Web Application Vulnerabilities

SQL Injection (SQLi)

How SQL Injection Works:

Vulnerable Code:

• •```sql
• •query = "SELECT * FROM users WHERE username='" + input + "'";
• •```

Malicious Input:

• •```
• •' OR '1'='1
• •```

Resulting Query:

• •```sql
• •SELECT * FROM users WHERE username='' OR '1'='1'
• •```
• •This returns ALL users because '1'='1' is always true.

SQL Injection Impact:

• •Data theft (dump entire database)
• •Data modification (change records)
• •Authentication bypass (login as any user)
• •Database destruction (DROP tables)
• •Command execution (in some cases)

SQL Injection Types:

SQL Injection Defenses:

• •Parameterized queries (prepared statements)
• •Input validation (whitelist allowed characters)
• •Stored procedures (with parameterization)
• •Least privilege (database accounts)
• •WAF (Web Application Firewall)

Cross-Site Scripting (XSS)

How XSS Works:

• 1.Attacker injects JavaScript into web page
• 2.Victim visits page containing malicious script
• 3.Script executes in victim's browser
• 4.Script can steal cookies, credentials, or perform actions

XSS Types:

Reflected XSS

• •Malicious script in URL or form input
• •Server reflects input back in response
• •Victim clicks malicious link
• •One-time, per-request attack

Stored XSS

• •Malicious script stored on server (database, comments)
• •Served to all users viewing the content
• •Persistent and affects many users
• •More dangerous than reflected

DOM-based XSS

• •Vulnerability in client-side JavaScript
• •Server never sees malicious payload
• •Executed entirely in browser

XSS Impact:

• •Session hijacking (steal cookies)
• •Credential theft (fake login forms)
• •Defacement (modify page content)
• •Malware distribution
• •Keylogging

XSS Defenses:

• •Output encoding (escape special characters)
• •Input validation (reject or sanitize)
• •Content Security Policy (CSP)
• •HTTPOnly cookies (inaccessible to JavaScript)
• •X-XSS-Protection header

Cross-Site Request Forgery (CSRF)

How CSRF Works:

• 1.User authenticates to target site
• 2.User visits attacker's site (while still logged in)
• 3.Attacker's site sends request to target
• 4.Target processes request using user's session
• 5.Action performed without user's knowledge

CSRF Example:

• •User logged into bank. Visits malicious page containing:
• •```html
• •
• •```
• •Bank processes transfer using user's existing session.

CSRF Defenses:

• •Anti-CSRF tokens (unique per request)
• •SameSite cookie attribute
• •Referer header validation
• •Re-authentication for sensitive actions

Other Web Vulnerabilities

Insecure Direct Object References (IDOR)

• •Accessing objects by manipulating IDs
• •Example: /user/profile?id=123 → change to id=124
• •Access other users' data

Server-Side Request Forgery (SSRF)

• •Tricking server into making requests
• •Access internal resources
• •Bypass firewalls

XML External Entity (XXE)

• •Exploiting XML parsers
• •Read local files
• •Server-side request forgery

Directory Traversal

• •Using ../ to access files outside web root
• •Read sensitive files
• •Example: /file?name=../../../etc/passwd

Input Validation Summary