1

I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection. After inserting a malformed URL, I get this message on my browser: "Malformed URL".

Given this message obtained on the browser, is the web app in your opinion vulnerable to SQL injection?

3

No, it's not an indication of a successful SQL injection. Literally the error means that your request doesn't conform to the Uniform Resource Identifier (URI) standard syntax (RFC 3986, 3.):

     foo://example.com:8042/over/there?name=ferret#nose
     \_/   \______________/\_________/ \_________/ \__/
      |           |            |            |        |
   scheme     authority       path        query   fragment

It's unclear what is giving the error.

  • If it's your browser, the request doesn't even reach the server. In HTTP(S) the server sees the authority part on the Host: header and the path and query parts in the (GET / POST) request.

  • If the request actually goes to the server and the server is unable to handle it, the server would probably response with the 400 Bad Request error, instead.

  • Some web application firewall (WAF) could respond with a Malformed URL error, but it's more likely to give 403 Forbidden without revealing the attacker what's the exact security rule that was fired.

  • You could even be behind a proxy / NGFW / UTM that blocks malformed request from leaving your network. Such an appliance would probably show the error directly to you.

In any case this doesn't look like you have succeed at all. Also, organizations having bug bounty programs have probably already fixed the most obvious vulnerabilities. You would need to come up with something a lot more sophisticated. Frankly, if you were capable of that, you wouldn't be asking this question here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.