SQL Injection Attacks and Defense - 2009

34 Chapter 2 • Testing for SQL Injection
Figure 2.1 Proxy Intercepting Requests to the Web Server
Figure 2.1 shows how you can bypass any client-side restriction by using a proxy server.
The proxy intercepts the request to the server and permits you to modify it at will. To do
this you need only two things:
■■
■■
Installation of a proxy server on your computer
Configuration of your browser to use your proxy server
You can choose from a number of alternatives when installing a proxy for SQL injection
attacks. The most notable ones are Paros Proxy, WebScarab, and Burp Suite, all of which can
intercept traffic and allow you to modify the data sent to the server. Although they have
some differences, deciding which one to use usually depends on your personal choice.
After installing and running the software, you need to check on what port your proxy is
listening. Set up your Web browser to use the proxy and you are ready to go. Depending on
the Web browser of your choice, the settings are situated in a different menu. For instance,
in Mozilla Firefox, click Edit | Preferences | Advanced | Network | Settings.
Firefox extensions such as FoxyProxy (https://addons.mozilla.org/en-US/firefox/
addon/2464) allow you to switch among predefined proxy settings, which can be very useful
and can save you some time.
In Microsoft Internet Explorer, you can access the proxy settings in Tools | Internet
Options | Connections | Lan Settings | Proxy Server.
Once you have your proxy software running and your browser pointing to it, you can
start testing the target Web site and manipulate the parameters sent to the remote application,
as shown in Figure 2.2.