07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening • Git, System Design & Web Security (OWASP Top 10) • Rishabh Ki Kaksha

Git, System Design & Web Security (OWASP Top 10) › 07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening

45 mins

← Prev Next →

Course Syllabus

Module 1: Git Internals, Plumbing Commands & DAG Graph Architecture

01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree) 03. Git Three Trees Architecture: Working Directory, Staging Index & HEAD

Part 1: Git Mastery, Security Defense & Caching

Module 2: Advanced Branching Strategies & Disaster Recovery

04. Advanced Rebasing: Interactive Rebase (squash, edit, fixup) vs Merge 05. Git Disaster Recovery: git reflog, Cherry-Pick & Recovering Deleted Commits/Branches 06. Enterprise Branching: Trunk-Based Development vs GitFlow vs Feature Flag Architecture

Module 3: Web Application Security: OWASP Top 10 Defenses

07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

Module 4: Cryptography, PKI, SSL/TLS & Mutual Auth (mTLS)

11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys 12. Public Key Infrastructure (PKI), TLS 1.3 Handshake & Let's Encrypt Automation 13. Mutual TLS (mTLS) for Zero-Trust Service-to-Service Communication

Module 5: DevSecOps, Secret Scanning & Zero-Trust Security Architecture

14. Automated Secret Scanning (Gitleaks, Trufflehog) & Git Pre-Commit Hooks 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Interactive Lesson Studio

# 07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening

> Git & Web Security Notes by Rishabh - Topic 07

---

### 1. SQL Injection (SQLi) & Parameterized Defense 💉

Attacker input me SQL control characters (`' OR '1'='1`) inject karke authentication bypass ya database dump chura leta hai.

```typescript
// ❌ VULNERABLE TO SQLi (String Concatenation):
const query = `SELECT * FROM users WHERE email = '${req.body.email}' AND password = '${req.body.password}'`;

// ✅ BULLETPROOF DEFENSE: Parameterized Prepared Statements!
const query = "SELECT * FROM users WHERE email = $1 AND password = $2";
await pool.query(query, [req.body.email, hashedPassword]);
```

---

### 2. Server-Side Request Forgery (SSRF) & Cloud Metadata Theft ☁️

Attacker server ko trick karta hai ki wo server ke internal private network (e.g. AWS EC2 Metadata `http://169.254.169.254/latest/meta-data/iam/security-credentials/`) par request bhejkar cloud IAM keys leak kare!

```typescript
// ❌ VULNERABLE SSRF:
app.post("/fetch-avatar", async (req, res) => {
    const response = await fetch(req.body.avatarUrl); // Attacker passes: http://169.254.169.254/...
});

// ✅ SSRF HARDENING PIPELINE:
import ipaddr from "ipaddr.js";
import dns from "dns/promises";

async function isSafeUrl(urlString: string): Promise<boolean> {
    const url = new URL(urlString);
    if (!["http:", "https:"].includes(url.protocol)) return false;

// Resolve domain to IP:
    const addresses = await dns.lookup(url.hostname, { all: true });
    for (const addr of addresses) {
        const ip = ipaddr.parse(addr.address);
        // Block private/loopback/cloud metadata ranges (127.0.0.1, 10.x, 192.168.x, 169.254.x):
        if (ip.range() !== "unicast") {
            return false; // 🚫 REJECT PRIVATE / INTERNAL IP!
        }
    }
    return true;
}
```

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **AWS IMDSv2 (Instance Metadata Service v2) SSRF se kaise bachata hai?** -> IMDSv2 me `PUT` request ke sath `X-aws-ec2-metadata-token` session token lena mandatory hota hai, jo standard SSRF payloads bypass nahi kar pate.
2. **Blind SQL Injection kya hoti hai?** -> Jab error messages browser me visible na hon, lekin attacker Time Delays (`pg_sleep(5)`) ya Boolean true/false responses observe karke bit-by-bit database dump karta hai.
3. **NoSQL Injection (MongoDB) kaise execute hoti hai?** -> `req.body.password = { "$ne": "wrong" }` pass karke `$ne` (not equal) operator se authentication bypass karna (`express-mongo-sanitize` prevents this).

---
**Next Topic:** 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP)

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track