From the course: CompTIA SecurityX (CAS-005) Cert Prep

Unlock this course with a free trial

Join today to access over 24,300 courses taught by industry experts.

Injection attacks

Injection attacks

From the course: CompTIA SecurityX (CAS-005) Cert Prep

Start my 1-month free trial Buy for my team

Injection attacks

“

- Okay, in this lesson we're going to look at injection attacks and there's quite a few. This one we're going to look at is a classic. So this is SQL injection, so this is SQLi, SQL injection. So over here, here's our attacker and here's our friendly end user using their favorite browser. Okay, so the attacker is going to inject a script onto the vulnerable web server. How would they discover it's a vulnerable server? They could use something like Burp Suite, Owasp ZAP, other tools that we would use for, you know, benign purposes. They can use other types of kits and scanning tools to find this poorly deployed server. Now this part particular server is going to be using SQL on the backend, okay, for its database to store everything in it, to store content, to store hashed passwords for credentials, all that type of thing. So they're going to inject the script into the web server, which is then communicating on the backend with the SQL server. Now, one thing we could do right off the…

Contents