[Full-disclosure] SQL Injection through HTTP Headers
adam at infosecinstitute.com
Wed Apr 4 15:24:51 BST 2012
During vulnerability assessment or penetration testing, identifying the
input vectors of the target application is a first step. Sometimes, when
dealing with Web application testing, verification routines related to SQL
injection flaws discovery are restricted to the GET and POST variables as
the unique inputs vectors ever. What about other HTTP header parameters?
Aren't they potential input vectors for SQL injection attacks? How can one
test all these HTTP parameters and which vulnerability scanners to use in
order to avoid leaving vulnerabilities undiscovered in parts of the
A result of a comparison of 60 commercial and open-source black box web
application vulnerability scanners was released and titled: < The Scanning
Legion: Web Application Scanners Accuracy Assessment & Feature Comparison >.
This benchmark, performed by the security researcher Shay Chen in 2011,
focused on testing commercial and open source tools that are able to detect
(and not necessarily exploit) security vulnerabilities on a wide range of
URLs. This study shows that 75% of Web application scanners couldn't
discover HTTP Headers parameters related flaws.
In this article at InfoSec Institute we cover how to perform SQL Injection
against HTTP headers, realizing a potential dormant method of SQL injection
that is not looked at as much as other SQL injection methods:
Full-Disclosure is hosted and sponsored by Secunia.