Question

I am attempting to incorporate sqlmap, and other sql injection tools, into a java GUI that will allow me to select them from the GUI (windows builder) in order to run them. I will then test them on a website that I have created that's local in order to test its vulnerabilities.However, I have had some trouble with the implementation, and cannot seem to find a way to do it successfully. If someone knows the solution to my problem, or if there a resource that you think could help/project that is similar, I'd be grateful.

Answer 1

Answer:

SQL injection vulnerabilities are caused by software applications that accept data from an untrusted source , fail to properly validate the data, and subsequently use that data to dynamically construct an SQL query to the database working on that application. For example, imagine we have a simple application that takes inputs of a username and password. It may process this input in an SQL statement as the below query:

"SELECT * FROM users WHERE username = "'" + username + "' AND password = '" + password + "'"

As this query is constructed by concatenating an input string directly from the user, the query behaves correctly only if password does not contain a single-quote character. If the user enters "Alt" as the username and "altamash OR 'a'='a as the password, the resulting query becomes SELECT * FROM users WHERE username = 'Alt' AND password = 'altamash' OR 'a'='a'; The "OR 'a'='a' clause always evaluates to true and the intended authentication check is passed as a result.

While any of the application that incorporates SQL can suffer from several vulnerabilities and they are most common in web-based applications. One reason for the occurance of these problems is that their underlying causes can be found in almost any web application, regardless of implementation technology, programming language. This class of vulnerabilities are also particularly severe in identifying them is tantamount to full exploitation. Indeed, this is what attackers are doing on an internet scale.