The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

279

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 279

---

T I P

Depending on the syntactic complexity of the query into which you are

injecting, your first connection test may or may not be successful in generating

different responses from the application. If it is not, then you need to fix up 

the syntax of the query that Absinthe’s requests are generating, given your

understanding gained from your manual probing of the application. To modify

the syntax following Absinthe’s payload, you can change the Append Text to

End of Query option. To modify the syntax before the payload, you can change

the default value for the relevant parameter. Keep experimenting until the