How to check login protected pages for sql injection and xss attack

unclesamcrazy · 07-27-2016, 04:31 AM

I have a web application where I have to check sql injection attacks and XSS attacks. Maximum number of forms are login protected. When user logs in, he is able to see those forms like

Create Class
Update Class
Create Lesson
Update Lesson
Post Question
Answer Question

If non-logged in user, hits these urls, it sends him on the login page.
How can I test these pages for sql injection and XSS.

Please help.

Regards
SAM

TenTenths · 07-27-2016, 05:38 AM

https://detectify.com/

If you want a recommendation for a good web application vulnerability testing company let me know.

mralk3 · 07-27-2016, 02:53 PM

I like to use sqlmap, nikto, w3af. I am not a penetration tester or anything so I may be wrong. It is best if you install them from Git.

http://sqlmap.org/
https://cirt.net/Nikto2
http://w3af.org/