Make sure you are not logged into the application. If you are, click the Logout button from the top menu.
- Within Mutillidae, browse to the User Lookup (SQL) Page and select OWASP 2013 | A1 Injection (SQL) | SQLi – Extract Data | User Info (SQL):
- Type user for Name and user for Password, and click View Account Details. You should see the results shown in the next screenshot. This is the account we will test provisioning functions against, using REST calls:
Through Spidering, Burp can find /api or /rest folders. Such folders ...
