Cross-Site Scripting & SQL Injection Attacks

What protocol is the web based on for servers responding to client requests?

HTTP/HTTPS

What is the difference between server-side code and client-side code in a web application?

Server-side code runs on the web server to process the request and build the response; client-side code runs within the web browser on the client machine to modify the web page before display or modify requests made to the server

What is one of the most widespread vulnerabilities in web apps?

Failure to validate user input properly

What indicates an input validation vulnerability in a web app?

A threat actor can send a script via an input field and make the server or client execute that code

What does sanitizing user input help prevent?

XSS attacks

What is output encoding in this section?

Converting special characters into safe format before displaying it

What does CSP stand for in this section?

Content Security Policy

What does a cross-site scripting (XSS) attack exploit?

The fact that the browser is likely to trust scripts that appear to come from a site the user has chosen to visit

What does an XSS attack insert into a trusted site?

A malicious script that appears to be part of the trusted site

What is the first step in a non-persistent XSS attack?

The attacker identifies an input validation vulnerability in the trusted site

What is the second step in a non-persistent XSS attack?

The attacker crafts a URL to perform code injection against the trusted site

What can the crafted XSS URL be delivered through?

A link to the attacker's site from the trusted site or a link in a phishing email message

What happens when the user opens the crafted XSS link?

The trusted site returns a page containing the malicious code injected by the attacker

Why does the malicious code execute in a non-persistent XSS attack?

The browser is likely to be configured to allow the site to run scripts

What can malicious code do in an XSS attack?

Deface the trusted site, steal data from the user's cookies, intercept information entered in a form, or try to install malware

What is the crucial point about how XSS malicious code runs?

It runs in the client's browser with the same permission level as the trusted site

Why is non-persistent XSS called non-persistent?

At no point is data on the web server changed

What is the goal of a stored or persistent XSS attack?

Insert code into a back-end database or content management system used by the trusted site

How can a persistent XSS attack be delivered in this section?

By submitting a post to a bulletin board with a malicious script embedded in the message

What happens when other users view content containing a persistent XSS payload?

The malicious script is executed

What does SQL stand for?

Structured Query Language

What is SQL used for in a web application?

To read and write information from a database

What SQL statement is used for selecting data?

SELECT

What SQL statement is used for inserting data?

INSERT

What SQL statement is used for deleting data?

DELETE

What SQL statement is used for updating data?

UPDATE

What is a SQL injection attack?

The threat actor modifies one or more of the four basic SQL functions by adding code to some input accepted by the app, causing it to execute the attacker's own set of SQL queries or parameters

What could a successful SQL injection attack allow?

Extract or insert information into the database or execute arbitrary code on the remote system using the same privileges as the database application

What is code injection in the reference?

Adding your own information into a data stream

What enables code injection according to the reference?

Bad programming; the application should properly handle input and output

What does the example input "' or 1 equals 1--" do in a SQL injection example?

It makes the logical statement 1 equals 1 always true and turns the rest of the statement into a comment

Why does the string "--" matter in the SQL injection example?

It turns the rest of the statement into a comment

Why can the injected query dump a list of all users?

Because 1 equals 1 is always true, making it more likely the web application will parse the modified version and return all users

How does input sanitization help prevent SQL injection?

By removing special characters that can be used to manipulate SQL queries

How do parameterized queries help prevent SQL injection?

User input is treated as data input and not executable code

How do stored procedures help prevent SQL injection?

They use pre-compiled SQL code that is stored on the server

What is the key risk if you can manipulate the database?

Then you control the application