The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

functions in ways that are not evident from the user’s perspective and may be

handled in an unsafe manner. You therefore need to probe every such item for

SQL injection vulnerabilities. This includes all URL parameters, cookies, items of

POST

data, and HTTP headers. In all cases, a vulnerability may exist in the

handling of both the name and value of the relevant parameter. 

244

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 244

---

Chapter 9 

■

Injecting Code

245

T I P

When you are probing for SQL injection vulnerabilities, be sure to walk

through to completion any multistage processes in which you submit crafted