Determining sql injection vulnerabilities through payload

Along with the constantly developing technology, the use of computer systems is increasing in parallel with the needs such as rapid access to information, storage. In these systems, especially institutions and organizations hold and use important information. As in every field, computer systems are under threat by cyber attackers because of the important resources they have. As in all areas, security measures are taken against these threats. Hardware and software precautions such as firewalls, intrusion detection and prevention systems (IPS/IDS), content filtering systems, anti virus software, code security tightening are taken. Various cyber attacks are carried out by cyber attackers in order to seize especially critical and confidential information on computer systems. One of these cyber attacks is the Structured Query Language (SQL) injection attack, which is the most common and most dangerous type of attack. A SQL injection attack is a form of exploitation of a security vulnerability by exploiting the vulnerabilities of the codes on the application using a database, with the aim of obtaining confidential information without the authorization of the cyber attacker. In this thesis, SQL injection, classification of SQL injection attacks, methods of detecting SQL injection vulnerability are explained. Studies have been carried out to determine SQL injection vulnerability on web applications. These studies were carried out on Damn Vulnerable Web Application (DVWA) and Web For Pentester applications, which were created for web application security and contain web security vulnerabilities. Manual queries and web vulnerability and penetration testing tools such as Burp Suite, Sqlmap, Kali Linux, Havij, Acunetix, Netsparker were used to identify SQL injection vulnerability. The data loads performed by these tools and manual SQL injection queries were analyzed and compared.