diff --git a/scripts/SQLInject.nse b/scripts/SQLInject.nse index 1b57254a5..05573ed57 100644 --- a/scripts/SQLInject.nse +++ b/scripts/SQLInject.nse @@ -5,16 +5,16 @@ injection attack. The script spiders an HTTP server looking for URLs containing queries. It then proceeds to combine crafted SQL commands with susceptible URLs in order to -obtain errors. The errors are analysed to see if the url is vulnerable to +obtain errors. The errors are analysed to see if the URL is vulnerable to attack. This uses the most basic form of SQL injection but anything more -complication is more suited to a stand alone tool. Both meta and HTTP redirects +complication is more suited to a standalone tool. Both meta and HTTP redirects are supported. It is not advisable to run this against unknown hosts. -We may not have access to the servers true hostname. This means we cannot +We may not have access to the server's true hostname. This means we cannot access virtually hosted sites and cannot follow absolute links when the -hostname is different from the resolved ip address +hostname is different from the resolved IP address ]] require('url')