CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
Besides SQL injection, which type of injection attack targets the operating system through a web application?
- A.A. HTML injection
- B.B. OS command injection
- C.C. CSS injection
- D.D. Header injection
Why B is correct
OS command injection occurs when user input is passed to system shell commands. For example, a web app using 'ping ' + userInput could be exploited with '; cat /etc/passwd'. Prevention: avoid calling OS commands from web apps, use language APIs instead, and if unavoidable, use strict allowlisting and parameterized command execution.
Know someone studying for Security Fundamentals? Send them this one.