How to do it...

Make sure you are not logged into the application. If you are, click the Logout button from the top menu. 

  1. Within Mutillidae, browse to the User Lookup (SQL) Page and select OWASP 2013 | A1 Injection (SQL) | SQLi – Extract Data | User Info (SQL):

  1. Type user for Name and user for Password, and click View Account Details. You should see the results shown in the next screenshot. This is the account we will test provisioning functions against, using REST calls:

Through Spidering, Burp can find /api or /rest folders. Such folders ...

Get Burp Suite Cookbook now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.