Once you have written your application, we do not know if it is vulnerable to SQL Injection. Obviously, you could examine the source code and find any instances of concatenating user input with SQL, but that could be very tedious and time consuming. You must use a good, updated vulnerability scanner to find the most frequently found vulnerabilities. Performing SQL Injection generates high network bandwidth and sends a lot of data, so make sure you are the owner of the website you are testing. If not, make sure you have taken prior permission from the owner. A few famous tools such as sqlmap, Acunetix, Vega, and Netsparker can be used for scanning.
Finding vulnerabilities
Get Practical Network Scanning now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
