TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Injection Attacks
VideoSecurityFree

DEMO: Injection Attacks

Injection attacks occur when malicious input is inserted into application fields to execute unauthorized commands or access restricted data. This content covers the core concept of injection vulnerabilities and demonstrates command injection using a real web application example.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Injection attacks represent one of the most prevalent and dangerous categories of security vulnerabilities, encompassing a wide range of techniques in which an attacker supplies malicious input to cause an application to execute unintended commands or expose unauthorized data. The Common Weakness Enumeration lists injection-related weaknesses under CWE-74 as the top-level class, with numerous subcategories including OS command injection, SQL injection, argument injection, and cross-site scripting, reflecting how broadly this attack surface extends across different application types and contexts. The unifying principle across all of these is the same: attacker-controlled input finds its way into code that is then executed as if it were a legitimate part of the program. A practical demonstration using a deliberately vulnerable web application illustrates how command injection works in practice. The application accepts an IP address from the user and constructs a shell ping command on the server, passing the user-supplied value directly into that command without sanitization. By appending a semicolon followed by additional shell commands, an attacker can chain unauthorized instructions onto the legitimate command, causing the server to return directory listings, file contents, and other sensitive system information through the same interface intended only for ping responses. The back-end code reveals why this succeeds: the user input is concatenated directly into a command string and executed, meaning whatever the attacker types becomes part of the command the server runs. Understanding injection attacks at this conceptual level is foundational for both offensive security testing and defensive application development. Recognizing that any unsanitized input channel is a potential injection vector, whether in a web form, an API parameter, or a database query, is the first step toward building and auditing systems that properly validate, escape, and isolate user-supplied data before it can interact with underlying execution environments.

What you'll learn

What's covered

Injection Attacks

Key terms

Injection Attack
An attack where malicious input is inserted into an application's input fields to execute unauthorized commands or manipulate system behavior.
Common Weakness Enumeration
CWE
Common Weakness Enumeration is a community-developed catalog of software and hardware weaknesses that serves as a common language for describing security flaws, enabling developers and researchers to identify and remediate root causes of vulnerabilities.
SQL Injection
SQLi
An attack that inserts malicious SQL code into a query to manipulate a database.
Command Injection
A type of injection attack where an attacker inserts operating system commands into an input field to execute unauthorized commands on the host system.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.

Topics

Injection Attacks Command Injection Web Application Security Cwe Input Validation Application Security

Transcript

Injection Attacks in the CWE List

Just a reminder that this is for educational and ethical hacking purposes only. This is to protect systems, not to compromise them.

I'm on the Common Weakness Enumeration. What I'm going to do is I'm going to expand all to see all of the list. We're going to do a find for injection. You can see there's 26 references to this, and I'm specifically going to jump down into this section where there's quite a few of them. There's this whole category here. So there's this class of injection, and we see under here special element conject injection, command injection, OS command injection, argument injection, lots of different ones. You will find in here the SQL injection, cross-site scripting. So we see a ton of different types of injections here.

The one that we're just going to take a look at is this top level here, this CWE-74. So I'm going to open this up, and we see that it gives a description about this injection type of an attack.

So the first thing that we can note is that there are a lot of different types of injection attacks. So we're just going to understand the concept of what an injection attack is and take a look at one of the examples. Essentially, in all these cases, somehow we're entering some sort of set of instructions to the computer and then being able to view or change or somehow manipulate things that we shouldn't have access to. And so what this is is we've got lines of code here, and somehow we insert our own lines of code into this, or our own lines of instructions into this, to get what we're looking for out of the computer.

This is really common in like web applications and other areas where we can have some sort of input. When we have an input into the system, then we put our code into this input, and then it will cause some sort of execution of it. Somehow the code that we enter into these fields will get into the code itself and then gets executed as if it's that program.

Command Injection on a Demo Page

I'm on my demo laptop here and I've got a simple web page up. And this web page has this IP address in a field that I can enter in an IP address and hit ping. What's going to happen is it's going to ping that IP address and come back with the response. So we can see it's pinging 8.8.8.8. It pings it twice, so two packets were transmitted, two were received, 0% lost. Simple little program.

Essentially, the command that's being executed on the back end is ping -c, and it's doing it twice. So -c is the count, and it's pinging 8.8.8.8 twice. And so if I hit enter here, this is the response I get, and that's what I'm getting through the website.

But the thing is, I can actually do multiple commands per line. So I'm going to do a semicolon ls and hit enter. So it does the same command, but then it lists out everything in this directory. So I can link these things together. And what I'm seeing here is what's in the root directory.

So I could actually get into, well, what is inside of maybe /etc. So I'm going to do the same ping command, but I'm going to change directories and I'm going to get into /etc, and then we'll do a semicolon and list out what's inside there. So it's chaining these together, and now I have quite a bit of information here.

Well, this website is not constructed right either. So what I can do is I can do a semicolon and then do that same ls command. So then I hit ping, and then it comes up with what else is in this directory. Or if I wanted to chain things together, I could do a cd and then maybe I want to see what's in the root folder here. So I'm going to do, this is going back a directory three times. So then hit ping, and now I can see what's inside the root and what directories are inside the root. So that is how we can utilize doing this command injection, to inject other commands into here that normally I shouldn't execute.

What the Back-End Code Is Doing

If we want to see it on the back end, this is some of the code that makes this happen. It's taking that IP address that you enter in, and then what it does is it inserts that IP address into this command variable right here, and then executes that command variable. So the command that it's executing is the ping -c2 and then your IP address and whatever you entered in. So in this case right here we entered in 8.8.8.8.

So by putting in the semicolon ls, essentially what we've done is we've now executed this command. It's 8.8.8.8 8 col semicolon ls, and then it pumps that out to your site and displays it on the site. So that is the command that's actually being executed on the back end when we do that: the IP address and then semicolon ls.

Here's the attack card on injection attacks, and that is when an attacker is injecting some sort of malicious input into fields on some sort of application, or injecting these inputs into there, and then being able to execute code or some sort of instructions for the computer that they normally wouldn't be able to do. And one of the CWEs for this is CWE-74. It's kind of the overall scoping one.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →