http header injection
In some cases, the background developers to verify that the client header information (such as common cookie verification) or get some information about the client via http header header information, such as username, accept the field and so on
http header information will the client be acquiring and using SQL processed at this time if there is not enough security considerations could result in SQL Inject-based http header vulnerabilities
We can first injected http header that page click on the prompt, enter the user's password he gave a look and found that the page has a recording function, record the user agent, http accept, port. A look at this, we can think of, the back end should be on the inside of the http header data has been acquired, then it is not also a database related to the operation of it.
We can test
After opening burpsuit, just look Ethereal, sent to the repeater, we have to be tested according to the user agent field. We put the value of this field is deleted, its own structure, you can submit a single quote, point send, found that returns a syntax error database, so you can already see that this place is sql injection vulnerability exists because our single placed inside quotation marks sql execution report came out grammatical mistakes, this time we can construct payload testing.
What is it there is a point, is this package inside the cookie, the cookie information is used to track the session, the background will get cookie information front end, although the cookie is actually a back-end hair down, but when you're in when to jump between pages, the client will actually get the front of the cookie, the associated verification, if acquired after the cookie to the same database which has been spliced, were related operations, it is also possible to generate SQL injection vulnerability.
We cookie related tests
We add a single quotation mark behind the user name, will see an error, error, indicating the presence of SQL injection vulnerabilities, where the payload configuration-based functions, look at the return.
So, when we test SQL injection, in addition to some of the common entry point accident, http head often produce some SQL injection vulnerability.
