Practical Security Automation and Testing

Step 1 – download the SQL injection data

To replace the parameter password with the SQL injection payloads, we can use the FuzzDB or SecList resources in the previous list. For example, SecLists provides a list of SQL injection payloads we can use. The following table lists common SQL injection security payloads that can be obtained from the following URL:

https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/Generic-SQLi.txt.

In this case, we will create the sqli.csv with the SQL injection security payloads, as follows:

SQL injection payloads samples

UNION ALL SELECT ) or sleep(__TIME__)=')) or benchmark(10000000,MD5(1))#hi' or 'a'='a021 %limitor 1=1or 2 > 1