The document discusses SQL injection and XPATH injection vulnerabilities. It provides examples of numeric and string SQL injection and shows SQL injection being found in a query. It also finds an XSS injection vulnerability. The document is copyrighted by iAppSecure Solutions and promotes their security testing tools.

1. SQL & XPATH Injection
Example,Analysis with Fusion Lite Insight

2. Numeric SQL Injection

20. String SQL Injection

25. SQL Injection

29. Copyright - iAppSecure Solutions

30. Copyright - iAppSecure Solutions

31. Copyright - iAppSecure Solutions
Clear
SQL Injection Check
NSA View / Guide Path
SQL Injection Found
javax.servlet.ServletRequest::java.lang.String[]
getParameterValues(java.lang.String) (“employee_id”)
java.lang.String (“Pass”)
java.sql.Statement::java.sql.ResultSet executeQuery(java.lang.String)
(“SELECT * FROM employee WHERE userid = 101 and password = ‘Pass’”)

32. Copyright - iAppSecure Solutions
Clear
org.owasp.webgoat.util.HtmlEncoder::java.lang.String
encode(java.lang.String) (“4128 3214 0002 1999”)
XSS Injection Found
java.io.PrintWriter::void print(java.lang.String)

33. XPATH Injection

34. Copyright - iAppSecure Solutions

35. Copyright - iAppSecure Solutions

36. Copyright - iAppSecure Solutions

37. Copyright - iAppSecure Solutions

38. Copyright - iAppSecure Solutions

39. Copyright - iAppSecure Solutions

40. Copyright - iAppSecure Solutions

41. Copyright - iAppSecure Solutions

42. Copyright - iAppSecure Solutions

43. Copyright - iAppSecure Solutions

44. Copyright - iAppSecure Solutions

45. Copyright - iAppSecure Solutions

46. Copyright - iAppSecure Solutions

47. Copyright - iAppSecure Solutions

48. Copyright - iAppSecure Solutions

49. Copyright - iAppSecure Solutions

50. Copyright - iAppSecure Solutions

51. Copyright - iAppSecure Solutions

52. Copyright - iAppSecure Solutions

53. Copyright - iAppSecure Solutions
Thank You
• iAppSecure Solutions
• www.iappsecure.com
• contact@iappsecure.com