injects programming code that the application executes.
Example: A web form that allows scripts but executes them on the server.
Impact: Can change application behavior, steal data, or compromise the server.

3. Why Injection Flaws Are Dangerous

Attackers can bypass authentication, access confidential data, delete or modify records, or even take control of a server.
They exploit trust assumptions: the program trusts user input too much.

From an exam perspective, understand that any application accepting input from users is a potential target.

4. How to Mitigate Injection Flaws

Here are key controls to prevent and mitigate them:

a) Input Validation

Only allow expected characters, lengths, and formats.
Example: If an IP address is required, only accept numbers and dots.

b) Parameterized Queries / Prepared Statements

Use SQL statements or API calls where user input is not directly concatenated into commands.
Example: Instead of writing SELECT * FROM users WHERE username = ' + user_input, use a prepared statement.

c) Stored Procedures

Execute predefined procedures in the database instead of building queries dynamically.
Helps prevent attackers from changing SQL logic.

d) Escaping / Encoding

Convert special characters into safe forms before sending to interpreters or databases.
Example: Convert < to < in web forms to prevent HTML/JavaScript injection.

e) Least Privilege

Ensure databases and applications run with minimal access.
Even if injection occurs, attacker can’t do much if permissions are limited.

f) Web Application Firewalls (WAFs)

Detect and block known malicious patterns in user input.
Acts as an extra layer of protection.

g) Regular Code Reviews and Security Testing

Use static and dynamic analysis tools to detect vulnerabilities.
Regularly check for injection flaws in your applications.

5. Exam Tips for Injection Flaws

Remember the key principle: “Never trust user input.”
Know the common types: SQL, command, LDAP, XML/XPath, and code injection.
Understand basic mitigations: input validation, parameterized queries, escaping, least privilege, and WAFs.
Scenario-based questions often describe a web app or server accepting input—your job is to pick the control that stops the attack.

✅ Quick Summary Table

Type of Injection	What it Targets	Example Input	Mitigation
SQL Injection	Database	`' OR '1'='1`	Parameterized queries, input validation
Command Injection	OS Commands	`; rm -rf /`	Input validation, least privilege
LDAP Injection	Directory	`*)(	(user=*))`
XPath/XML Injection	XML/Queries	`//user[password='']`	Input validation, encoding
Code Injection	Application code	Malicious script	Input validation, sandboxing

Injection flaws are a high-priority topic for CySA+ because they are common, critical, and often exploited in real IT environments. Understanding both the attack and the controls is crucial for exam scenarios.