Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits?

If so, when black-box testing a house made web application, is the difference between vulnerability identification and exploitation the pentester's intent? For instance for SQL injections, in the first case the pentester wants to identify the vulnerability, and in the second case he/she wants to retrieve the records in the database?

1 Answer 1


When you do a penetration test, you do not want (usually) to break your target. This is why you must choose the payload of your attack (what will be sent to the target service) so that it shows you that a vulnerability exists but without breaking anything.

The examples you show are typical in the vulnerability analysis part of a pentest: they work when there is a vulnerability but they are benign (for a less benign case, see the obligatory xkcd).

An exploit is, as you correctly guessed, the use of a vulnerability to attain an actual goal: extract data, crash a service, implant malware, ...

  • Thanks for your answer. Wikipedia provides a broader definition of exploit and defines it as anything that causes the program to behave in a non intented way. So I guess the two strings I gave are exploits but non-malicious since their only purpose is to identify vulnerabilities. I guess in a lot of cases the only way to identify a vulnerability is trying to exploit it. I however agree, that when we say "I exploited a vulnerability", it usually means we leveraged the vulnerability to do something pretty "bad".
    – Othman
    Jun 11, 2016 at 15:54
  • I guess "exploit" is a matter of semantics. When I discuss a vulnerability, I ask the question "did you manage to exploit it" in the sense "did you manage to get tangible data, as opposed to a proof of concept".
    – WoJ
    Jun 11, 2016 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .