Re: Help to Automate XSS and SQL

["Michael Boman" <michael.boman () gmail com>]

Try the fuzzer module in WebScarab
(http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project), or
wfuzz (http://www.edge-security.com/wfuzz.php). Neither of them are
available as a browser plugin, but WebScarab is written in Java so it
runs anywhere there is a suitable JVM, and wfuzz has win32 binaries
available.

Best regards
Michael Boman

On Tue, Dec 16, 2008 at 6:09 AM, Vin Oxious <vinoxious () gmail com> wrote:
> Hello Friends,
>
>               Greetings of the day !! .. Recently I had carried out
> manual test with XSS and SQL. I have tried quite a lot of the
> variants.. but later on it was detected that it has XSS and SQL
> vulnerability.
>
> Since there are so many variants of XSS and SQL and cannot be tried of
> all those in a limited time span. What should I do to make sure that
> the site doesn't have XSS and SQL.
>
> Should I try with every SQL and XSS string. and use a automated brute
> force attack .. If yes .. can anyone suggest me some good tools that I
> can run from windows or browser ( similar to tamper data ,greasy
> monkey or any other windows tools ).
>
> Note : please don't suggest perl scripts or linux related scripts even
> though I would love to work upon :(  Coz this is a windows
> environment.
>
>
> Thanks in advance for sharing your experiences :)
>
> regards,
> Vinox



-- 
http://michaelboman.org - Security Blog & Wiki