Secure › Module 3 › Lesson 3
Injection Shapes
Name injection classes and defend with validate + parameterize — no sqlmap on strangers.
Visual · injection_shapes
Injection defense literacy. validate + parameterize. $MY_REPO only. Original Cyberlium.
Opening
Injection is untrusted data becoming code — your defense is validate early and bind parameters, not sqlmap strangers.
SQL injection, command injection, LDAP injection, and template injection share a shape: attacker-controlled input crosses into an interpreter. Defense is twofold: validate/sanitize at boundaries (allowlists) and never concatenate — use parameterized queries, prepared statements, and safe APIs. Cyberlium teaches naming shapes and fixing YOUR toy app in $MY_REPO — not running sqlmap against café SaaS or live shop search boxes. You will NOT treat injection labs as license to dump exploit strings on production strangers. Next: Validation Lab.
1. Shapes defenders recognize
SQLi: user input in query string. Command injection: shell metacharacters in system calls. XSS is output context (Module 4) but often starts as unvalidated input stored server-side.
On $MY_REPO, grep for string concatenation in SQL or shell calls — refactor one to parameterized API locally.
Command guide
Try these commands — Shapes defenders recognize
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Injection prevention — https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html CWE-89 SQLi — https://cwe.mitre.org/data/definitions/89.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t17-demo"
cat > "$HOME/cyberlium-lab/t17-demo/insecure.py" <<'EOF'
import pickle
def load(data): return pickle.loads(data) # lab anti-pattern
query = f"SELECT * FROM users WHERE id={user_id}" # lab anti-pattern
EOFCommand — copy this
grep -nE 'pickle|eval|f"SELECT' "$HOME/cyberlium-lab/t17-demo/insecure.py"
python3 -c "import ast; ast.parse(open('$HOME/cyberlium-lab/t17-demo/insecure.py').read()); print('parsed — now fix injection patterns')"Primary tools to practice this lesson: grep, python3. Reference sites: Injection prevention (https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html); CWE-89 SQLi (https://cwe.mitre.org/data/definitions/89.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Validate AND parameterize
Validation reduces weird input; parameterization ensures data never becomes syntax. ORM prepared statements and driver bind parameters are the developer fix — not 'escape harder' alone.
Defenders block at WAF as belt; developers fix root cause in code you ship from $MY_REPO.
3. No offensive tooling on stranger URLs
sqlmap, commix, and similar tools against URLs you do not own are out of scope — even 'to learn shapes.' Lab fixes happen on localhost $TOY_APP with your own test cases.
Ship: one concatenation found and parameterized OR documented fix plan. Next: Validation Lab.
4. What you ship: injection fix note for $TOY_APP
Name injection shape found. Parameterize or allowlist fix in $MY_REPO. NEVER sqlmap stranger URLs. chmod 600.
5. What you record before the next lesson
Date. Injection shape and fix approach. File t17-m03-l03-injection-shapes.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
sqlmap a live shop search box. Leave string concat SQL because 'WAF will catch it.'
Right
Document shape and parameterize on $TOY_APP. Next: Validation Lab.
Mission: parameterize one query
1) Find one string-concat SQL or shell call in $MY_REPO (or use lab stub). 2) Refactor to prepared statement or safe API. 3) Test locally only — no stranger URLs. Never sqlmap apps you do not own.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor about prepared statement syntax — not for sqlmap flags on a live site.
Knowledge Check
APPLY: Primary developer defense against SQL injection:
Multiple choice
Knowledge Check
APPLY: True or False: sqlmap against classmate deploy URLs is Cyberlium validation homework.
True or False
Knowledge Check
APPLY: Injection 'shape' means:
Multiple choice