The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of the sections in the methodology is to test various weaknesses concerning input handling/validation (INPVAL). In particular, INPVAL-005 is testing for SQL injection and INPVAL-007 is testing for ORM injection. In the Summary to ORM injection it says

ORM Injection is an attack using SQL Injection against an ORM generated data access object model. From the point of view of a tester, this attack is virtually identical to a SQL Injection attack. However, the injection vulnerability exists in code generated by the ORM tool.

I wonder, is it possible to distinguish between them, i.e. is it possible to have no finding for SQLi but to have a finding for ORMi? Does it make sense at all to have two distinct testing items, or shoudln't they be merged into one?

N.B. SQL injection might also be mistaken for XPath injection - in principle xyz' OR 'x'='x could work in both cases. However, XPath has no commenting out (so something like xyz' or 1<2 -- does not work for XPath injection) and XPath has no sleep function (which SQL has). So here it is possible to distinguish quite clearly. Is there a similar distinguishing feature so that one could tell ORM and SQL injection apart?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.