0

I [itsec novice] am developing a workflow/application for identifying potential SQL injection vulnerabilities in web applications and would like to get some professional opinions on my approach.

Roughly my approch is

  • Step 1: Identifying potential vulnerabilities
  • Step 2: Exploiting/Verifying them via sqlmap

First question (regarding existing tools):

Considering speed, would you recommend to use existing applications like sqlmap? It feels like there is much overhead when scanning with sqlmap, but I didn't try out every switch. What do you think? My assumption is that a own application would be faster, but is this true and is there a rule like "do not roll your own" like for encryption?

Second question (regarding vuln identification):

Currently I am thinking of two ways to identify entry points. Both of them are applied to GET&POST parameters, cookies and HTTP header values.

  1. Appending ' to the parameter value (and encoded variants) and checking for SQL errors or differences in the rendered page
  2. Appending a true/false condition (with/without encoding and commenting characters) and check if the rendered pages differ

Are there any other ways which I should implement or should these two ways identify most vulnerabilities?

2
  • As you have the source code: do a code review and check all variable that are incorporated in a SQL statement whether its value is properly handled (e. g., parameterized using prepared statement, properly escaped/quoted, etc.).
    – Gumbo
    Dec 25, 2014 at 22:35
  • Code analysis is a very good idea, didn't even think of this yet. Thanks.
    – saxum
    Dec 27, 2014 at 18:56

1 Answer 1

1

It's easier to use the tools that the attacker might try to figure out the holes. This is the lowest hanging fruit that you can do to ensure your application is safe.

Not the answer you're looking for? Browse other questions tagged .