When we first hear the term “injection”, the first word which comes to our mind when injecting something in the server, you may have heard of some of the attacks such as SQL injection, Host Header injection and so on. It is a dangerous attack and has the capability to destroy any large or small organization so to make sure that our security is up to the mark we can make use of threatscan which is a product developed by the cyber security hive and has successfully kept organizations safe from injection attacks. It does so by proving automated AI based penetration testing and manual penetration testing as well. It is also trusted by a lot of businesses in the market which makes it one the best vulnerability management and penetration testing as a service product in the market.

What are Injection Attacks?

An Injection takes place when a malicious code is injected in the network and has the capability to extract all the information from the database and send it to the server. This attack type is considered a major problem in web security and is listed as the number one web application security risk in the OWASP Top 10. The procedure of avoiding SQL injection vulnerability is simple, developers need to stop writing dynamic queries or prevent user-supplied input which contains malicious codes.

Types of Injection Attacks

SQL INJECTION

This type of injection refers to an attack in which the attacker executes a malicious payload (malicious SQL statements) that controls a web application database server. This is one of the oldest vulnerabilities because all websites or web applications use SQL-based databases. By exploiting the SQL Injection vulnerability, under the right circumstances, an attacker could use it to bypass a web application’s authentication and authorization mechanisms and retrieve the contents of an entire database. SQL injection can also be used to add, modify and delete records in a database, affecting data integrity. The impacts of SQL injections are authentication bypass, information disclosure, data loss, data theft and loss of data integrity, denial of service and sometimes system compromise.

CROSS SITE SCRIPTING (XSS)

In a cross-site scripting attack, malicious scripts are injected into a web page and executed when that page is visited by a user. XSS attacks occur when an attacker uses a web application to send malicious code, usually in the form of browser-side script, to another end user. The flaws that allow these attacks to succeed are fairly common and occur anywhere when a web application uses user input in the output which it generates without validating or encoding it.

XPATH INJECTION

Similar to SQL injection attacks, XPath Injection attacks websites that operate on user-supplied information to create an XPath query for XML data. In addition to that, these vulnerabilities can also elevate the attacker’s privileges on the website if XML data is used for authentication (such as an XML-based user file).

TEMPLATE INJECTION

Template injection attacks can occur when user input is concatenated directly into a template instead of being passed as data. This allows attackers to inject arbitrary template directives to manipulate the template engine, often giving them complete control over the server.

CODE INJECTION

As the name suggests, this attack introduces malicious code into the application that can compromise the integrity of the database and the privacy properties, security and even the accuracy of the data. It can also steal data and bypass access and authentication controls. Code injection into any application can lead to complete system compromise and cause system plague.

CRLF INJECTION

The term CRLF stands for Carriage Return Line feed, which generally denotes the end of a line. A CRLF injection occurs when a user successfully sends a CRLF into an application, which is most often done by modifying an HTTP parameter or a URL. CRLF Injection is a software application coding vulnerability that occurs when an attacker enters a CRLF character sequence where it is not expected. When CRLF injection is used to split an HTTP response header, it is referred to as HTTP Response Splitting. CRLF injection vulnerabilities result from data input that is not neutralized, incorrectly neutralized or otherwise un-sanitized.

EMAIL HEADER INJECTION

Most of the time, a contact form sends SMTP headers such as From and Reply to allow the recipient to easily process the communication from the contact form just like they would do to any other email rather than sending email to an intended recipient of the message by a legitimate user. Unless user input is validated before being inserted into SMTP headers, the contact form may be vulnerable to email header injection (also referred to as SMTP header injection). Indeed, an attacker could be able to insert additional headers in the message, thus asking the SMTP server to execute instructions different from those expected. Such attacks generally lead to the disclosure of information and the increase of spam.

HOST HEADER INJECTION

The host header specifies which website or web application should handle an incoming HTTP request, and the web server uses the value of this header to send the request to the specified website or web application. As a common practice of hosting multiple websites and web applications on the same IP address, most web servers are configured to forward the unrecognized host header to the first virtual host in the list. Therefore, requests with arbitrary host headers can be sent to the first virtual host. Another way to pass arbitrary host headers is to use the X-Forwarded Host header. In some configurations this header will overwrite the value of the Host header

XML EXTERNAL ENTITY INJECTION (XXE)

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application that is processing XML data. It often allows an attacker to view files on the server’s file system, and to interact with any external systems that the application itself can access.

LDAP INJECTION

Lightweight Directory Access Protocol (LDAP) is an open standard protocol for querying and manipulating X.500 directory services. An attacker alters the structure of an LDAP statement when a web application fails to properly sanitize user-supplied input. If an attacker can modify an LDAP statement, the process will run with the same privileges as the component that executed the command. (e.g., database server, web application server, web server, etc.) This can lead to serious security problems when permissions grant the rights to query modify or delete content within the LDAP structure. The same advanced exploit techniques available in SQL Injection can also be similarly applied in LDAP Injection. These injections target authentication bypass, privilege escalation, and authentication bypass.

OS COMMAND INJECTION

Operating System Command Injection (also known as Shell Injection) is an Internet security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise the application and all its data. Very often, an attacker can exploit an operating system command injection vulnerability to compromise other parts of the hosting infrastructure by exploiting trust relationships to attack other systems within the organization.

How can we Detect Injection Vulnerabilities?

The easiest way to detect injection vulnerabilities or any other vulnerability is by using automated scanners but it is not recommended to use automatic tools due to its inaccurate results. The best way to determine if your applications are vulnerable to injection attacks is to search the source code for resources such as system, exec, fork, Runtime. Exec, SQL queries, XML and JSON parsers, or whatever the syntax is used for making requests to interpreters in your environment. We should also validate that all users input is properly sanitized and the output is encrypted.

With threatscan we manually perform checklist of 150+ checks designed for your application to exploit and generate vulnerabilities. That’s one of the primary reasons why threatscan is best vulnerability management and penetration testing as a service product in the market.

How can we Protect from Injection based Vulnerabilities?

• Penetration Testing
• Validate Input.
• Apply Least Privilege.
• Handle Exceptions and Returned Status Codes.
• Investigate Mitigation Techniques for Specific Technologies Your Application Uses.
• Avoid Accessing External Interpreters.
• Performing White list Input Validation as a Secondary defense.