Let us start with the most important part in Web application testing, that is a skill injection.
In this lecture, we learn an overview to what is a skill injection with advanced technology.
Modern society has accomplished many unthinkable goals.
However, as technology develops, so does the risk increases.
Same is the case with Web applications to these applications are fraught with vulnerabilities.
Since 2003, a SQL injection has remained in the Web's top 10 list of application security risks that
companies are wrestling with.
So what is a skill in attack, a skill in addiction, also called a skill eye, is an injection attack
when an attacker executes malicious ESKIL statements to control a Web applications database server,
thereby accessing, modifying and deleting unauthorized data.
In the early days of the Internet, building websites was a simple process, like no JavaScript, no
Sears's and only a few images.
But as the websites gained popularity, the need for more advanced technology and dynamic websites grew.
This led to development of side scripting languages like GSP and HP, we started storing user input
and content in databases like my skill.
My skill became the most popular and standardized language for accessing and manipulating databases.
However, hackers found new ways to leverage the loopholes present in the insecure technology and SQL
injection attack is one of the most popular ways of targeting databases and SQL injection targets.
The databases using specifically crafted SQL statements systems in unexpected and undesired things.
So why is a skill injection so dangerous?
There are a lot of things an attacker can do when exploding, and it's a good indication on a terrible
website.
But leveraging and SQL injection vulnerability, given the right circumstances and attacker can do the
following things like bypass web applications, authorization mechanisms and extract sensitive information
easily.
Control application behavior that is based on the data in the database, inject further malicious code
to be executed using user access applications and modify and delete data, corrupting the database and
making the application unusable.
Enumerate the authentication details of a user registered on the website and use the data in attacks
on other sites.
It all depends on the capability of the attacker, but sometimes and SQL injection can lead to a complete
takeover of the database and web application.
So how does a skill injection attack works?
A developer usually finds in a school query to perform some database action necessary for the application
to function.
This query has one or two arguments so that only desired records are written when the value for the
argument is provided by the user and ESKIL attack plays out in two stages research an attack in the
research phase and I could use some random, unexpected values for the argument, observes how the application
responds.
And besides an attack attempt in the attack phase here, attacker provides carefully crafted value for
the argument.
The application will interpret the value part of an ESKIL come on, rather than merely data.
The database then executes the self-command as modified by the attacker.
In the next video, we will learn different types of skill in addiction attacks.