Injection attack
Injection attacks are one of the oldest and most well-known software vulnerabilities. Although originally a common defect in web applications, they are quite frequently encountered in APIs, particularly when an API accepts user-supplied input. We will cover the basics of the main injection attack types. Readers wanting more details on topics including hands-on laboratories are advised to take a look at the Further reading section in this chapter, particularly the PortSwigger resources.
Detecting injection vulnerabilities
The concept of an injection attack is extremely simple: where an API expects input data, inject one of several types of payloads and observe the behavior. For example, by passing JavaScript into a website form, can you force the website to display a message box? If so, you have found a webpage that is vulnerable to XSS attacks.
For APIs, there are numerous locations where inject payloads can be placed:
- Query strings in the URL (for...
