A malicious user in this example will try to make a POST request to the users/ endpoint which could lead to the loss of data if the sql statement is not secure. In this case, it could delete a user. Good thing it doesn't!
This test has been added to the workflows in GitHub and will be triggered every time the development branch gets updated.
Example of Test Run:
Step1
This test will create a test-user to run the POST request on it
This test makes sure that a user is in the database
Step 2.
verify that a user got created ( reading the created test-user {userId1}
Step 3.
Now we create a user with a SQL injection which would DELETE the previous user
Step 4.
Now we read the output of the POST request
Step 5.
a user got created with a specific id
Step 6
Now we check if that the SQL injection statement wasn't successful and get the output of the GET request
Step 7.
A user with a specific id get retrieved and we can verify that the user did not get deleted.
Expected Result:
Time Spend:
DATE
ACTIVITY
TIME
02/23
Looked into SQL injection for POST request
2hr
02/24
Meet with team to go over results and fix other issues
2 Hr
02/25
Example of SQL injections during class
2hr
02/27
continued research SQL injection
1hr
02/28
Investigated GA and how to implement SQL injection
2hr
03/01
started working on Implementing GA for SQL injection
SQL-Injection-Users-Post
This is the PR for the SQL-injection test for HTTPTriggerAPIUsers POST request Task: #185
You can see the sample run here
A malicious user in this example will try to make a POST request to the users/ endpoint which could lead to the loss of data if the sql statement is not secure. In this case, it could delete a user. Good thing it doesn't!
This test has been added to the workflows in GitHub and will be triggered every time the development branch gets updated.
Example of Test Run:
Expected Result:
Time Spend: