It appears that you are able to modify the query in a manner that causes a
problem with its execution. This would be indicative of SQL injection.
However, whether or not there are further mechanisms possibly preventing
you from doing anything with it are another story. I would suggest you
read some of the whitepapers out there about SQL injection and go from
there. SPI Dynamics has a few good ones on there website:
http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf
http://www.spidynamics.com/whitepapers/Blind_SQLInjection.pdf
However, as it seems you are not overly familiar with SQL injection
testing, you might want to be especially careful and make sure what the
rules are with your client before you move too far forward.
Steven Adair
http://www.securityzone.org
Hi Group,
I'm doing a penetration test for a client on their web
portal. When I give ' on the username field I was
received with an error from the server:
Unspecified error
ORA-01756: quoted string not properly terminated
Does that mean the site is vulnerable to SQL
Injection? I tried ' OR 1=1-- and ' OR '1'='1'-- but I
get same error message.
Any help would be much appreciated.
Clone
Meet people who discuss and share your passions. Go to
http://in.promos.yahoo.com/groups
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
