Vulnerability A1: Injection
Remember to get the OWASP Proactive Controls for Developers:
https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf
Practice and Process
Open a browser tab to:
https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
Once you are there, do a search in the page to highlight all occurrences of injection. Scroll down to the HTML and CSS injections. Open and read those sections.
See this video on HTML injection:
https://www.youtube.com/watch?v=0M711nyRgn0
And this one from one of my favorite channels, HackerSploit:
https://www.youtube.com/watch?v=RoaL_ugswto
Scroll up to the SQL and Code injection links.
See HackerSploit again:
https://www.youtube.com/watch?v=rapaRJDO3vA
Use the video above to practice on bWAPP.
And:
https://www.youtube.com/watch?v=3ZFblGx5v94
which will also introduce you to sqlmap.
Finally: see the OWASP Guide:
https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)
SQL Parameter Injection
Get this cheat sheet on query parameterization:
https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html
The cheat sheet above has code examples for several languages, not including Python. For a good Python tutorial in this area see:
https://pynative.com/python-mysql-execute-parameterized-query-using-prepared-statement/
Use the code examples above to practice in Python.
Practice SQL injection on any target below.
Find a Python site to practice on.
Targets for Testing the OWASP Top 10 Vulnerabilities
Root-me.org
https://www.root-me.org/en/Challenges/Web-Client/
HackThisSite
https://www.hackthissite.org/
Mutillidae (included in Metasploitable2)
DVWA: Damn Vulnerable Web App
bWAPP:
https://sourceforge.net/projects/bwapp/files/bee-box/