SecurityInnovation/TMContentReview — Issue #109: How to Test for Exception Information Disclosure
Author: SergeTruth
Created: 2011-11-07 22:45:58+00:00
State: open

Handling Exceptions at the Application Level
Why are the code examples associated with this section open for SQL Injection?

"Submit malicious input
The primary goal when testing for information disclosure bugs is to make the application fail in unexpected ways. Start by submitting unexpected input consisting of malicious attack strings such as OWASP Fuzz Vectors [i], escape and especial characters, and exceedingly long strings."
The last sentence is worded incorrectly.

http://www.example.com/getProfile?id=a'%20OR%[02]1=1#&username=testuser