Re: SQL Injection and XSS testing,

["Jason Ross" <algorythm () gmail com>]

On 2/23/07, IRM <irm () iinet net au> wrote:
> Excuse me for this basic question. Just wondering in regards to the SQL
> injection, is it sufficient to insert the input with "1=1--" to test
> whether a site is vulnerable to the SQL injection?

absolutely not.
for one thing, there umpty-zillion different variations of "1=1--" ,
some of which may work where others do not, depending on:
  a) the backend dbms, and
  b) the code in the application and
  c) some third thing i'm sure i've forgotten to mention

apart from that however, there are a number of other ways to inject
sql into an application which may work where a simple 1=1 fails.

That said, performing 1=1 tests can be a fairly useful first pass, in
that you are likely to reveal some "low hanging fruit" so to speak;
but it should by no means be the only thing done before slapping a
"not injectable" on the app (of course, i'm not sure i'm comfortable
saying *any* app that talks to a dbms is "not injectable" ... perhaps
"not trivially injectable" ;-) )

> If I am not wrong I guess most of the security aspects in Web
> application are mainly around input validation.

I'd tend to agree with this statement, emphasizing that "most" implies
that input validation is by no means the only aspect to consider.

> So I was wondering is there any free open source software to automate all the input?

I highly recommend checking out absinthe. I find it useful for a
number of things, one of them being providing management with a solid
idea of exactly how much data one can obtain via an application which
is vulnerable.

I've found it does very little to provide someone with a screenshot of
"1=1" with a sql error on the page (or even a successful login as the
first user in the database for that matter, sadly.) Providing them a
spreadsheet containing all (or a good portion) of the data in the
database, along with a documented schema, all gained from a single
vulnerable input field, that tends to have the desired effect of "um,
we should fix that" =)

> Or maybe a list of stuff that usually need to test? Say SQL Injection or XSS?

I don't have a cheat sheet link, but wanted to note (the obvious
perhaps) that these are two very different things...

--
Jason Ross

-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using 
manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fH6
--------------------------------------------------------------------------