Tech Tip: SQL Injection Attacks by Example
I recently did a penetration test for a customer, and for the first time was able to really go to town with SQL Injection to leverage access to a web application. SQL Injection is providing bogus input to a web form and getting my own input data treated as SQL, and it only works when the application does not properly sanitize input forms (sadly, a common malady).
The process was pretty interesting to me, and on the chance it might be to others, I wrote a Tech Tips that detailed the steps I took to gradually work my way inside.