Understanding injection vulnerabilities
Injection attacks are pretty easy to understand and sometimes to execute as well. They simply consist of inserting unexpected data, usually crafted commands or keywords, inside an input that should only contain specific data, such as a username and/or a corresponding password. By leveraging different formats, such as another encoding, or by adding commands to the input, a badly implemented API’s backend would inadvertently execute those commands or try to interpret the exceptional encoding, which could cause general failure and possible data leakage.
The possibly most famous variation of this attack affects SQL databases, and they are frequently called SQLi (“i” for injection) attacks. This happens because many publicly available applications and API endpoints interact with relational databases on their backend’s infrastructure. On the other hand, some other applications make use of unstructured data, which makes...
