Remember: It is illegal perform any attacks without permission
SQL Injection Attacks
Remember: Do not attack any live websites without explicit permission from the server owners.
SQL Injection Attack – Recap
A page has been added to the VLE for
this module that provides a summarised
recap of SQL Injection attacks
Damn Vulnerable Web App (DVWA)
Damn Vulnerable Web App (DVWA) is a PHP/MySQL
web application that has been built with
vulnerabilities in it
The goal of DVWA is to:
Be an aid for security professionals to test their skills and
tools in a legal environment
Help web developers better understand the processes of
securing web applications
Aid teachers/students to teach/learn web application
security in a class room environment
DVWA Security Levels
The level of security on the DVWA can be
adjusted within the application
When the DVWA Security Level is set, it
changes the PHP code used by the
website
You can see the source code for the
section we will attack on the SQL Injection,
by clicking the “View Source” button
1. Confirm Metasploitable VM IP
Note: You can also do this by
running an nmap scan on
the subnet from the Kali VM
2. Confirm DVWA Security Level is Low
Navigate to
[Link]
Log into the DVWA (admin/password)
Ensure the Security Level is set to “low”
and click Submit
3. Navigate to SQL Injection
DVWA has sections for us to attack in
different ways
In this tutorial, we will be
concentrating on the “SQL Injection”
section
Note: There is an “SQL Injection
(Blind)” section, but we will NOT be
using this section in this guide
4. Figuring out the SQL Statement (reconnaissance)
Before we begin attacking a target (for any type of attack), we need to understand as
much as possible about what it does and how it works
In this case, we’ll begin by entering numbers into the box (as it is asking for an ID (which
we can assume will be a numerical value – but could also be something else depending
on the system)
4. Figuring out the SQL Statement (reconnaissance)
Now we have determined that we could conduct an SQL Injection attack on the website,
we need to think about the way that SQL statement it uses functions
Because of what we get returned on this page, we can assume that the SQL statement
being used looks something like this:
SELECT Name, Surname FROM table_name WHERE Id = ‘user_input’
Where table_name is the name of the table (we don’t know this yet – but we could guess it
could be: users, accounts, tbl_users etc.)
And user_input is the input from the web form
5. Test SQL Injection
We’ll begin our attack by seeing if the
website is susceptible to an SQL injection
attack (1)
We will do this by inputting a special character that we know is used in SQL and could
potentially cause issue with the syntax of a statement
In this case, we will input a single quotation mark (’) and hit submit
If we get an SQL generated error returned, we know an attack may be possible:
6. Selecting all records in the table
Now we know that SQL Injection may be possible, we will append to the SQL statement to
try and reveal more records
Because we know that the single quotation mark caused an error, we can assume that
the query is constructed with the single quotation applied to the user input
We will then append an additional query that will always evaluate as true to the end of
the search string
ID: %' OR '1'='1
6. Selecting all records in the table
ID: %' OR '1'='1
Executing this query should return a
list of all users that exist within the
table
Note that it only shows us the default
columns that the query is set to
return
7. Finding the Columns
1' order by X #
We’re going to now execute this
SQL statement to find out how many Normal:
columns that this table has
We will do this by increasing the
value of the X variable in our query
by 1 each time
SQL Error:
When we get an error, we know that
the query has exceeded the
number of columns
7. Finding the Columns
1' order by X #
We’re going to now execute this
SQL statement to find out how many Normal:
Note:columns that thisatable
We’ve added hasend of our query.
# to the
# in SQL donates a comment, if we run this command without the
We willthe
comment, docode
this byofincreasing thewill append a single quotation to it,
the website
value of the X variable in our query
making the syntax invalid.
by 1 each time
Therefore, in instances like this, we can usually add a comment
SQL Error: to our
query to allow
When it to an
we get execute properly!
error, we know that
the query has exceeded the
number of columns
8. Testing UNION SELECT command
1' UNION SELECT 1,2 #
Next, we want to see if the UNION
SELECT command is available to us to
use
UNION is a great SQL command to pull
additional data from other tables when
combined with SELECT, if this runs
successfully, we should have the 1 and
2 displayed on the page, as well as the
record with the User ID of 1
9. Getting the Database name and the
User
1' UNION SELECT database(),user() #
We will now use UNION SELECT to try
and identify the Database name and
the User
We will do this by combining it with 2
MySQL functions:
1. database()
2. user()
10. Finding other Databases
1' UNION SELECT schema_name, 2 FROM information_schema.schemata #
We will now use UNION SELECT to try and
identify the other databases that exist
We will do this by taking the
schema_name from the
information_schema.schemata
command
This will return all other databases we
have access to
11. Getting the Database name and
the User
1' UNION SELECT table_name, 2 FROM information_schema.tables WHERE
table_schema = 'dvwa' #
Next, we want to pull out
information on the other
tables in the dvwa database
We will do this by taking the
table_name value from the
information_schema.tables
for the dvwa database
12. Getting all usernames and
passwords
1' UNION SELECT concat(user_id, ':', first_name, ':', last_name),
concat(user, ':', password) FROM [Link] #
Finally, we will extract all
usernames and passwords from
the users table and display the
results by concatenating the
values onto the rows visible to us
(in this instance “First name” and
“Surname”
Hashed Passwords
The passwords we have extracted are all hashed
When looking at the returned string, we can determine that this is likely an MD5 hash
Common passwords are easily reversed, and we can use websites to do this
In this instance, if we google the hashed password for admin, we will get a lot of website
hits, because “5f4dcc3b5aa765d61d8327deb882cf99” is the has of “password”
[Link] for “password”
[Link] (link to calculator)
Task: Attempt to get additional data
We know that a guestbook table exists in our dvwa database
Attempt to use SQL injection to extract the data from this table
Hints:
You will need to determine the table schema
You will have to use a combination of UNION SELECT and CONCAT to display the data as you did
for the user table.
