1/6

Various Types of Attacks Evaluation: Code Injections

This material was developed with funding from the National Science Foundation under Grant # DUE 1601612

Next

Restart

Back

SQL Injection

2/6

You visit your favorite team’s website to check the score of the game. You login into your account to use the Javascript enabled web application that allows you to get real time scoring information. Later that day, you receive an email indicating that you have changed your password for that account and that you should contact the website if you didn’t make this change. You know you didn’t make this change. You have been the victim of what kind of code injection attack?

Cross Site Scripting

OS Command Injection

Buffer Overflow

You are working on your computer and you notice it seems to be working very hard and is taking a long time to load an application. You decide to log into the administrator account to investigate what might be going on. You discover that your administrator password no longer works. Further, you discover that new files have been placed into the memory that you didn’t put there, and the memory addressing seems to be affected as well. You know you didn’t make these changes. You have been the victim of what kind of code injection attack?

Loading

3/6

Your website is hosted on your own personal web server. You check you website through your browser and you notice that many users accessing your website seem to have typed unusual items into the forums. That’s weird. Later that day, you attempt to log back into the web server and now your username and password do not work. You know you didn’t make this change. You have been the victim of what kind of code injection attack?

www.mysite.com

4/6

5/6

You receive a letter from your bank that your personal information may have been stolen when their customer database was compromised by an unknown attacker or attackers via their website. Your bank (and by extension you) have been the victim of what kind of code injection attack?

Close

That’s correct! This is an example of cross site scripting because vulnerable Javascript web applications running on websites are often exploited by this type of attack.

is a computer attack in which malicious code is embedded in a poorly-designed application and then passed to the backend database. The malicious data then produces database query results or actions that should never have been executed.

< Click to review each type of code injection.

is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users.

occurs when a program writes more data to the buffer than it is allocated to hold. The extra data can overwrite data values in memory addresses adjacent to the destination buffer unless the program includes sufficient bounds checking. Exploiting a buffer overflow allows an attacker to control or crash the process or to modify its internal variables.

Buffer Overflow

Cross Site Scripting

is an attack in which the goal is execution of commands on the webserver operating system via a vulnerable web application or website. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

6/6

OS Command Injection

Congratulations! You really know your code injection attacks. As a reminder, code injection attacks are a category of attacks where a computer vulnerability is exploited by processing invalid user data. Injection is used by an attacker to introduce code into a vulnerable program and change the course of execution. These four attacks are all types of code injection attacks.

SQL Injection

That’s correct! This is an example of buffer overflow because the computer’s memory addressing being altered and new files inserted into the adjacent memory are characteristics of this type of attack.

That’s correct! This is an example of OS command injection because data can be inputted into forums where attackers can test and execute OS commands if a website is vulnerable to this type of attack.

That’s correct! This is an example of SQL injection because databases connected to websites may be vulnerable to this type of attack.