All threats

injection-attack

Attacker injects malicious code that gets executed by the application

MITRE ATT&CK techniques

Common Weakness Enumeration

• CWE-94

Mitigating controls

ctrl-inject-1

Validate and sanitize all user inputs

ctrl-inject-2

Use parameterized queries and prepared statements

ctrl-inject-3

Implement Content Security Policy (CSP)

ctrl-inject-4

Apply output encoding for different contexts

ctrl-inject-5

Use Web Application Firewalls (WAF)

References

• https://owasp.org/Top10/A03_2021-Injection/
• https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html