Testing for Web Site Vulnerabilities - ' Testing for SQL Injection '

( Page 2 of 4 )

Vulnerability">


Look for common scripting-language file extensions--Microsoft Active Server Pages (*.asp) and Macromedia ColdFusion (*.cfm) scripts are usually the most vulnerable. The search field is your best bet; the Uniform Resource Locator (URL) on the results page will likely contain a script. Also try hovering your cursor over links while watching the bottom status bar. If the status bar doesn't display URLs, click on links and watch the address bar until you find a URL that has parameters.

Once you are on a page whose URL contains parameters, you are ready to test for SQL Injection vulnerability. There are two methods. Be sure to test each parameter value, one at a time, with each method.


Method 2. Instead of highlighting the entire parameter value, click inside the value and type a single quote.