I am creating a "vulnerable web application".

Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-scanner like sqlmap or "burp active scan" to detect?

This is important to me because I want to find out which of the testers are capable of finding the vulnerability without using a scanner.

One way that came to my mind immediately would be if the user had only one chance to submit the form, but that would be too impractical. I could use one time tokens (csrf) but it's relatively easy to instruct a scanner to fetch a new token before every request.

  • 4
    Beyond concealing the vuln itself, you can also construct the app with some not too uncommon hurdles like a WAF, blacklisting the user agent of sqlmap, banning IPs who request too frequently, adding a token like you mentioned (maybe so that they will need to write a separate script to retrieve the token). Things like these will show if they can operate, configure and extend their tools beyond just running them with --aggressive -vvv. – Arminius Feb 16 at 5:49
  • 2
    Blacklisting user-agents is easy to bypass with a tool like sqlmap (--random-agent). I'd suggest to implement rate limiting. X amount of requests per Y time. – Jeroen Feb 16 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.