quinta-feira, 20 de agosto de 2020

Learning Web Pentesting With DVWA Part 2: SQL Injection

In the last article Learning Web Pentesting With DVWA Part 1: Installation, you were given a glimpse of SQL injection when we installed the DVWA app. In this article we will explain what we did at the end of that article and much more.
Lets start by defining what SQL injection is, OWASP defines it as: "A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands."
Which basically means that we can use a simple (vulnerable) input field in our web application to get information from the database of the server which hosts the web application. We can command and control (at certain times) the database of the web application or even the server.
In this article we are going to perform SQL injection attack on DVWA, so let's jump in. On the DVWA welcome page click on SQL Injection navigation link. We are presented with a page with an input field for User ID.
Now lets try to input a value like 1 in the input field. We can see a response from server telling us the firstname and surname of the user associated with User ID 1.
If we try to enter a user id which doesn't exist, we get no data back from the server. To determine whether an input field is vulnerable to SQL injection, we first start by sending a single quote (') as input. Which returns an SQL error.
We saw this in the previous article and we also talked about injection point in it. Before diving deeper into how this vulnerability can be exploited lets try to understand how this error might have occurred. Lets try to build the SQL query that the server might be trying to execute. Say the query looks something like this:
SELECT first_name, sur_name FROM users WHERE user_id = '1';
The 1 in this query is the value supplied by the user in the User ID input field. When we input a single quote in the User ID input field, the query looks like this:
SELECT first_name, sur_name FROM users WHERE user_id = ''';
The quotes around the input provided in the User ID input field are from the server side application code. The error is due to the extra single quote present in the query. Now if we specify a comment after the single quote like this:
'-- -
or
'#
we should get no error. Now our crafted query looks like this:
SELECT first_name, sur_name FROM users WHERE user_id = ''-- -';
or
SELECT first_name, sur_name FROM users WHERE user_id = ''#';
since everything after the # or -- - are commented out, the query will ignore the extra single quote added by the server side app and whatever comes after it and will not generate any error. However the query returns nothing because we specified nothing ('') as the user_id.
After knowing how things might be working on the server side, we will start to attack the application.
First of all we will try to determine the number of columns that the query outputs because if we try a query which will output the number of columns greater or smaller than what the original query outputs then our query is going to get an error. So we will first figure out the exact number of columns that the query outputs and we will do that with the help of order by sql statement like this:
' order by 1-- -
This MySQL server might execute the query as:
SELECT first_name, sur_name FROM users WHERE user_id = '' order by 1-- -';
you get the idea now.
if we don't get any error message, we will increase the number to 2 like this:
' order by 2-- -
still no error message, lets add another:
' order by 3-- -
and there we go we have an error message. Which tells us the number of columns that the server query selects is 2 because it erred out at 3.
Now lets use the union select SQL statement to get information about the database itself.
' union select null, version()-- -
You should first understand what a union select statement does and only then can you understand what we are doing here. You can read about it here.
We have used null as one column since we need to match the number of columns from the server query which is two. null will act as a dummy column here which will give no output and the second column which in our case here is the version() command will output the database version. Notice the output from the application, nothing is shown for First name since we specified null for it and the maria db version will be displayed in Surname.
Now lets check who the database user is using the user() function of mariadb:
' union select null, user()-- -
After clicking the submit button you should be able to see the user of the database in surname.

Now lets get some information about the databases in the database.
Lets determine the names of databases from INFORMATION_SCHEMA.SCHEMATA by entering following input in the User ID field:
' union select null, SCHEMA_NAME from INFORMATION_SCHEMA.SCHEMATA-- -
This lists two databases dvwa and information_schema. information_schema is the built in database. Lets look at the dvwa database.
Get table names for dvwa database from INFORMATION_SCHEMA.TABLES
' union select null, TABLE_NAME from INFORMATION_SCHEMA.TABLES-- -
It gives a huge number of tables that are present in dvwa database. But what we are really interested in is the users table as it is most likely to contain user passwords. But first we need to determine columns of that table and we will do that by querying INFORMATION_SCHEMA.COLUMNS like this:
' union select null, COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'users'-- -

We can see the password column in the output now lets get those passwords:
' union select user, password from users-- -
Of-course those are the hashes and not plain text passwords. You need to crack them.
Hope you learned something about SQL injection in this article. See you next time.

References:

1. SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
2. MySQL UNION: https://www.mysqltutorial.org/sql-union-mysql.aspx
3. Chapter 25 INFORMATION_SCHEMA Tables: https://dev.mysql.com/doc/refman/8.0/en/information-schema.html

More articles


  1. Pentest Tools Tcp Port Scanner
  2. Growth Hacker Tools
  3. Usb Pentest Tools
  4. Hack Website Online Tool
  5. Tools Used For Hacking
  6. Hacker Techniques Tools And Incident Handling
  7. Hack Website Online Tool
  8. Easy Hack Tools
  9. Hack Tools For Ubuntu
  10. Hak5 Tools
  11. Hacking Tools Kit
  12. Hacking Tools
  13. Hacking Tools For Mac
  14. Termux Hacking Tools 2019
  15. Pentest Tools Review
  16. What Is Hacking Tools
  17. Pentest Tools Free
  18. Pentest Tools For Windows
  19. Bluetooth Hacking Tools Kali
  20. Pentest Tools For Android
  21. What Are Hacking Tools
  22. Pentest Reporting Tools
  23. Hacker Tools List
  24. Hacker Tools For Mac
  25. Hack Tools 2019
  26. Hacker Tools Github
  27. Best Hacking Tools 2020
  28. How To Install Pentest Tools In Ubuntu
  29. Pentest Tools Windows
  30. Hacking Tools For Windows Free Download
  31. Hack Tools Download
  32. Hacker Tool Kit
  33. Hacker Tools Apk
  34. Hacker Tools Hardware
  35. Hacker Security Tools
  36. Best Hacking Tools 2020
  37. Pentest Tools Url Fuzzer
  38. Pentest Tools Nmap
  39. Pentest Tools Open Source
  40. How To Install Pentest Tools In Ubuntu
  41. Hacker Search Tools
  42. Hack Tools For Pc
  43. Free Pentest Tools For Windows
  44. Hack Tools
  45. Hack Tools For Mac
  46. Pentest Tools List
  47. Hack Tool Apk No Root
  48. Pentest Tools Bluekeep
  49. Hacker Tools 2020
  50. Pentest Tools Online
  51. Physical Pentest Tools
  52. Hack Tools Github
  53. Hacking Tools Windows 10
  54. Hack Tools
  55. Pentest Tools Free
  56. Hacking Tools Kit
  57. Pentest Tools
  58. Hacking App
  59. Hacking Tools Download
  60. Physical Pentest Tools
  61. Nsa Hack Tools
  62. Hacker Tools Apk Download
  63. Pentest Tools Website
  64. Hak5 Tools
  65. Pentest Tools Linux
  66. Hackrf Tools
  67. Hacking App
  68. Hacker Tools Windows
  69. Hack Tools Mac
  70. Hack Tool Apk No Root
  71. Pentest Tools Apk
  72. Install Pentest Tools Ubuntu
  73. Pentest Tools Alternative
  74. Hacking Tools For Pc
  75. Hack Tools For Ubuntu
  76. Physical Pentest Tools
  77. Hacker Techniques Tools And Incident Handling
  78. Usb Pentest Tools
  79. Hacker Tools Apk
  80. Hacking Tools Online
  81. Kik Hack Tools
  82. New Hack Tools
  83. Pentest Tools Download
  84. Pentest Tools Url Fuzzer
  85. Hacking Tools Github
  86. Hacking Tools For Pc
  87. Hack Tools For Mac
  88. Hacker Search Tools
  89. Hacking Tools Github
  90. Hacker Techniques Tools And Incident Handling
  91. Hack Tool Apk No Root
  92. Hack Tools For Pc
  93. Hacking Apps
  94. Hacker Tools Github
  95. Pentest Tools Framework
  96. Beginner Hacker Tools
  97. Usb Pentest Tools
  98. Hacker Search Tools
  99. Pentest Tools Github
  100. Hacker Tools Hardware
  101. Install Pentest Tools Ubuntu
  102. Hackers Toolbox
  103. Hacking Tools Usb
  104. Hacker Tool Kit
  105. Install Pentest Tools Ubuntu
  106. Pentest Tools Website Vulnerability
  107. Hacker Tools
  108. Hack Tools Download
  109. Hacking Tools And Software
  110. Hacking Tools For Beginners
  111. Hacking Tools Windows
  112. Tools For Hacker
  113. Underground Hacker Sites
  114. Hacking Tools Software
  115. Pentest Tools Online
  116. Hack Tools Mac
  117. How To Make Hacking Tools
  118. Hacking Tools Usb
  119. Pentest Automation Tools
  120. Pentest Tools Apk
  121. Hackrf Tools
  122. How To Install Pentest Tools In Ubuntu
  123. Game Hacking
  124. Pentest Automation Tools
  125. Hacking Tools Name
  126. Hacking Apps
  127. Hacker Tools Free Download
  128. Hack Tools Github
  129. Install Pentest Tools Ubuntu
  130. Hacker Tools For Ios
  131. Hacker Tools Apk
  132. Tools For Hacker
  133. Hacking Tools For Mac
  134. World No 1 Hacker Software
  135. Pentest Reporting Tools
  136. Hacker Tools Online
  137. Hack Tools Mac
  138. Top Pentest Tools
  139. Hack Rom Tools
  140. Pentest Tools Website Vulnerability
  141. Pentest Tools Tcp Port Scanner
  142. Pentest Tools Website
  143. Hacker Tools Linux
  144. Hacking Tools
  145. Bluetooth Hacking Tools Kali
  146. Pentest Tools Windows
  147. Hak5 Tools
  148. Hacking Tools Online
  149. Blackhat Hacker Tools
  150. Hacking Tools For Beginners
  151. Hacking Tools For Games
  152. Hack Tool Apk No Root
  153. Hacking Tools For Windows
  154. Hack Tools Pc
  155. Beginner Hacker Tools
  156. Pentest Tools Open Source
  157. Tools 4 Hack
  158. Pentest Tools Nmap
  159. Hack Tools For Pc
  160. Growth Hacker Tools
  161. Computer Hacker
  162. How To Make Hacking Tools
  163. Game Hacking
  164. Hacker Hardware Tools
  165. How To Install Pentest Tools In Ubuntu
  166. Pentest Tools Url Fuzzer
  167. Computer Hacker
  168. Pentest Tools Website Vulnerability
  169. Hack Tools Mac

Nenhum comentário: