Practice
Direct static code injection: similar to code and command injection, but instead of
feeding malicious code into the target application, it injects attack code into a
resource that the application uses. For example, if the target application uses a static file
as the default source for arguments, then direct static code injection would place
attack code in that file (instead of feeding it directly to the target application), so that it is
consumed. Direct static code injection occurs on the server side rather than the client side. (SST
injection, discussed further in this list, is a form of direct static code injection.)
Comments