SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 89
Paros Proxy also has a built-in Web crawler, called a spider. You just have to right-click one of
the domains displayed on the Sites tab and click Spider. You can also specify a folder where the
crawling process will be executed. When you click Start Paros will begin the crawling process.
Now you should have all the discovered files under the domain name on the Sites tab.
You just need to select the domain you want to test and click Analyse | Scan. Figure 2.21
shows the execution of a scan against Victim Inc.’s Web site.
Figure 2.21 Paros Proxy
The identified security issues are displayed in the lower pane under the Alerts tab.
Paros Proxy tests GET and POST requests. Moreover, it supports blind SQL injection
discovery, which makes it a good candidate among the free software alternatives.
Table 2.11 shows a list of the testing strings the tool uses.