The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

278

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 278

---

A typical configuration is shown in Figure 9-1.

Figure 9-1: A typical Absinthe configuration

The next step is to click the Initialize Injection option. This causes Absinthe

to issue two test requests, designed to trigger different application responses.

As described in the previous attack, Absinthe injects the following two 

payloads:

‘ AND 1=1-- 

‘ AND 1=2--

Provided that you have configured Absinthe correctly, the two test requests

should result in different responses from the application, confirming that you

are ready to exploit the vulnerability.