What are the main types of injection attacks and how do they differ?
The top split is how the payload reaches its target — 1st order, 2nd order, or lateral. 1st order then splits again by how the results come back: in-band, blind (inferential), or out-of-band.
* Injection taxonomy — 1st order / 2nd order / lateral at the top; only 1st order splits again into in-band, blind and out-of-band. *
The classification is a two-level tree, not three independent axes. The first level asks how the payload gets to its target:
| Top-level family | What it means |
|---|---|
| 1st order | The payload fires immediately, on the very system it was sent to |
| 2nd order | The payload is stored harmlessly first, then executes later — often on a different system or in a different user's context |
| Lateral | The damage comes from shifting or transforming one datatype's representation into another (e.g. a value converted between types along the way) |
Only 1st order splits further, and it splits by how the attacker gets the answer back:
| 1st-order subtype | How results reach the attacker | Sub-methods |
|---|---|---|
| In-band | Straight back through the same channel used to attack | WHERE-clause tampering, UNION query |
| Inferential (blind) | Nothing comes back — differing responses reveal the answer bit by bit | conditional, time-based, error-based |
| Out-of-band | Through a different channel, e.g. an email or a DNS lookup | — |
Why the tree matters: it tells you where to look. In-band attacks show up in the response body, so response inspection catches them; blind attacks leave nothing to read and need behavioural or timing analysis; out-of-band ones only surface in outbound traffic (mail, DNS) — a response-only monitor never sees them at all. And 2nd order is the reason encoding at output time is non-negotiable: input that looked harmless going in becomes dangerous coming back out.