Injections

SQL Injection is the method where an attacker may create or alter SQL commands in order to disclose data in the database. This can be effective on an application that takes user input and combines it with static parameters to build a SQL query without proper validation.

Likewise, all types of injection attacks can be done with manipulating input data to the application. With Python, we could inject some attack vectors to the application and analyze the output to verify the possibility of the attack. Mechanize is a very useful Python module for navigating through web forms, which provide a stateful programmatic web-browsing experience with Python.

We could use mechanize to submit forms and analyze the response:

import mechanize 
 # Import module 
 
# Set the URL 
url = "http://www.webscantest.com/datastore/search_by_id.php" 
  
 
request = mechanize.Browser() 
 
request.open(url) 
 
 
# Selected the first form in the page 
request.select_form(nr=0) 
 
 
# Set the Id  ...