Loading…
MITRE ATT&CK-based attack techniques — Exploit · Prevention · Detection
2 techniques · initial access
Clear filters ×A comprehensive technical analysis of web application attack classes covered by OWASP Top 10 2021; covers XSS, SSRF, IDOR/Broken Access Control, insecure deserialization, CSRF, XXE, command injection, path traversal, and web shell techniques through the exploit/POC, detection, and prevention triad.
SQL injection (CWE-89) originates from embedding user input directly into an SQL query; an attacker can modify the query structure to exfiltrate data, bypass authentication, and under certain conditions execute operating system commands. This article covers UNION-based, error-based, boolean/time-based blind, and OOB classes with DBMS-specific syntax and sqlmap usage; provides WAF log patterns and a Sigma rule for detection; and gives parameterized queries, least privilege, and allowlisting for prevention.
