CCNA Web App Injection Attacks Questions

Parameterised queries and prepared statements separate SQL code from user-supplied data, so input is bound as values rather than concatenated into statements. The database never interprets injected text as executable SQL, satisfying the primary defence requirement against SQL injection.

The encoded ../ sequences (%2f is URL-encoded '/') combined with a 200 response of 1845 bytes indicate the readfile() call resolved outside the intended directory and returned /etc/passwd contents. Because only reading occurs and no code executes, this is LFI/path traversal, not remote code execution, and it is constrained to files readable by the www-data account.

The application reflects the user-supplied query parameter 'q' directly into the HTML without sanitization. An attacker can inject a payload like '" onmouseover="alert(1)" to execute code. This vulnerability occurs because the server trusts input and fails to perform context-aware encoding before sending the response to the client browser.

The input `*)(uid=*))(|(uid=*` manipulates the LDAP filter structure, causing the authentication query to match any user. This is classic LDAP injection: unsanitized user input alters the filter logic, allowing the attacker to bypass authentication or enumerate directory objects. The incident handler should recognize this pattern as distinct from SQL injection, even though both involve injection into query languages.

The attacker defined an external entity in the DOCTYPE that pointed to a local file, and the parser resolved it, returning the file's contents. This is the defining behavior of XXE injection. The SOAP endpoint accepted XML and processed the entity without disabling external entity resolution, allowing local file disclosure.

Prepared statements separate SQL code from data, so user input is bound as a parameter and cannot alter query structure. This eliminates the injection point regardless of input content. For the profiles query, the username would be passed via a placeholder, making classic payloads like ' OR '1'='1 ineffective. This is the definitive code-level fix for SQL injection.

The attacker manipulates the Host header so the application embeds the attacker's domain into the password-reset URL. When a victim clicks the link, the reset token is sent to the attacker-controlled server. This matches the observed traffic and the application's behavior of using the Host header for link generation.

Removing sysadmin rights and disabling xp_cmdshell directly stops the observed command-execution path while preserving logs and database state for forensics. This containment is surgical: it addresses the exploited capability without destroying evidence. Capturing logs and state first ensures the analyst retains indicators such as the injected queries and any files created by whoami or subsequent commands.

The payload `{{7*7}}` being evaluated to `49` indicates that user input is being processed as a template expression rather than plain text. This is the hallmark of Server-Side Template Injection. The additional endpoint accepting a template name increases the attack surface, potentially allowing template path traversal or remote code execution depending on the engine. Incident handlers should treat this as a high-severity finding.

Stored XSS payloads reside in the application's back-end storage and are served to every user who accesses the affected page. Reflected XSS payloads are transient, meaning they are processed and immediately reflected back during a single request cycle, requiring a victim to initiate the specific trigger link.

Failing to explicitly whitelist permitted cryptographic algorithms allows clients to specify 'none' in the JWT header. The verification library then bypasses signature checking, treating the unsigned payload as authentic and allowing total session integrity compromise.

The attacker injected MongoDB operators ($ne) into the query parameters. The application likely passed the user input directly into a MongoDB query without sanitization, allowing the attacker to alter the query logic. $ne means 'not equal', so the query returns a user where username is not 'admin' and password is not 'wrong', effectively bypassing authentication.

Shell metacharacters allow attackers to chain multiple commands together in a single execution stream. Observing characters like pipes or semicolons in web server access logs strongly indicates an attempt to break out of intended application logic into the shell.

Reflected XSS occurs when user input is immediately returned by the web application in an error message, search result, or other response without proper encoding. The script executes in the victim's browser when they click the crafted URL. The theft of session cookies is a common impact. This matches the scenario exactly: input reflected into an HTML attribute, script execution, and cookie exfiltration.

Parameterised queries and prepared statements separate SQL code from user-supplied data, so manipulated parameters are treated as values rather than executable syntax. This eliminates the injection vector at its root while preserving full query functionality, unlike input filtering or error suppression.

Failing to disable Document Type Definitions and external entity resolution in XML parsers allows attackers to read local files or trigger out-of-band requests. When combined with specific PHP wrappers, XXE can escalate into direct operating system command execution.

Contextual output encoding transforms sensitive characters into their safe HTML entity equivalents before rendering data in the browser. By applying specific encoding based on where the data is placed—HTML body, attribute, or JavaScript—the application ensures the browser treats data as content rather than executable script code.

Unsanitized user inputs concatenated directly into SQL query strings allow attackers to manipulate execution flow and trigger database errors. Verbose database exceptions outputted to the user interface reveal structural details, making error-based SQL injection the primary suspect for this specific application behavior.

Enabling the HttpOnly attribute instructs browsers to restrict cookie access exclusively to the HTTP protocol. Consequently, malicious JavaScript running inside an exploited browser session cannot read or exfiltrate the session identifier via document.cookie properties during an XSS attack.

The attacker is using ../ sequences to escape the intended base directory and read files outside it, which is classic Path Traversal. The Java code concatenates user input directly onto a base path without canonicalization or a whitelist, so the servlet opens /etc/passwd instead of a permitted file. The presence of root:x:0:0 in responses confirms successful traversal, making Path Traversal the accurate classification.

The policy strictly restricts scripts to the origin and a specific CDN. Inline scripts are not allowed by the policy, so the browser identifies the violation, stops the script from running, and sends a report to the configured CSP reporting endpoint. This protects users from the malicious script execution.

NoSQL injection occurs when user input is not properly sanitized before being included in a NoSQL query. Operators like `$ne` (not equal) and `$gt` (greater than) can alter query logic. For example, injecting `{"$ne": null}` into a password field can bypass authentication by matching any non-null value. This statement correctly identifies the attack type and its root cause.

Java serialization streams begin with the magic bytes AC ED 00 05. Their presence in HTTP request bodies indicates that the application is accepting serialized Java objects from the client. When combined with other suspicious behavior, this is a strong indicator of an insecure deserialization attack attempt, as attackers must deliver a serialized payload to the vulnerable endpoint.

String concatenation allows attackers to inject SQL syntax directly into the final command sent to the database. By using quotes and operators, an attacker can escape the data field and alter the query logic. This is the root cause of most SQL injection vulnerabilities in legacy and poorly written applications.

The application fails to validate the file type and allows a file with a double extension to be stored and executed. The attacker bypasses a naive check for `.jpg` by including `.php` before it. This is a classic Unrestricted File Upload vulnerability, leading to remote code execution. Incident handlers should treat this as a critical finding and review upload validation logic.

Prepared statements separate code and data completely at the database driver level. When parameters are bound correctly, any user-supplied string like a UNION query is treated strictly as literal literal data values, neutralizing injection attempts and protecting backend data assets permanently.

Attackers can craft malicious serialized objects that, when deserialized, trigger a sequence of method calls known as gadget chains. These chains utilize existing application code to perform unintended actions, leading to full remote code execution. This makes it a high-severity risk in applications that accept serialized data from users.

Native language libraries or built-in functions perform the intended task without invoking a shell, eliminating the command interpreter that enables injection. This satisfies the stem's requirement for robust remediation by removing the vulnerable mechanism entirely, rather than filtering or escaping user input.