ZEKASTRA

Threat profile

Injection (SQL and command)

Untrusted input is treated as part of a query or command, so the application runs something its developer never intended.

How it works

If an application builds a database query or an operating-system command by joining strings, input such as a form field can change the structure of that query. The consequence ranges from reading other users' records to deleting data. The cause is mixing data and instructions.

What to look for

  • Database errors shown to visitors.
  • Unusual characters such as quotes and semicolons in logs for fields that should hold plain text.
  • Slow or repeated requests probing the same parameter.

What reduces the risk

  1. Use parameterised queries or an ORM that binds values; never concatenate input into a query.
  2. Validate input on the server against what is expected, and use an allow-list where possible.
  3. Give the application's database account only the rights it needs.
  4. Do not show raw error messages to users; log them privately.

Sources

This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).