I have a textbox which is used for searching the data within the site. What my client wants that,
1)Enter any text in the search field and click the search symbol.
2)The request going to the server using a web proxy tool like "Burp"
3)Append the parameter with the script present as
what happens here is
The XSS script entered by the advesary gets reflected in the response without any input.
I have found a line of code, which might get effected with SQL injection. See the code which is highlighted.
private void SearchResult()
{
DataTable dt;
if (Session["Search"] == null)
{
ResXResourceReader reader = new ResXResourceReader(Server.MapPath("~/App_GlobalResources/Strings.en-US.resx"));
IDictionaryEnumerator id = reader.GetEnumerator();
string sResourceFile = Server.MapPath("~/App_GlobalResources/Strings.en-US ...
Go to the complete details ...