Test Client Side SQL Injection
This article is part of the OWASP Testing Guide v4 (the current status is:DRAFT).
OWASP Testing Guide v4 Table of Contents [DRAFT] At the moment the The entire OWASP Testing Guide v3 can be downloaded here.
Description of the Issue
The following script
Black Box testing and example
Blackbox testing for HTML Injection is not usually performed since access to the source code is always available as it needs to be sent to the client to be executed.
Gray Box testing and example
Testing for HTML Injection vulnerabilities:
For example, looking at the following URL: aa
- Browser location/document URI/URL Sources - https://code.google.com/p/domxsswiki/wiki/LocationSources
- i.e., what is returned when you ask the browser for things like document.URL, document.baseURI, location, location.href, etc.