Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #injection

23 posts

All topics Clear tag filter

Injection --help

Command Injection5 min read

Argument Injection: Hijacking a Command Without a Shell

A value can be safely separated from the shell and still be interpreted as an option by the target program. Learn the parser boundary, a harmless proof, and when validation plus -- closes it.

Injection ; sleep 2

Command Injection5 min read

Blind Command Injection: Proving Execution Through Time and DNS

When a shell runs injected input but discards output, timing and authorized callback evidence can still prove execution. Learn how to separate a real signal from noise and remove the shell boundary.

Client-side & redirects #<img src=x onerror=alert(1)>

Cross-Site Scripting4 min read

DOM-Based XSS: When the Vulnerability Never Touches the Server

DOM-based XSS lives entirely in client-side JavaScript: an attacker-controlled source flows into a dangerous sink with no server round-trip. Here is why WAFs miss it, and how safe sinks and Trusted Types stop it.

Injection CAST('ssec-lab' AS integer)

SQL Injection4 min read

Error-Based SQL Injection: Turning Database Errors Into Data

A verbose database error is not just a stack trace — it is an output channel. Error-based SQLi tricks the database into printing the data you want inside its own error message.

Injection 0||6*7===42

NoSQL Injection4 min read

MongoDB JavaScript Injection: Why $where Must Stay Server-Owned

MongoDB can evaluate JavaScript in legacy query features such as $where. Learn how string construction crosses into code, how to prove it harmlessly, and why MongoDB 8.0 deprecation strengthens the case for removal.

Injection sku[$ne]=

NoSQL Injection4 min read

NoSQL Operator Injection: When a Scalar Field Becomes a Filter

When a parser turns a scalar field into an object, keys such as $ne, $gt and $regex can become MongoDB query logic. Learn both request shapes, a safe proof, and strict schema defenses.

Injection xp_dirtree '\\ssec-lab.assessment.example\x'

SQL Injection5 min read

Out-of-Band SQL Injection: Confirming a Blind Flaw Through DNS

When a response offers no usable signal, a database-initiated DNS or HTTP callback can confirm SQL execution out of band. Learn the prerequisites, safe correlation model, and layered defenses.

Injection quarterly' OR '1'='1' -- -

SQL Injection4 min read

Second-Order SQL Injection: When Stored Input Detonates Later

Some payloads do nothing at the point of entry. They are stored safely, then read back into a second query that builds SQL by concatenation — and that is where they fire.

Injection 1; WAITFOR DELAY '0:0:2' --

SQL Injection4 min read

Stacked Queries: Running Multiple Statements Through One Injection

Stacked-query injection terminates the intended statement and appends another one. Learn why driver protocol and privileges matter, how a harmless delay proves batching, and how to prevent it.