SQL Injection Tests

SQL Detection

• Append -- to the query param:
  • If the response does not change, the query param might be used in an SQL statement.

SQL Error Detection

• Append ', " or ` to the query param:
  • If the response lacks data or contains an SQL Error message, the query param is being used in an SQL statement.

Filter Detection

• Pre-append -- to the query param:
  • If the response does not change, filtering may be removing - characters.
• Append 0 to the numeric query param:
  • If the response does not change, filtering may be removing 0 characters.
• Pre-append punctuation characters to the query param:
  • If the response does not change, filtering may be removing punctuation characters.
• Append non-numeric characters to the query param:
  • If the response does not change, the query param is being sanitized using a String to Integer conversion function.

Numeric Detection

• Pre-append 0 to the numeric query param:
  • If the response does not change, the query param is being treated as an integer.
• Pre-append - to the numeric query param:
  • If the response does change, the the query param is being treated as an integer.
• Pre-append + to the numeric query param:
  • If the response does not change, the query param is being treated as an integer.
• Divide the numeric query param by 2 and pre-append 2*:
  • If the response does not change, the query param is being treated as an integer.
• Subtract 1 from the numeric query param and pre-append 1+:
  • If the response does not change, the query param is being treated as an integer.

String Detection