Justin Clarke Lead Author and Technical Editor Rodrigo Marcos Alvarez Dave Hartley Joseph Hemler Alexander Kornbrust Haroon Meer Gary O’Leary-Steele Alberto Revelli Marco Slaviero Dafydd Stuttard

32
 
Chapter 2 • Testing for SQL Injection
Accept: text/xml,application/xml,application/xhtml+xml,
text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
This kind of request sends parameters within the URLs in the following format:
?parameter1=value1¶meter2=value2¶meter3=value3...
In the preceding example, you can see three parameters: 
text
, 
cat
, and 
num
. The remote 
application will retrieve the values of the parameters and use them for whatever purpose 
they have been designed. For 
GET
requests, you can manipulate the parameters by simply 
changing them in your browser’s navigation toolbar. Alternatively, you can also use a proxy 
tool, which I’ll explain shortly.
POST Requests
POST
is an HTTP method used to send information to the Web server. The action the 
server performs is determined by the target URL. This is normally the method used when 
you fill in a form in your browser and click the Submit button. Although your browser does 
everything for you, this is an example of what is sent to the remote Web server:
POST /contact/index.asp HTTP/1.1
Host:www.victim.com
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.19) Gecko/20081216 
Ubuntu/8.04 (hardy) Firefox/2.0.0.19
Accept: text/xml,application/xml,application/xhtml+xml,
text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Referer: http://www.victim.com/contact/index.asp
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
first=John&last=Doe&email=[e-mail]&phone=555123456&title=Mr&country=US&comments=
I%20would%20like%20to%20request%20information

---