Archive of Blind Custom Error Data Validation Error Error Handling Test Time Based
Errors related to SQL injection attacks.
-
Extracting Information from Custom Errors
Posted in AnomaliesUnderstanding information provided by application errors. Software developers often use error handling and validation mechanisms to prevent the application from crashing when an unexpected event occurs. In those situations custom errors are habitually returned to the user to indicate that something wrong happened (without providing full...
Continue reading this entry → -
Detecting SQL Injection Vulnerabilities from HTTP Errors
Posted in AnomaliesUnderstanding HTTP errors generated by SQL injection attacks. While testing for SQL injection vulnerabilities or attempting to take over a query, the attacker may face different HTTP status codes. Those responses may indicate that the SQL injection partially worked and therefore give precious hints to the tester. This...
Continue reading this entry → -
SQL Injection and Database Errors
Posted in AnomaliesUnderstand and identify database errors. Information leaked by errors, especially database errors, can help an attacker to achieve a successful SQL injection attack. They basically give hints to help crafting an SQL segment that will be correcly integrated in the query. It can also reveal...
Continue reading this entry → -
Using Comments to Simplify SQL Injection
Posted in SQL Injection TechniquesTerminating query with comments to achieve SQL injection. Terminating the query properly is one of the main difficulties an attacker may encounter while testing. Frequently, the problem comes from what follows the integrated user parameter. This SQL segment is part of the query and the malicious input must...
Continue reading this entry → -
SQL Injection Detection
Posted in SQL Injection TestDetect potential SQL injection vulnerabilities. The first step towards achieving a successful SQL injection attack is to detect vulnerabilities. Of course, some tools can automate the process, but it’s better to understand how detection can be done manually. In addition, there are some situations where...
Continue reading this entry →
