From the course: Static Application Security Testing

Unlock the full course today

Join today to access over 24,500 courses taught by industry experts.

A3: Injection

A3: Injection - SonarQube Tutorial

From the course: Static Application Security Testing

Start my 1-month free trial Buy for my team

A3: Injection

“

- [Teacher] The third set of risks in the OWASP top 10 list are injection flaws. When an attacker sends untrusted data to a backend interpreter, something like an OS command line interpreter or a database or an LDAP directory the interpreter has to decide what to do with that data. The only problem is that interpreters can't decide that's not their job. If they receive a command, they're going to act on it. That's why it's so important for the developers to make sure that the only commands that make it to those interpreters are commands that the developers trust. Attackers seeking to exploit injection flaws are going to go after any and every part of the application that looks like it interacts with an interpreter on the backend. Common attack vectors include environment variables, application parameters, web services, and even the users themselves. If an application allows users to enter data and let's face it, most of…

Contents