SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 33
The values sent to the Web server have the same format explained for the GET request,
but are now located at the bottom of the request.
No t e
Keep one thing in mind: It doesn’t matter how this data is presented to you
in the browser. Some of the values might be hidden fields within the form,
and others might be drop-down fields with a set of choices; you may have
size limits, or even disabled fields.
Remember that all of this is just client-side functionality, and you have
full control of what you send to the server. Do not think of client-side
interface mechanisms as security functionality.
You may be wondering how you modify data if the browser is not allowing you to do
so. There are a couple of ways to do this:
■■
■■
Browser modification extensions
Proxy servers
Browser modification extensions are plug-ins that run on your browser and allow you to
perform some additional functionality. For example, the Web Developer (https://addons.mozilla.
org/en-US/firefox/addon/60) extension for Mozilla Firefox allows you to visualize hidden
fields, remove size limitations, and convert select fields into input fields, among other tasks.
This can be very useful when trying to manipulate data sent to the server. Tamper Data
(https://addons.mozilla.org/en-US/firefox/addon/966) is another interesting extension available
for Firefox. You can use Tamper Data to view and modify headers and POST parameters in
HTTP and HTTPS requests. Another option is SQL Inject Me (https://addons.mozilla.org/
en-US/firefox/addon/7597). This tool sends database escape strings through the form fields
found in the HTML page.
The second solution is the use of a local proxy. A local proxy is a piece of software that
sits between your browser and the server, as shown in Figure 2.1. The software runs locally
on your computer; however, the figure shows a logical representation of a local proxy setup.