Challenge #13 : SQL Injection

OWASP / crAPI

completely ridiculous API (crAPI)

Apache License 2.0

1.13k stars 347 forks source link

Challenge #13 : SQL Injection #155

Closed rallapallinagarjun closed 1 year ago

rallapallinagarjun commented 2 years ago

Challenge 12 and 13 are somewhat related to each other. NoSQL Injection can be cracked “manually” on /community/api/v2/coupon/validate-coupon - {"coupon_code":"TRAC075"} on this endpoint. The same endpoint cant have SQL injection attack, because the table will be a part of NoSQL DB. (for coupons) How can the same endpoint be used for SQL injection, if a different column of the same table (For Challenge 12) will be updated to redeem an already claimed Coupon, and the table is NoSQL based....

piyushroshan commented 2 years ago

Since the service tracking the coupon redemption is different, it can have its own stack. Do look at the apis/postman_collections to learn more.

nikhil-rajesh commented 1 year ago

It is not the same endpoint but a different endpoint which is coupon related. Closing this issue as it is more of a doubt than issue. Please reopen a thread in discussion forum if needed.