Loading…
18
Just realized my scanner finding that one SQL injection was because a coworker showed me prep mode
Six months ago I was running my usual scanner on our login page before a release and getting nothing but noise, mostly false positives I kept triaging over and over. A dev named Priya pulled up a chair next to me in the Denver office and said my tool was fine, but my session cookies were dying before it could test the authenticated routes. She showed me how to grab a fresh token and feed it into the proxy tool so the scanner could actually crawl behind the login, and boom, it flagged a blind SQL injection in the search field the next run. That one finding led to two more in the same code path, and we patched all three before the release went out. I still feel a little dumb it took someone pointing at my screen to see it. Anyone else have a tool that just needed one weird config tweak before it started pulling its weight?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.