2

A lot of stuff covered by OWASP applies to applications as the line between desktop app and web app blurs. Things like SQL injection, command injection, object injection to name a few injection attacks. I once tested a .Net MVC app by uploading a PHP file and tried to see if the code was executed or presented as raw text when viewed. As far as tools you ...


1

If for some reason you don't like XPath Extractor you can always switch to Regular Expression Extractor, the relevant configuration would be something like: Reference Name: the same value you use in the XPath Extractor, i.e. id Regular Expression: <productid>(.+?)</productid> Template: $1$ You can refer it in the JDBC Request like: SELECT * ...


1

What's wrong with XPath Extraction? Is there a specific reason you cannot use XPath? You can use RegEx extractor, but keep in mind you are going to have to build a pretty well structured query to get the right value. XPath anticipates many results and puts them into an index array. Without more information this question cannot be answered. - Why is that 90%...


1

I would suggest for any security related testing you start with OWASP: https://www.owasp.org/index.php/SQL_Injection OWASP have excellent overviews and descriptions as well as concrete guidance on testing and mitigation for most common classes of vulnerability.


Only top voted, non community-wiki answers of a minimum length are eligible