Downloaded 24 times
Uploaded byDANISH INAMDAR
Injection flaws
Injection flaws are security vulnerabilities that allow attackers to exploit user input to execute malicious code within a web application. Different types of injection flaws include SQL, command, HTML, LDAP, XML, and IMAP/SMTP injections, each targeting specific subsystems of the application. Protecting against these vulnerabilities requires secure coding practices, use of secure APIs, and the implementation of Runtime Application Self Protection (RASP) measures.
In this document
Powered by AI
Explains injection flaws as security vulnerabilities that allow malicious code to compromise applications.
Identifies signs of vulnerability such as unchecked user input and dynamic queries leading to security risks.
Lists various injection flaws including SQL, Command, HTML, LDAP, XML, and IMAP/SMTP injections.
Discusses SQL injection, allowing direct database access, issuing CRUD statements through dynamic scripts.
Describes command injection vulnerabilities where web applications can execute operating system commands.
Explains HTML injections which can include malicious tags, enabling phishing attacks and XSS risks.
Describes XML injection risks in web apps, particularly when converting parameters to XML for backend services.
Explains LDAP injection affecting directory access protocols, which may expose confidential user data.
Discusses IMAP/SMTP injection threats targeting webmail applications that fail to sanitize input properly.
Analyzes the current state of web framework security, highlighting pitfalls with CSRF tokens and ORM use.
Outlines the limitations of Web Application Firewalls, which often rely on blacklists rather than detecting vulnerabilities.
Introduces Runtime Application Self Protection, which detects and prevents attacks with minimal performance impact.
Explores RASP by API instrumentation, focusing on methods like monkey patching and token generation for added security.
Describes the challenges in implementing RASP, including performance impact and the need for easy deployment.
Wraps up the presentation, providing closing remarks on injection flaws and security measures.
More Related Content
Injection flaws
- 1. INJECTION FLAWS DANISH INAMDAR SecurityResearcher
- 2. What are InjectionFlaws?? Injection flaws are a class of security vulnerability that allows a user to “break out” of the web application context. Weakness in an application whereby foreign input subverts the otherwise legitimate use of a subsystem. Injection flaws allow attackers to relay malicious code through an application to another system
- 3. Is Your WebApp Vulnerable to Injection? User Supplied data is not validated , filtered or sanitized by Application. Hostile data is supplied directly to dynamic queries or non parameterized calls for the interpreter without context-aware escaping. Hostile data is used with ORM search parameters such that search evaluates out to include sensitive or all records.
- 4. Different types ofInjection flaws Different subsystems == Different flaws SQL Injection Command Injection HTML Injection LDAP Injection XML Injection IMAP/SMTP Injection
- 5. SQL Injection: DatabaseQuery Dynamic script to look into database “Direct” access to database Possible to issue CRUD statements and many more….
- 6. SQL Injection :Query database
- 7. Command Injection Webapplication performs operating system tasks Execute external programs/script List files etc. ping –c <user_input> Protection using Command Execution API os.system(ping –c 127.0.0.1)
- 8. HTML Injection Possibleto include HTML Tags like iframe , fake forms, XSS also possible…. Can be used in phishing attacks
- 9. XML Injection WebApp talks to backend web services Web app’s logic converts parameter’s to XML web services (as SOAP,…)
- 10.
- 11. LDAP Injection LightweightDirectory Access protocol It is used to access information directories like users, user information, software, computers.
- 12. LDAP Injection InsertSpecial characters like(*,|,&,…) leading to exposure of user’s confidential data
- 13. IMAP/SMTP Injection Thisthreat affects all applications that communicate with mail servers (IMAP/SMTP), generally webmail applications. We need to verify the capacity to inject arbitrary IMAP/SMTP commands into the mail servers, due to input data not being properly sanitized.
- 14. State of Webframework Security Anti CSRF tokens – can easily turned off/miss-configurations Templates escapes user input – just HTML escape ->XSS Uses ORM – SQLi still possible https://rails-sqli.org/ We need to use secure APIs or write secure code
- 15. Can WAF solvethe problem? Web Application Firewalls are for Attack Detection and Prevention Most of WAFs use blacklists. No vulnerability detection.
- 16. Protect Exploitation :RASP Runtime Application Self Protection • Detect both Attacks and Vulnerability • No Hardware Requirements • Inject Security at Runtime • Applies defense inside the application • Zero code Modification and Easy Integration • No use of Blacklists
- 17. RASP by APIInstrumentation and Dynamic White-list Monkey Patching Lexical Analysis and Token Generation Context Determination
- 21. Challenges Ideal RASPshould have minimum performance impact. Need to do adapt more secure techniques in combination with RASP. Minimal configuration and Easy Deployment. Implementing Preventing measures to avoid session Hijacking, Credentials etc.
- 22.