SQL Injection Attacks and Defense - 2009

32 Chapter 2 • Testing for SQL Injection
Accept: text/xml,application/xml,application/xhtml+xml,
text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
This kind of request sends parameters within the URLs in the following format:
?parameter1=value1&parameter2=value2&parameter3=value3...
In the preceding example, you can see three parameters: text, cat, and num. The remote
application will retrieve the values of the parameters and use them for whatever purpose
they have been designed. For GET requests, you can manipulate the parameters by simply
changing them in your browser’s navigation toolbar. Alternatively, you can also use a proxy
tool, which I’ll explain shortly.
POST Requests
POST is an HTTP method used to send information to the Web server. The action the
server performs is determined by the target URL. This is normally the method used when
you fill in a form in your browser and click the Submit button. Although your browser does
everything for you, this is an example of what is sent to the remote Web server:
POST /contact/index.asp HTTP/1.1
Host:www.victim.com
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.19) Gecko/20081216
Ubuntu/8.04 (hardy) Firefox/2.0.0.19
Accept: text/xml,application/xml,application/xhtml+xml,
text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Referer: http://www.victim.com/contact/index.asp
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
first=John&last=Doe&email=john@doe.com&phone=555123456&title=Mr&country=US&comments=
I%20would%20like%20to%20request%20information