Web security testing using Burp and Firebug STC 2012 - QAI

Web security testing using BurpRepeater (ctd..)When we use the Repeater to submit arequest where the username value is ‘ or ’1′=’1 we get a different error. The error tellsus the password (blank in the request) wesubmitted was incorrect. The XPATH querywill now look something like this://users/user[username=' ' or '1' ='1']/passwordSince we know the user name now, we canbrute force the password using intruder.13ETT | 12/10/2012 | © Robert Bosch Engineering and Business Solutions Limited 2012. All rights reserved, also regarding any disposal,exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.