Injection Attacks and Validation Testing

We are starting a new part of the book. So far, you have had an introduction to API security, how we can acquire more data about the target – with the important reconnaissance and information gathering chapter – and learned ways to test both authentication and authorization mechanisms most APIs implement nowadays. Now, it’s time to dive deeper into the waters of attacks. This part starts with injection and validation (or the lack of it) testing.

These kinds of attacks are not new at all, but it’s impressive how often they show up in media headlines around the world, affecting pretty much all kinds and sizes of companies. Hopefully, you already know they are not limited to Structured Query Language (SQL), but if you don’t, that’s perfectly fine, as you will learn about them.

In this chapter, we start with an introduction of what exactly injection attacks are and which kinds of vulnerabilities can...