Find the interpreters in your own architecture

short · 50 min · Objective 4.2

Task

Run the four-question pass over an application you can read, locating the injection class from the design rather than from a scanner.

Steps

  1. Write lab/input-paths.csv with header entry_point,untrusted,interpreter,separation,blast_radius.
  2. Enumerate every entry point where untrusted input enters, INCLUDING data read back from your own store that was originally user-supplied.
  3. For each, name the interpreter it reaches -- database engine, shell, template engine, parser, deserialiser, browser -- or none.
  4. For each that reaches one, record what separates instruction from data: parameterised, argument_array, contextual_encoding, schema, or validation_only. A validation_only row is an outstanding question, not a fix.
  5. Record the blast radius: the identity the interpreter runs as and what it can reach. Then narrow ONE over-broad identity for real.

Verify

awk -F, 'NR>1 {n++} END {print n" entry point(s)"}' lab/input-paths.csv
awk -F, 'NR>1 && $2=="yes" {n++} END {print n+0" untrusted"}' lab/input-paths.csv
awk -F, 'NR>1 && $4=="validation_only" {n++} END {print n+0" mitigated but not fixed"}' lab/input-paths.csv
awk -F, 'NR>1 {print $3}' lab/input-paths.csv | sort -u | wc -l

Five or more entry points, at least two distinct interpreters, and the validation-only count stated. If no entry point reads data back from your own store, you have missed the path that produces stored cross-site scripting -- output treated as trusted because it came from the database.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.