Regarding SQL Inject me Firefox add-on?

Question

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool.

After getting result, it has displayed following responses

Server Status Code: 302 Moved Temporarily
Tested value: 1 UNI/**/ON SELECT ALL FROM WHERE
Server Status Code: 302 Moved Temporarily
Tested value: ' OR username IS NOT NULL OR username = '
Server Status Code: 302 Moved Temporarily
Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31
Server Status Code: 302 Moved Temporarily
Tested value: 1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects WHERE xtype = 'U' --
Server Status Code: 302 Moved Temporarily
Tested value: 1'1
Server Status Code: 302 Moved Temporarily
Tested value: 1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116
Server Status Code: 302 Moved Temporarily
Tested value: 1' AND non_existant_table = '1
Server Status Code: 302 Moved Temporarily
Tested value: 1 AND USER_NAME() = 'dbo'
Server Status Code: 302 Moved Temporarily
Tested value: 1' AND 1=(SELECT COUNT(*) FROM tablenames); --
Server Status Code: 302 Moved Temporarily
Tested value: '; DESC users; --
Server Status Code: 302 Moved Temporarily
Tested value: 1'1
Server Status Code: 302 Moved Temporarily
Tested value: 1' OR '1'='1

Please find attached image.

I want to know what is exactly 302 moved temporarily?

Is my site is vulnerable?

Answer 1

While I haven't used SQL Inject Me plugin before, it is hard to tell if you are vulnerable or not by the data and screenshot you shared.

The 302 Moved Temporarily is a HTTP response. It means that the webserver wants to send you to a different page. If this HTTP response was sent to your Firefox it would lead to Firefox loading a different page, such as the index or whatever.

Answer 2

When you get into server redirects as responses to errors you caused with SQL injection strings (302 moved temporarily), you are entering Blind SQL Injection territory. As the SQL Inject Me docs state:

its ability to detect SQL Injection is limited by the responses received from the server. Testing for advanced attacks, such as blind SQL injection, may require additional manual testing.

I recommend you move this test to another tool. I've found that sqlmap is very good at blind SQL injection.

Answer 3

From the form parameters displayed in the screenshot it looks like it is testing a password change form.

The parameters of interest are: uname, ppwd, npwd, cpwd

It appears that the cpwd parameter is the one being tested, which I would guess is the parameter for the confirmation of password change?

The 302 Moved Temporarily is a HTTP response code where the server is redirecting the user. This could be because the cpwd does not match the npwd value (i.e. new password and confirmation do not match as the tool has replaced cpwd with its data to test with).

So this appears to be a false positive (if my assumptions on the tool, page and parameters are correct). I have not used this particular plugin before, but like @mcgyver5 I recommend sqlmap so you should also test with this.