the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 827
7.1.10 After you have configured Burp Intruder to perform a fuzz test of a single
request, you can quickly repeat the same test on other requests within
the application. Simply select each target request within Burp Proxy and
choose the Send to Intruder option. Then immediately launch the attack
within Intruder using the existing attack configuration. In this way, you
can launch a large number of tests simultaneously in separate windows
and manually review the results as each test completes its work.
7.1.11 If your mapping exercises identified any out-of-band input channels
whereby user-controllable input can be introduced into the application’s
processing, you should perform a similar fuzzing exercise on these input
channels. Submit various crafted data designed to trigger common vulnerabilities
when processed within the web application. Depending on
the nature of the input channel, you may need to create a custom script
or other harness for this purpose.
7.1.12 In addition to your own fuzzing of application requests, if you have access
to an automated web application vulnerability scanner, you should run
it against the target application to provide a basis for comparison with
your own findings.
7.2 Test for SQL Injection
7.2.1 If the SQL attack strings listed in step 7.1.3 result in any anomalous
responses, probe the application’s handling of the relevant parameter
manually to determine whether a SQL injection vulnerability is present.
7.2.2 If any database error messages were returned, investigate their meaning.
Use the section “SQL Syntax and Error Reference” in Chapter 9 to help
interpret error messages on some common database platforms.
7.2.3 If submitting a single quotation mark in the parameter causes an error
or other anomalous behavior, submit two single quotation marks. If this
input causes the error or anomalous behavior to disappear, the application
is probably vulnerable to SQL injection.
7.2.4 Try using common SQL string concatenator functions to construct a string
that is equivalent to some benign input. If this causes the same response
as the original benign input, the application is probably vulnerable. For
example, if the original input is the expression FOO, you can perform
this test using the following items (in the third example, note the space
between the two quotes):
‘||’FOO
‘+’FOO
‘ ‘FOO