[...]» Blog Archive » Webscarab Tutorial Part 3 (fuzzing)[...]…

not all web applications use the “location” field in their headers. it just so happens the example i used does. when looking to see if the sql injection was successful it’s better to look in the body of the response (aka the very bottom pane in webscarab). if you see any errors or something that looks out of place then you may be able to perform sql injection. it’s not an exact science but be on the look out for a response that is abnormal. does that answer your question?

are you saying there’s no “location” in the header of the response?

I am not getting any pop up window on security certificate for my application. Even though I clicked Intercept botton ON/OFF.Can you pls tell me wat to do?

Thanks
Harjeet

that’s somewhat of a general error but the first error is complaining about ssl, have you accepted the certificate so that webscarab can man in the middle the ssl traffic? you should click yes / accept to this certificate. below is a screen shot link to accepting a certificate.

http://www.dental.ufl.edu/IT/images/netstorage_accept_cert.jpg

I was Testing an application through Webscarab in remote login which was deployed in “http://training:8080/xyz/” but unable to test.

On running the Web scarab i got following errors:

WebScarab encountered an error trying to retrieve

GET https://training:8080/daytrader/ HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/xaml xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/x-shockwave-flash, */*
Accept-Language: en-us
UA-CPU: x86
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: training:8080

The error was :

Unrecognized SSL message, plaintext connection?
at com.sun.net.ssl.internal.ssl.InputRecord.handleUnknownRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.InputRecord.read(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(Unknown Source)
at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
at java.io.BufferedOutputStream.flush(Unknown Source)
at org.owasp.webscarab.model.Request.writeDirect(Request.java:233)
at org.owasp.webscarab.model.Request.writeDirect(Request.java:214)
at org.owasp.webscarab.httpclient.URLFetcher.fetchResponse(URLFetcher.java:241)
at org.owasp.webscarab.plugin.proxy.CookieTracker$Plugin.fetchResponse(CookieTracker.java:130)
at org.owasp.webscarab.plugin.proxy.BrowserCache$Plugin.fetchResponse(BrowserCache.java:101)
at org.owasp.webscarab.plugin.proxy.RevealHidden$Plugin.fetchResponse(RevealHidden.java:100)
at org.owasp.webscarab.plugin.proxy.BeanShell$Plugin.fetchResponse(BeanShell.java:229)
at org.owasp.webscarab.plugin.proxy.ManualEdit$Plugin.fetchResponse(ManualEdit.java:243)
at org.owasp.webscarab.plugin.proxy.ConnectionHandler.run(ConnectionHandler.java:223)
at java.lang.Thread.run(Unknown Source)

Could you pls help me to solve my problem or any other site where i can post my problem.

Thanks

Harjeet