Other Injection Families Concepts
A05: command/LDAP/template/header — no packs.
Visual · other_injection_families
Other injection families: Same idea — untrusted data becomes interpreter syntax. Concepts only. No exploit packs. No LAN hydra.
SQL and XSS are not the only interpreters you can accidentally program.
OWASP Top 10:2025 A05 covers injection broadly: whenever untrusted input reaches an interpreter (shell, LDAP, template engine, expression language, log/header parsers) without separation, attackers reshape commands. Goals vary: RCE-shaped outcomes, auth bypass in directories, SSTI, log forging — still unauthorized if aimed at systems you do not own. This is ORIGINAL Cyberlium teaching — name families and shipping habits.
1. Shared mechanism: data crosses into a command language
Each family has an interpreter. Concatenation or unsafe formatting is the recurring bug. Fix pattern: avoid the interpreter when possible; use parameterized/safe APIs; allowlist; escape only when you must and know the context. Attacker goal: change interpreter meaning.
2. OS command and similar process injection — named, not a shell kit
Passing user strings to system()/bash -c is a classic failure. Prefer argv arrays without a shell, or avoid shelling out. Do not practice with live reverse shells. Literacy: “never build shell strings from users.”
3. LDAP, templates, headers/logs
LDAP filter injection abuses directory query syntax. Template injection (SSTI) abuses server-side rendering languages. CRLF/header injection can split HTTP responses or forge log lines. Name them in notes. Fixes: allowlist, safe template autoescape, reject CR/LF in header values. No payload packs here.
4. Shipping list across families
Prefer libraries that separate code and data. Allowlist known-good tokens. Least privilege for interpreters. Test with adversarial strings on apps YOU own in labs — not production strangers. Log safely without executing logs.
5. What you record
Date (UTC). Identify banner of DEMO (or STOP if router). Families named: command, LDAP, template, header/log. Shared fix idea. Ethics refuse exploit packs, hydra/nmap LAN. Path: $HOME/cyberlium-lab/a05-other-injection-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.
6. Wrong vs right: exploit packs vs naming + habits
Worked failure — same family names, opposite homework.
- Wrong: Shell metacharacter packs against strangers. SSTI exploit kits on foreign apps. Hydra 192.168.0.1. Skip allowlists.
- Right: curl -I DEMO (STOP if router); name families and safe APIs; lock notes. Next: Lab — Parameterize and Escape Locally.
Identify DEMO, fill concept notes. No network exploitation.
Mission: a05-other-injection-notes.txt (mode 600)
1) curl -sS -I http://192.168.0.1/ —2) Name command, LDAP, template, header/log injection; write shared mechanism and ship habits. 3) Fill $HOME/cyberlium-lab/a05-other-injection-notes.txt, chmod 600. No exploit packs.
Stuck? Ask Cyberlium AI Mentor
If “families only count with RCE demos” still feels true, ask for a hint — not a shell kit. Try: "Hint only: shared injection mechanism across interpreters, why a router banner means STOP, and where locked a05-other-injection-notes.txt lives?"
You can name other A05 injection families and the shared “data becomes syntax” pattern without running foreign exploit packs. Original Cyberlium — not official OWASP certification. Next — Lab — Parameterize and Escape Locally.
APPLY: User input is passed to bash -c. What family and fix direction?
APPLY: True or False: SSTI exploit kits against random sites are Cyberlium A05 homework.
APPLY: curl http://192.168.0.1/ shows Huawei Router Admin. What do you do?