I have a question I'm hoping you could help me with?
http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&id=193 http://example.com/kb/index.php?cat=8&id=41
Clean url's (the equivalent urls once they have been 'cleaned'):
http://example.com/foo http://example.com/products/2/25 http://example.com/profiles/193 http://example.com/kb/8/41
Explanation of clean/unclean url's here
As you can see in the examples of unclean and clean url's above they obviously differ slightly.
With the unclean url's it would be possible to test for a possible sql injection vulnerabilities by appending an apostrophe (') to the end of the url and so on...
http://example.com/products?category=2&pid=25' and then looking at the response lengths it returns.
I am aware that using clean/rest url's does not make it any less vulnerable to sql injection and is mainly used for SEO, usability and so on (although also making it more difficult for automated sql injection tools) , but how would you go about injecting these types of url and is there a particular, preferred/best method to use?
for example would the following work for injecting clean url's (using an apostrophe)?
and so on... or is there a preferred/better method.
Your help with this question would be much appreciated, many thanks