Secure › Module 3 › Lesson 3
Injection Shapes
Name injection classes and defend with validate + parameterize — no sqlmap on strangers.
Visual · injection_shapes
Injection defense literacy. validate + parameterize. $MY_REPO only. Original Cyberlium.
Opening
Injection is untrusted data becoming code — your defense is validate early and bind parameters, not sqlmap strangers.
SQL injection, command injection, LDAP injection, and template injection share a shape: attacker-controlled input crosses into an interpreter. Defense is twofold: validate/sanitize at boundaries (allowlists) and never concatenate — use parameterized queries, prepared statements, and safe APIs. Cyberlium teaches naming shapes and fixing YOUR toy app in $MY_REPO — not running sqlmap against café SaaS or live shop search boxes. You will NOT treat injection labs as license to dump exploit strings on production strangers. Next: Validation Lab.
1. Shapes defenders recognize
SQLi: user input in query string. Command injection: shell metacharacters in system calls. XSS is output context (Module 4) but often starts as unvalidated input stored server-side.
On $MY_REPO, grep for string concatenation in SQL or shell calls — refactor one to parameterized API locally.
Command guide
Try these commands — Shapes defenders recognize
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: grep, python3. Reference sites: Injection prevention (https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html); CWE-89 SQLi (https://cwe.mitre.org/data/definitions/89.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Validate AND parameterize
Validation reduces weird input; parameterization ensures data never becomes syntax. ORM prepared statements and driver bind parameters are the developer fix — not 'escape harder' alone.
Defenders block at WAF as belt; developers fix root cause in code you ship from $MY_REPO.
3. No offensive tooling on stranger URLs
sqlmap, commix, and similar tools against URLs you do not own are out of scope — even 'to learn shapes.' Lab fixes happen on localhost $TOY_APP with your own test cases.
Ship: one concatenation found and parameterized OR documented fix plan. Next: Validation Lab.
4. What you ship: injection fix note for $TOY_APP
Name injection shape found. Parameterize or allowlist fix in $MY_REPO. NEVER sqlmap stranger URLs. chmod 600.
5. What you record before the next lesson
Date. Injection shape and fix approach. File t17-m03-l03-injection-shapes.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
sqlmap a live shop search box. Leave string concat SQL because 'WAF will catch it.'
Right
Document shape and parameterize on $TOY_APP. Next: Validation Lab.
Mission: parameterize one query
1) Find one string-concat SQL or shell call in $MY_REPO (or use lab stub). 2) Refactor to prepared statement or safe API. 3) Test locally only — no stranger URLs. Never sqlmap apps you do not own.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor about prepared statement syntax — not for sqlmap flags on a live site.
Knowledge Check
APPLY: Primary developer defense against SQL injection:
Multiple choice
Knowledge Check
APPLY: True or False: sqlmap against classmate deploy URLs is Cyberlium validation homework.
True or False
Knowledge Check
APPLY: Injection 'shape' means:
Multiple choice