I85PREP
⌘ K
CWICP study materials
CWICP study resources

CWICP: Input Validation and Injection Testing

CWICP · Work through your exam, one topic at a time.

All guide sections

Input Validation and Injection Testing

Injection remains the highest-impact class in web assessments. The exam tests whether you can identify the sink, choose a detection technique that survives filtering, prove impact without damaging data, and name the correct root-cause fix rather than a blacklist.

Classes and signatures

  • SQL injection. Error-based, boolean-based, UNION-based, time-based, and second-order (stored then concatenated elsewhere). Confirm with a logical differential before exploiting.
  • NoSQL injection. JSON operator injection ({"$ne":null}, {"$gt":""}) and $where JavaScript execution in MongoDB; also parameter-form types like user[$ne]=x.
  • Command injection. Shell metacharacters ; | & $() `` `` and newline in arguments passed to system, exec, or image/PDF tooling; blind variants need out-of-band callbacks.
  • SSTI. {{7*7}}, ${7*7}, <%= 7*7 %> per engine; Twig, Jinja2, Freemarker and Velocity have distinct escalation paths - fingerprint before payloading.
  • XXE. External entity and parameter entity expansion in XML parsers, including hidden parsers inside SVG, DOCX/XLSX, SAML, and SOAP.
  • SSRF. Server-side fetches of user URLs - reach internal RFC1918 ranges, 169.254.169.254 metadata, and cloud APIs; filter bypass via decimal/hex IPs, DNS rebinding, redirects.
  • Deserialization, LDAP, XPath, template-driven email, log injection.

Worked example

A search field returns results for widget. Send widget' AND '1'='1 → results returned; widget' AND '1'='2 → empty page with the same layout. Reasoning: the identical layout rules out content-based coincidence, so the parameter is concatenated into a SQL string. Determine column count with ORDER BY n until error, then UNION SELECT matching types to extract version() and the current user. Impact: database read access as the application user; fix is parameterized queries, not escaping and not a WAF rule.

Traps that cost marks

  • Testing a numeric parameter with quote-based payloads only; numeric context needs AND 1=1 style logic.
  • Concluding "no injection" because the WAF returned 403 - that is a filter result, not a parser result.
  • Escaping APIs used incorrectly: mysql_real_escape_string fails under a non-matching charset or numeric context.
  • Missing second-order injection where input is stored cleanly and concatenated later.
  • Destructive payloads (DROP, xp_cmdshell) on production without written authorization.