web vulnerabilities question

[waelkd]

if we want to chk a site for flaws ,we use sql injections,but lets say a website doesn't have a username password box,how can we sql inject it??
or do we just use ssi's and xss.
thx

EDIIT:NM www.***********.com/products/products.asp?productid=123 UNION SELECT username, password FROM USERS

[insomaniacal]

Anything that searches through an database can be considered "testable". If it looks like it whatever form it is might be scouring some sort of database, you might as well give SQL injection a shot, if not, then look for other vulnerabilities.

[waelkd]

all sql command we use are query based,anyone knows a browser/url sql injection commands,or websites that supple browser commands.
thx

-- Tue Jul 07, 2009 12:20 am --

You don't have permission to access /models/ on this server.

its an apache server ,is their anywway to enable myself to access the folder

[godofcereal]

You could try the .htaccess trick but rarely works.

[waelkd]

already did m8,i tried everything from xss,to ssi,sql inj .htac,u name it .
seems like crac king a web site isnt easy as it seems.

those guys who really break into other sites,r really geniuses

[Schiz0id]

already did m8,i tried everything from xss,to ssi,sql inj .htac,u name it .
seems like crac king a web site isnt easy as it seems.

those guys who really break into other sites,r really geniuses

I'm sure there are many you didn't try. What about CRLF, Poison Null, LDAP Injection, File Inclusion ect. There are many types of exploits, and every site is vulnerable to something.