We have a set of internal Python/Django web applications that are pretty well tested functionality-wise, but from time to time we do discover vulnerabilities and, specifically, places where SQL and other types of injections may happen. Currently, this is a very manual process requiring the knowledge of the system (white box).
But, is there a way to do an automated SQL injection test of all of our API endpoints of the applications under test?
I guess some of the things I don't understand now is: should we actually write the logic of these tests and examples for them and use, say, Python
unittest framework, or is there a way to specify endpoints and possible parameters and let some security testing framework generate the malformed inputs to probe for SQL injections (
sqlmap?) (the question is in a sense about whether it would be Example-based testing or Property-based testing)