full-disclosure - SQL Injection through HTTP Headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 4 Apr 2012 09:24:51 -0500
From: "Adam Behnke" <adam@...osecinstitute.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: SQL Injection through HTTP Headers

During vulnerability assessment or penetration testing, identifying the
input vectors of the target application is a first step. Sometimes, when
dealing with Web application testing, verification routines related to SQL
injection flaws discovery are restricted to the GET and POST variables as
the unique inputs vectors ever. What about other HTTP header parameters?
Aren't they potential input vectors for SQL injection attacks? How can one
test all these HTTP parameters and which vulnerability scanners to use in
order to avoid leaving vulnerabilities undiscovered in parts of the
application?

A result of a comparison of 60 commercial and open-source black box web
application vulnerability scanners was released and titled: < The Scanning
Legion: Web Application Scanners Accuracy Assessment & Feature Comparison >.
This benchmark, performed by the security researcher Shay Chen in 2011,
focused on testing commercial and open source tools that are able to detect
(and not necessarily exploit) security vulnerabilities on a wide range of
URLs.  This study shows that 75% of Web application scanners couldn't
discover HTTP Headers parameters related flaws. 

In this article at InfoSec Institute we cover how to perform SQL Injection
against HTTP headers, realizing a potential dormant method of SQL injection
that is not looked at as much as other SQL injection methods:
http://resources.infosecinstitute.com/sql-injection-http-headers/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/