CompTIA Security+ Preparation · lesson 17 of 45 · 25 min
Injection Attacks
SQL Injection (SQLi) — attacker inserts malicious SQL code into an input field that is passed to a database query. Can bypass authentication, extract data, modify/delete data, or execute OS commands. Example: entering ' OR '1'='1 in a login field to bypass authentication. Mitigation: parameterized queries (prepared statements), input validation, WAF.
Command injection — attacker injects OS commands through an application input. Example: a web app that runs ping [user_input] — attacker enters 8.8.8.8; rm -rf /. Mitigation: input validation, avoid system calls with user input.
LDAP injection — similar to SQLi but targets LDAP directory services. Mitigation: input validation, parameterized LDAP queries.
Cross-Site Scripting (XSS)
XSS (Cross-Site Scripting) — attacker injects malicious JavaScript into a web page that is then executed in other users’ browsers. The script runs in the victim’s browser with the victim’s session context.
Stored XSS (Persistent) — malicious script is stored on the server (e.g., in a comment or profile field) and served to all users who view that content. Most dangerous.
Reflected XSS (Non-persistent) — malicious script is in the URL and reflected back in the response. Victim must click a crafted link.
DOM-based XSS — script executes in the browser’s DOM without going to the server.
Mitigation: output encoding (HTML-encode user input before displaying), Content Security Policy (CSP), input validation, HTTPOnly cookies.
CSRF, Buffer Overflow, and Other Attacks
CSRF (Cross-Site Request Forgery) — tricks an authenticated user’s browser into making an unwanted request to a web application. Example: victim is logged into their bank; attacker’s page sends a hidden transfer request using the victim’s session. Mitigation: CSRF tokens (anti-forgery tokens), SameSite cookie attribute, re-authentication for sensitive actions.
Buffer overflow — writing more data to a buffer than it can hold, overwriting adjacent memory. Can overwrite the return address to execute attacker-controlled code. Mitigation: input validation, ASLR (Address Space Layout Randomization), DEP/NX (Data Execution Prevention), stack canaries, safe programming languages.
Directory traversal (path traversal) — attacker uses ../ sequences to access files outside the intended directory. Example: ../../etc/passwd. Mitigation: input validation, canonicalize paths, chroot jails.
Race condition — two processes access shared resources in an unexpected order. TOCTOU (Time of Check to Time of Use) is a common variant.
OWASP Top 10
The OWASP Top 10 lists the most critical web application security risks. Injection (SQLi, command injection) and XSS are consistently in the top 10. Know these for Security+ and real-world security work.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Application Attacks
The primary mitigation for SQL injection is:
- Encryption
- Parameterized queries (prepared statements)
- Firewall rules
- Strong passwords
- Answer: Parameterized queries (prepared statements)
Parameterized queries separate SQL code from user data — the database treats user input as data, never as executable SQL. Stored XSS is more dangerous than reflected XSS because:
- It is harder to write
- The malicious script is stored on the server and affects all users who view the content
- It requires a special browser
- It only affects the attacker
Answer: The malicious script is stored on the server and affects all users who view the content Stored XSS persists on the server — every user who views the infected page executes the malicious script. CSRF attacks exploit:
- SQL databases
- The trust a web application has in an authenticated user’s browser
- Buffer overflows
- Weak passwords
- Answer: The trust a web application has in an authenticated user’s browser
CSRF exploits the fact that the server trusts requests from authenticated sessions — the attacker forges a request using the victim’s session. ASLR (Address Space Layout Randomization) mitigates:
- SQL injection
- XSS
- Buffer overflow attacks
- CSRF
- Answer: Buffer overflow attacks
ASLR randomizes memory addresses — attackers cannot reliably predict where to redirect execution after a buffer overflow. A CSRF token mitigates CSRF by:
- Encrypting the session
- Including a unique, unpredictable value in each request that the attacker cannot forge
- Blocking cross-origin requests entirely
- Requiring re-authentication
Answer: Including a unique, unpredictable value in each request that the attacker cannot forge CSRF tokens are unique per session/request — the attacker’s forged request lacks the valid token, so the server rejects it.
Directory traversal uses which character sequence to escape the intended directory?
- ../
- **/
- //
Answer: ../
../ navigates up one directory level — attackers chain these to escape the web root and access sensitive files like /etc/passwd.
Content Security Policy (CSP) primarily mitigates:
- SQL injection
- XSS
- CSRF
- Buffer overflow
- Answer: XSS
CSP is an HTTP header that restricts which scripts can execute on a page — prevents injected scripts from running. TOCTOU is a type of:
- SQL injection
- Race condition
- Buffer overflow
- XSS
- Answer: Race condition
TOCTOU (Time of Check to Time of Use) is a race condition where the state changes between when it is checked and when it is used. The HTTPOnly cookie attribute mitigates:
- CSRF
- SQL injection
- XSS cookie theft — JavaScript cannot access HTTPOnly cookies
- Buffer overflow
- Answer: XSS cookie theft — JavaScript cannot access HTTPOnly cookies
HTTPOnly prevents JavaScript from reading cookies — even if XSS executes, it cannot steal session cookies marked HTTPOnly. Command injection differs from SQL injection in that:
- Command injection targets databases
- Command injection executes OS commands through application inputs
- SQL injection is more dangerous
- They are identical
- Answer: Command injection executes OS commands through application inputs
Command injection injects OS shell commands (not SQL) — can give the attacker OS-level access to the server.
Previous lesson: Malware types: virus, worm, trojan, ransomware, rootkit, spyware, keylogger, botnet
Back to CompTIA Security+ Preparation
Next lesson: Network attacks: DoS/DDoS, on-path, replay, DNS poisoning, ARP spoofing