I implemented a small website for penetration testing purposes using the Vaadin framework. I have a MySQL database running in the background as well as a Jetty server.
The website is vulnerable against manual SQL injection attacks. But when I want to use a powerful tool such as
sqlmap I can't find any vulnerabilites. The main reason is that the url of my website doesn't contain injectable paramters. Instead I get following message:
!main/test: event not found
How can I change the URL to be vulnerable?