Summary

In this chapter, we talked about injection attacks for both worlds, SQL and NoSQL, how they can be perpetrated, and the types of damage they can cause on an end system serving an API endpoint. We learned the different types of injection attacks, and we did two exercises, one with crAPI and another with a vulnerable Python application, each one showing how both types of databases can be hit by injecting commands or spurious/unpredicted data. We finished the chapter with a discussion about validating and sanitizing user input, which intends to either remove or at least reduce the success ratio of injection attacks. Code excerpts were also provided so that you could have a taste of how this works on real applications out there.

In the next chapter, we’ll talk about error handling and exception testing. This content is as important as anything else since we’ll see that a badly treated exception or error can disclose valuable information about the API or the application...