Use get-based search injection to detect websites

By love letter

In the search box, enter a keyword, which must be searched for on this site. For example, I entered 1 on this site and found a lot of news.

Determine whether there is an injection vulnerability in the search box.

In the search box, enter 1% and 1 = 1 and % =
Return normal

In the search box, enter 1% and 1 = 2 and % =
Returns an exception.
Sorry, no news found
This is an injection point.

In the search box, search keyword 1. the address bar of the browser displays: asp? Key = 1 & otype = msg "> http://www.bkjia.com/News_search.asp? Key = 1 & otype = msg

Here the key = 1, that is, we search for the keyword 1. What we need to do is put key = 1 at the end and change the connection
Http://www.bkjia.com/News_search.asp? Otype = msg & key = 1, or directly Delete & otype = msg into http://www.bkjia.com/News_search.asp? Key = 1

You can use a tool to mount it in.