PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Down the OWASP Top 10: Injection

hackerone.com | blog | #xss | #injection | #ssti | #command-injection | #sqli | #owasp-top-10 | #directory-traversal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A walkthrough of OWASP Top 10 injection attacks - reflected and stored XSS, SQLi, SSTI, CRLF, header and command injection, and directory traversal - with concrete exploitation examples.
Published
Collected

Related coverage

blog · netspi.com
AppSec Experts React to the OWASP Top 10 2021
AppSec experts react to the OWASP Top 10 2021: Broken Access Control takes the top spot, Injection falls to third, and Insecure Design, SSRF, and cloud adoption reshape AppSec risk priorities.
blog · hackerone.com
Pentesting for Web Applications
HackerOne outlines its PTaaS web pentesting methodology based on OWASP Top 10 and PTES, covering common vulnerabilities like injection, XSS, SQLi, and IDOR, plus remediation best practices.
blog · hackerone.com
How to Catch Injection Security Vulnerabilities in Code Review
XSS, SQL injection, and path control flaws stem from unvalidated input. The guide shows how to spot missing validation and sanitization during code review, where automated scanners often fall short.
blog · hackerone.com
Hacking the Singapore Government: Q&A with Hacker Personality Samuel Eng
Interview with Samuel Eng (@samengmg), a self-taught Singaporean hacker and GovTech top performer who favors server-side bugs like SSRF and SSTI, recalling a PDF-generator SSRF with WAF bypass.
blog · portswigger.net
Gartner continues to recognize PortSwigger as a Challenger for AST in 2015
Gartner's 2015 Magic Quadrant for Application Security Testing places PortSwigger as a Challenger for the second year, with Stuttard highlighting Burp Collaborator and new SSTI and PRSSI checks.
blog · bishopfox.com
(In)Secure by Design
Starting from the OWASP Top 10's new Insecure Design category, this post explains why issues like injection keep recurring and how secure design patterns and threat modeling address root causes.
Back