In this video, you will learn to: describe the nature of various injection attacks and their prevalence on the threat landscape. My name is Dmitriy Beryoza. I am a member of X-force Ethical Hacking Team. A little bit about what we do; we do penetration testing of security products. We test products before they're released to customers. For those who don't know, penetration testing is a type of security testing, where a tester or QA person acts as an attacker, as a hacker. So we use very same techniques and tools as the bad guys out there use to attack customers and products, and that helps us find security holes and we report them to development. They get fixed before the products are released. In these presentations that we do, we show you a lot of examples that we see in real case scenarios out there. Hopefully, with the recommendations that we give, you would be able to both address and prevent security bugs in your software. So let's get started. Injection flaws, if we give a definition, they usually allow attackers relay malicious code through the vulnerable application to another system. Could be operating system, could be a database server, LDAP server, and just pretty much any component that accepts scripting as input. As you can see from this chart, they're fairly common. But what makes them special is that usually they're rated as high issues, top issues, and they're extremely dangerous. In the worst case scenario, they may allow full takeover of the vulnerable system. You may be familiar with OWASP Top 10 list, it's open web application security project. It gives you a list of most common security vulnerabilities that afflict web applications. As you can see from year to year, from previous version in 2013 to the current version in 2017 of the list, injection vulnerabilities are at the very top of the list. They are considered as the most dangerous type of vulnerability out there. There's also SANS Top 25, a list that you may be familiar with. Here you can see it's the same picture. Positions one and two are taken by SQL injection and OS Command injection. There's agreement throughout the industry that these are the most dangerous types of vulnerabilities out there. Injection vulnerabilities, we hear about them in the news constantly. They made possible some of the most dramatic hacks in recent history. The one that you probably heard of last year was Equifax hack, where hackers use this type of vulnerability to leak data of a 150 million US and Canadian citizens. That was truly massive, probably even the fact that some people on this call. Another example is the hack of TalkTalk, which is a British telecom company, records of 157,000 customers were exposed through SQL injection. If you read through news, you see these types of vulnerabilities come up very often and the end result of these types of leaks are lots of customer data being leaked, personal user information being leaked. They're really, really dangerous.