TESTING A WEBSITE (sql injection)

• anthonyjoe

  Grasshopper

  Points: 14

  More actions

  November 8, 2003 at 2:10 am

  #176939

  Hi all!

  am trying to test for any sql injections possible for a particular website on the test server.The server on which the site is hosted is Iplanet ..the os being solaris..and the database is oracle 8i.can any of you sujjest a few ways which i could adopt to test the the website for any of the sql vulnarabilities?

• Steven.

  SSCrazy Eights

  Points: 9806

  More actions

  November 8, 2003 at 4:31 am

  #481350

  All I can suggest is you read some of the papers on the subject

  see the following page for a start http://www.sqlsecurity.com/DesktopDefault.aspx?tabindex=2&tabid=3

  and get someone to peer review the code to ensure all the inputs are validated.

  Steven

• aaronnewman

  SSC Enthusiast

  Points: 151

  More actions

  November 9, 2003 at 10:25 pm

  #481373

  you can find white papers and tools to help you here:

  http://www.appsecinc.com/techdocs/whitepapers.html#manipulate_mssql_wp

  http://www.appsecinc.com/resources/freetools/

  http://www.appsecinc.com/products/appdetective/webapps/

• Frank Kalis

  SSC Guru

  Points: 111183

  More actions

  November 10, 2003 at 12:52 am

  #481379

  Also, you might want to join http://www.LazyDBA.com . They have a quite active dedicated Oracle mailing list oracledba@lazydba.com.

  Frank

  http://www.insidesql.de

  http://www.familienzirkus.de

  --
  Frank Kalis
  Microsoft SQL Server MVP
  Webmaster: http://www.insidesql.org/blogs
  My blog: http://www.insidesql.org/blogs/frankkalis/[/url]