Techniques for bypassing input validation controls in APIs

There are a few techniques that malicious actors employ when bypassing input validation controls in APIs. In this section, we’ll go through a few of those techniques. These techniques can also be employed by red teamers when testing APIs for vulnerabilities. We’ve seen different input validation controls and how you can implement some of them. When not implemented correctly, these controls can lead to vulnerabilities.

SQL injection

The first technique we’ll go through is SQL injection. This technique has been one of the most prevalent techniques in the space for a long time and has been used to exploit many web applications. SQL is a programming language that is specifically used and designed to manage data in relational databases such as MySQL. SQL injection occurs when user-supplied input is not validated or sanitized properly before being included in SQL queries, allowing attackers to inject malicious...