6 lessons

Injection & Untrusted Input

The same bug in six costumes: data crossing a boundary and being interpreted as instructions — SQL, shell, paths, URLs, serialized objects.

Asset→Threat→Attack Surface→Trust Boundary→Vulnerability→Exploit Path→Impact→Mitigation→Defense in Depth→Residual Risk

Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.

SQL Injection and Parameterization

▶ lab

SQL injection is a boundary failure: user data is concatenated into query syntax and the database interprets it as instructions.

Boundary · Application data → SQL parser

Command Injection

▶ lab

A shell is an interpreter: when user data becomes part of a command string, punctuation can become behavior.

Boundary · Application value → OS shell

Path Traversal

Unsafe path construction lets an identifier escape the directory the developer intended as its boundary.

Boundary · External identifier → local filesystem namespace

Server-Side Request Forgery (SSRF)

▶ lab

A user-controlled URL turns the backend’s network position and credentials into an attacker-controlled capability.

Boundary · Untrusted URL → privileged server network

SSRF Defense in Depth

▶ lab

URL parsing is only one layer; destination policy, DNS/IP checks, redirect handling, egress rules and workload identity constrain the real capability.

Boundary · Fetch service → internal network and internet

Unsafe Deserialization

Untrusted serialized bytes should become validated data, not native objects with executable hooks and surprising behavior.

Boundary · Untrusted bytes → in-memory object behavior