OWASP Top 10 Part 5: Injection Attacks and Real Pen Test War Stories | Ep 199
Show notes
We’re halfway through the OWASP Top 10, and this one is a favorite. Brad Causey is joined by Jordan Natter, SecurIT360’s resident web app pen tester, to cover A05: Injection. They explain how injection flaws work, why it slipped two spots on the list but is no less dangerous, and what developers can do to shut it down.
Along the way, they share real stories from the field. There’s a first-ever pen test that turned a blood drive gift card app into $25,000 in gift cards and a destroyed production database. There’s a harmless-looking hub status dropdown that became a reverse shell. And there’s a username field that handed over session cookies.
In this episode:
- What injection is and why it can happen anywhere from the browser to the data layer
- Reflected, stored, and DOM-based cross-site scripting, and how they differ
- SQL, NoSQL, LDAP, and why no data layer is immune to injection
- Why injection moving to #5 doesn’t make it a lower priority
- How CSP, HttpOnly cookies, CSRF tokens, and SameSite attributes break attack chains
- Why client-side validation is a usability feature, not a security control
- Whitelisting vs. blacklisting, parameterized queries, and output encoding
- The case for never testing in production, and backing up your staging data too
Resources mentioned: OWASP Input Validation Cheat Sheet and the OWASP Cheat Sheet Series
Need a web app pen test or have questions about application security? Reach out to the SecurIT360 team.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com