Input Filtering Attack
Input Filtering Attacks
• Input filtering attacks, often referred to as input
validation attacks, are a type of cyber attack that
exploits vulnerabilities in an application or system by
injecting malicious input.
• These attacks generally target improper handling of
input data, where the system fails to validate, sanitize,
or filter user-provided data properly. Such vulnerabilities
can lead to security issues, such as code execution,
unauthorized access, or data corruption.
Types of input filtering attacks:
1. SQL Injection (SQLi)
SQL Injection occurs when an attacker inserts or manipulates
SQL queries through user input fields that are not properly
sanitized. The attacker can modify the query to execute
arbitrary SQL code, potentially gaining unauthorized access to
the database, retrieving sensitive information, or performing
destructive operations.
Example:
• An attacker inputs '; DROP TABLE users; -- into a login form.
• If the input is not sanitized, it might alter the SQL query to
drop the users table.
Cont..
2. Cross-Site Scripting (XSS)
XSS attacks involve injecting malicious scripts (typically JavaScript)
into web pages viewed by other users. If input fields (such as
comment sections or search bars) allow unfiltered user input, an
attacker can inject scripts that execute in the browser of anyone
who views the page, potentially stealing cookies, session data, or
performing actions on behalf of the user.
Example:
• An attacker submits a comment with a malicious script:
<script>alert('Hacked!');</script>.
• If the input is not sanitized, the script could execute in the
browser of every user who views the comment.
Cont..
3. Command Injection
• Command injection occurs when an attacker provides
malicious input that is executed as part of a system
command. This can happen if the input is passed to a
system shell without proper validation or escaping.
Example:
• In a form where users can specify a file to open, an
attacker might input ; rm -rf / to delete files on the
server.
Cont..
4. Path Traversal
• Path traversal attacks occur when an attacker manipulates user
input in a way that allows them to navigate the file system
outside of the intended directory. If the application uses file
names or paths based on user input without proper sanitization,
an attacker can access sensitive files, such as configuration files
or system files.
Example:
• An attacker submits ../../etc/passwd as an input to read the
system password file.
• If the path is not sanitized, it may lead to unauthorized access to
critical files.
Cont..
5. Buffer Overflow
• Buffer overflow attacks exploit vulnerabilities where an
application does not properly check the size of user
input before copying it into a buffer. The attacker can
overflow the buffer, overwriting adjacent memory,
potentially executing arbitrary code or crashing the
application.
Example:
• An attacker inputs a string longer than the buffer can
handle, causing the application to overwrite important
memory regions (e.g., return addresses) and gain
control over the program
Cont.
6. Denial of Service (DoS) / Resource Exhaustion
Attacks
In these attacks, attackers input specially crafted data to
exhaust system resources, such as memory, CPU, or
database connections, making the system slow,
unresponsive, or unavailable.
• Example:
• Inputting large numbers of records in a form, or sending
specially crafted input to exploit inefficient algorithms,
causing the system to crash or become unresponsive.
Preventing Input Filtering Attacks
• Sanitize and Validate Input: All user input should be
treated as untrusted. Use allow-lists (whitelists) to
ensure only valid input is accepted.
• Escape Output: For XSS and other injection attacks,
ensure user input is properly escaped before being
included in dynamic web pages or system commands.
• Use Prepared Statements and Parameterized
Queries: For SQL injection, always use parameterized
queries or prepared statements rather than constructing
queries with string concatenation.
Cont..
• Limit File Uploads and Paths: When accepting file
uploads or paths, ensure the file names or paths are
validated and restricted to safe locations.
• Use Strong Authentication and Authorization:
Implement strong authentication mechanisms to
prevent unauthorized access via injected input.
• Monitor for Anomalies: Continuously monitor
systems for signs of unusual input or requests that
could indicate an attack.
