SQL injection is not detected in single-page applications (SPAs) or during form submissions using JavaScript.

[Kundan8000]

Issue:

When testing the site demoblaze.com, SQL injection vulnerabilities are not detected because the form uses JavaScript for submission without specifying action or name attributes.

Proposed Solution:

Using Selenium, we can identify all forms on the page, submit them with dummy data, and capture the actual payload sent over the network. For intercepting these network requests, we can use selenium-wire to observe and analyze the payloads generated during form submission. Once captured, we can modify this payload with custom inputs to perform SQL injection tests.

Library Version: Wapiti 3.2.0
OS Version: Ubuntu 22.04.4 LTS