Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits?
If so, when black-box testing a house made web application, is the difference between vulnerability identification and exploitation the pentester's intent? For instance for SQL injections, in the first case the pentester wants to identify the vulnerability, and in the second case he/she wants to retrieve the records in the database?
When you do a penetration test, you do not want (usually) to break your target. This is why you must choose the payload of your attack (what will be sent to the target service) so that it shows you that a vulnerability exists but without breaking anything.
The examples you show are typical in the vulnerability analysis part of a pentest: they work when there is a vulnerability but they are benign (for a less benign case, see the obligatory xkcd).
An exploit is, as you correctly guessed, the use of a vulnerability to attain an actual goal: extract data, crash a service, implant malware, ...
