SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 35
Figure 2.2 Burp Suite Intercepting a POST Request
Figure 2.2 shows Burp Suite intercepting a POST request and allowing the user to
modify the fields. The request has been intercepted by the proxy and the user can make
arbitrary changes to the content. Once finished the user should click the forward button
and the modified request will be sent to the server.
Later, in “Confirming SQL Injection,” we will discuss the kind of content that can be
injected into the parameters to trigger SQL injection vulnerabilities.
Other Injectable Data
Most applications retrieve data from GET or POST parameters. However, other parts of the
HTTP request might trigger SQL injection vulnerabilities.
Cookies are a good example. Cookies are sent to the user’s browser and they are
automatically sent back to the server in each request. Cookies are usually used for authentication,
session control, and maintaining specific information about the user, such as preferences in the
Web site. As explained before, you have full control of the content sent to the server and so
you should consider cookies as a valid form of user data entry, and therefore, as being susceptible
to injection.