Evaluating Input Validation Checks

Failure to validate any input received from the client before using it in the application code is one of the most common security vulnerabilities found in web applications. This flaw is the source of major security issues, such as SQL injection and Cross-Site Scripting (XSS). Web penetration testers must evaluate and determine whether any input is reflected back or executed upon by the application. We’ll learn how to use Burp Suite to perform such tests.

In this chapter, we will cover the following recipes:

• Testing for reflected cross-site scripting
• Testing for stored cross-site scripting
• Testing for HTTP verb tampering
• Testing for HTTP parameter pollution
• Testing for SQL injection
• Testing for command injection