TEST FOR SQL INJECTION TOOL MANUAL

Sometimes, web applications implement client side validation for form input fields, which could be easily bypassed using a proxy tool. Use of Proxy tool (Eg: Burp) to find SQL injection: Response: additional data got retrieved successfully USERID SELECT * FROM user_data WHERE last_name = вЂYour Name вЂ or вЂ1вЂ™=вЂ™1вЂІвЂ“вЂ Unexpected end of command in statement Successful Attack: We may have to modify our injection to launch successful attack. Response: The error message indicates that our injection reached the database. SELECT * FROM user_data WHERE last_name = вЂYour Name вЂ or вЂ1вЂ™=1вЂІ

TEST FOR SQL INJECTION TOOL MANUAL

This is the reason why manual penetration testing is required in addition to automated scan to perform comprehensive security testing. Most of the times, a successful SQL injection in your application will be based on your application implementation, all SQL injection attack vectors available on the internet may fail for your application, but still your application parameter could be vulnerable to SQLi through a customized and new attack vector. Proceeding intelligently basing on the error messages will yield results quickly rather than trying all the available SQL injection attack vectors. Try to guess the database (Oracle or SQL Server or DB2) from the error messages and try various attack vectors basing on the application response to confirm whether a parameter is vulnerable to SQL injection or not.

An application page without any error (may be a successful SQL injection attack).

A custom application error message with no clues whether our injection has reached the database or not (need to probe further to confirm if SQLi exists or not).

An application error with traces of Database error (may be vulnerable to SQLi).

A database error message like вЂњ ORA-00923: FROM keyword not found where expectedвЂќ (may be vulnerable to SQLi, but we need to dig further to launch a successful attack).

An error message saying invalid characters are entered (may or may not be vulnerable to SQLi).

When an SQL injection is attempted, the application may respond in one of the following ways.

For examples of SQLI attack vectors, see the SQL Injection Attack VectorsВ article. URL parameters and parameters in user entry forms can be tested from the browser. These are the parameters that need to be tested for SQL injection. The first step for testing SQL injection vulnerability is to identify parameters whose values are sent to database. Manual Penetration Testing of SQL Injection:

Test for sql injection tool