0% found this document useful (0 votes)

5 views26 pages

Code Injection

The document discusses code injection, a security vulnerability where attackers insert malicious code into applications, leading to unauthorized code execution, data theft, and system compromise. It highlights common types of code injection, such as SQL injection and Cross-Site Scripting (XSS), and provides examples of notable hacking incidents like GhostShell and RedHack. Additionally, it outlines defense mechanisms to mitigate these threats, including input validation and the use of parameterized statements.

Uploaded by

PaulGary Oca

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

5 views26 pages

Code Injection

Uploaded by

PaulGary Oca

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 26

SHODWE TEAM www.reallygreatsite.

com

CODE
INJECTION
Protecting Our Digital World

Reporters: Palania, Regalado, Mangoda, Muaña,

Oca
SHODWE TEAM www.reallygreatsite.com

WHAT IS CODE
INJECTION?
Definition of Code Injection:
Code injection is a type of security vulnerability that occurs
when an attacker is able to insert or "inject" malicious code
into an application, which is then executed by the
application. This typically happens when an application
improperly handles untrusted input, allowing the attacker’s
input to be treated as executable code. The injected code
can be in various forms, such as SQL queries, shell
commands, or scripts, depending on the nature of the
vulnerability.
SHODWE TEAM www.reallygreatsite.com

CODE INJECTION POSES SEVERAL

SERIOUS THREATS:
1. Unauthorized Code Execution
Nature: The primary threat in code
injection is that it allows attackers to
execute arbitrary code on the target
system
2. Data Theft and Breaches
Nature: Attackers can inject code to
extract sensitive information from
databases or application files.
SHODWE TEAM www.reallygreatsite.com

CODE INJECTION POSES SEVERAL

SERIOUS THREATS:
3. System Compromise
Nature: In some cases, code injection
allows attackers to gain control over
the underlying operating system by
executing shell commands.
SHODWE TEAM www.reallygreatsite.com

COMMON EXAMPLES OF CODE INJECTION:

SQL Injection:
An attacker injects malicious SQL queries into input fields that interact with the database, potentially
allowing them to read, modify, or delete database records.

Command Injection:
The attacker injects operating system commands into an application, which are then executed by the
system, potentially leading to full system compromise.

Cross-Site Scripting (XSS):

The attacker injects malicious scripts into web pages viewed by other users, allowing them to steal session
cookies, deface websites, or redirect users to malicious sites.
CHARACTERISTICS

Features/Characteristics

Impact/Damage
CHARACTERISTICS OF
CODE INJECTION
Exploitation of User Input: Injecting code through text fields,
URLs, etc.
Execution of Arbitrary Code: Allows unauthorized system actions.
Language-Specific: Targets specific environments, like SQL
databases or web browsers.
Bypassing Security: Can circumvent authentication and access
controls.
Common Types: SQL Injection, Command Injection, XSS.
Mitigation: Input validation, prepared statements, least
privilege, and security audits.
CODE INJECTION
FLOWCHART
How big of an impact/damage it can do?

Complete System Takeover: Attackers

can gain full control over the
targeted system. This allows them to
manipulate, steal, or destroy data,
install malware, and create backdoors
for future access
How big of an impact/damage it can do?

Data Theft:
Sensitive information such as
usernames, passwords, and credit card
details can be extracted and sent
back to the attacker.
How big of an impact/damage it can do?

System Disruption:
Attackers can manipulate files,
disrupt system processes, or even
cause a complete system crash.
GHOSTSHELL ATTACK

GHOSTSHELL HACKING COLLECTIVE:

A group of hackers and security

specialist who formed collective in 2012.

The group targeted a range of

organizations globally this includes
government agencies, education
institutions, libraries, and other
miscellaneous site across various
industries.
GHOSTSHELL ATTACK

WHAT HAPPENED?
The GhostShell hacking collective launched a series of large-scale cyber
attacks in 2012 using SQL injection to infiltrate and exploit
vulnerabilities in web applications, they claimed to have stolen 1.6
million accounts and passwords along with other sensitive information from
various high profile organizations.

a post from Team GhostShell in Pastebin

“For those two factors we have prepared a juicy release of 1.6 million
accounts/records from fields such as aerospace, nanotechnology, banking, law,
education, government, military, all kinds of wacky companies & corporations
working for the department of defense, airlines and more.”
GHOSTSHELL ATTACK

WHEN DID IT HAPPEN?

The attack occurred in 2012. As part#ProjectWhiteFox – Freedom of
Information. During a period of hacktivism was on the rise and making
headlines worldwide.

WAS THE CASE SOLVED?

The identities of GhostShell members remain unknown, and no public

resolution or apprehension has been reported. The incident highlighted
significant cybersecurity weaknesses globally.
GHOSTSHELL ATTACK

Founder of GhostShell
GHOSTSHELL ATTACK

TheNextWeb was approached by a man using a generic

Yahoo email address.
GHOSTSHELL ATTACK
@DeadMellox — another pseudonym that had
been tied to GhostShell, but has since been
abandoned.

the founder provided pastebin login that

was confirmed to be legitimate, and was
used by the ghostShell official twitter
account to desseminate leaked info before
its suspension.
REDHACK

REDHACK:

A Turkish hacking collective known for its

activism, operating independently but
often compared to Anonymous.
REDHACK

WHAT HAPPENED?
RedHack discovered and exploited an authentication vulnerability on the
Istanbul Special Provincial Administration’s portal (ioi.gov.tr), using a
basic SQL injection technique. They publicly announced the vulnerability,
encouraged others to exploit it, and reportedly deleted financial
obligations from the portal.

WHEN DID IT HAPPEN?

The incident occurred in June 2013, coinciding with ongoing protests in
Turkey’s capital, Ankara.
REDHACK

WAS THE CASE SOLVED?

The portal was taken offline shortly after the attack, but there is no
public information indicating that the perpetrators were identified or
apprehended, leaving the case unresolved. The attack was part of a broader
wave of protests and digital activism in Turkey at the time.
REDHACK