Injection beyond SQL: command, template, NoSQL, LDAP and header
You recognise where data turns into code in OS commands, template engines, NoSQL, LDAP and HTTP headers, and apply the safe API, the fix and a detection rule for each.
Level 301 · 18 lessons · 15 practice labs
Lessons
OS commands
- Command injection in code: system, exec and shell=True
- Recognising blind command injection through timing and output redirection
- Argument injection: danger even without a shell
- Safe APIs: argument lists and shell-free calls
- Short task: close the command injection in a network diagnostics page
Template injection
- How template injection happens: rendering input as a template
- Identifying the template engine: Jinja2, Twig and Freemarker
- Expression language injection: Spring EL and OGNL
- The fix: fixed templates, sandboxes and logic-less templates
- Short task: evidence and close the SSTI in an e-mail template feature
NoSQL, LDAP and XPath
- NoSQL operator injection: $ne, $gt and $where
- LDAP and XPath injection: input mixed into filter and query strings
- Short task: close the injection in three query languages
Header and log injection
- CRLF injection: response splitting and header insertion
- Trusting the Host header: poisoned password reset links
- E-mail header injection: bulk mail from a contact form
- Log injection: forged log lines and XSS in log viewers
- Capstone: find and close five injection types in an admin panel and write detection rules
Practice labs
- shell=True in a network diagnostics page: Prove the shell=True call in a Python network diagnostics page leads to injection and change it to an argument list.
- Argument injection without a shell: Show that input starting with a dash adds options to the tool even without a shell and add -- and input validation.
- Confirm blind command injection by output redirection: Confirm command injection in a report builder with no output by a file written inside the lab and fix the code.
- Which template engine: Jinja2 or Twig: Identify the template engine on two lab pages with harmless expressions and find where user input is rendered as a template.
- SSTI in an email template editor: Prove expressions can be run in an email template the admin edits and move it to a sandboxed environment.
- Expression language injection with Spring EL: Find expression language input evaluated in an error message and fix it so the message is built without evaluation.
- Moving to a logic-less template: Move the feature where users write their own notification text to a logic-less template engine and prove the old flaw is closed.
- A login bypassed with $ne: Prove the MongoDB login query accepts operators and add validation that forces the input type.
- An asterisk in an LDAP filter: Show input mixed into an LDAP filter in the staff search dumps the whole directory and escape special characters.
- Server-side JavaScript through $where: Prove user input is executed in a query that uses $where and rewrite the query without the operator.
- An authentication bypass in an XPath query: Prove the injection in a login that checks an XML user store with XPath and fix it with parameterised XPath.
- A reset link poisoned through the Host header: Prove the link in the reset email is built from the Host header and take the domain from configuration.
- Adding a header to the response with CRLF: Show CRLF characters in a redirect parameter add a new header and validate header values.
- Bulk email from a contact form: Prove extra recipients can be added through lines in the subject field and switch to the mail library's safe API.
- Fake lines and XSS in a log viewer: Prove user input adds fake lines to the log and turns into XSS in the admin viewer and fix it in both places.
About this course
You recognise where data turns into code in OS commands, template engines, NoSQL, LDAP and HTTP headers, and apply the safe API, the fix and a detection rule for each.
What you will learn
- OS commands
- Template injection
- NoSQL, LDAP and XPath
- Header and log injection
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.