OWASP / wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
https://owasp.org/www-project-web-security-testing-guide/
Creative Commons Attribution Share Alike 4.0 International
7.19k stars 1.32k forks source link

Update 05-Testing_for_SQL_Injection.md #1123

Closed adenning4 closed 8 months ago

adenning4 commented 8 months ago

Fix boolean logic error for inference methods

The current inferential query will only work in cases where the Id value actually equals 1. In blind SQL cases this value is likely not known. SELECT field1, field2, field3 FROM Users WHERE Id='1' AND I(SUBSTRING(username,1,1))=97 AND '1'='1'

Changing the first AND to an OR will ensure the inferential query executes regardless of the Id value. SELECT field1, field2, field3 FROM Users WHERE Id='1' OR ASCII(SUBSTRING(username,1,1))=97 AND '1'='1'

github-actions[bot] commented 8 months ago

The following issues were identified: document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.7-Testing_for_ORM_Injection.md:48:31 MD056/table-column-count Table column count [Expected: 2; Actual: 6; Too many cells, extra data will be missing]

github-actions[bot] commented 8 months ago

The following links are broken: FILE:document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods.md [✖] https://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf → Status: 403

github-actions[bot] commented 8 months ago

The following links are broken: FILE:document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/06-Test_HTTP_Methods.md [✖] https://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf → Status: 403

github-actions[bot] commented 8 months ago

The following issues were identified: document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.7-Testing_for_ORM_Injection.md:48:31 MD056/table-column-count Table column count [Expected: 2; Actual: 6; Too many cells, extra data will be missing]