APPLICATION PENETRATION TEST SUPER VEDA

More documents

Recommendations

Info

Application Penetration Test for Super Veda- Sample Report -getting) and query a different table – the sysobjects. This table holds theentire collection of tables within the database, and has a known columnnames. The query would look like this:http://veda2.imperva.com/showproducts.asp?CatID=1 UNION SELECT 1,name,1,1,'1','1 FROM sysobjectsGiving him the entire list of tables – as requested.Last, he would form a query on the syscolumns table which holds, foreach of the table IDs gotten from sysobjects, the name of all the columnswithin that table:http://veda2.imperva.com/showproducts.asp?CatID=1 UNION SELECT 1,name,1,1,'1','1 FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name='Users')Getting a list of all the column names, including: CCName – the name ofthe column holding the credit card numbers, Password – the name of thecolumn holding the passwords and so forth.ImpervaPage16 of73
Application Penetration Test for Super Veda- Sample Report -With this information he can easily form his finishing query:http://veda2.imperva.com/showproducts.asp?CatID=1 UNION SELECT 1,CCName,1,1,'1','1 FROM UsersGiving the list of all the credit card numbers for each and every user.A demonstration of this can be seen in Appendix A.5.1.2 proddetails.aspSimilar to the showproducts.asp the proddetails.asp gets an id with whichhe queries the products table and returns a formatted description of itsdetails.ImpervaPage17 of73
Page 1 and 2: APPLICATION PENETRATION TESTSUPER V
Page 3 and 4: REFERENCESREF DOCUMENT VERSION DATE
Page 5 and 6: 5.6 Script Injection into User’s
Page 7 and 8: Application Penetration Test for Su
Page 15: Application Penetration Test for Su
Page 67 and 68:
Application Penetration Test for Su
Page 69 and 70:
Page 71 and 72:
Page 73:
show all

APPLICATION PENETRATION TEST SUPER VEDA

Create successful ePaper yourself

Delete template?

Save as template?