1 1 00:00:00,210 --> 00:00:02,610 Web application vulnerabilities. 2 2 00:00:02,610 --> 00:00:04,440 In this lesson, we're going to go through 3 3 00:00:04,440 --> 00:00:06,000 and do a little bit of analysis 4 4 00:00:06,000 --> 00:00:08,940 on the impact of web application vulnerabilities. 5 5 00:00:08,940 --> 00:00:10,620 Now, as we do this, we're going to take a look 6 6 00:00:10,620 --> 00:00:12,720 at a sample e-commerce website 7 7 00:00:12,720 --> 00:00:15,360 that's going to involve a web front end and a database backend. 8 8 00:00:15,360 --> 00:00:18,330 So we're first going to assess the database functionality 9 9 00:00:18,330 --> 00:00:20,910 then we're going to look at the website functionality. 10 10 00:00:20,910 --> 00:00:23,610 After that, we're going to test some injection vulnerabilities 11 11 00:00:23,610 --> 00:00:26,280 and then test some authentication vulnerabilities. 12 12 00:00:26,280 --> 00:00:28,320 And by doing this, we're going to be able to see 13 13 00:00:28,320 --> 00:00:30,630 if this website has any vulnerabilities 14 14 00:00:30,630 --> 00:00:33,360 that we need to address as a cybersecurity analyst. 15 15 00:00:33,360 --> 00:00:36,420 All right, let's jump into the lab environment. 16 16 00:00:36,420 --> 00:00:39,300 First, I need to test my database and my web server. 17 17 00:00:39,300 --> 00:00:41,310 So to do this, I need to make sure they're running. 18 18 00:00:41,310 --> 00:00:44,880 So I'm going to type in service, MySQL, start and hit enter. 19 19 00:00:44,880 --> 00:00:48,750 Then I'm going to type in service apache2 start and hit enter. 20 20 00:00:48,750 --> 00:00:50,610 This is going to start both the database server 21 21 00:00:50,610 --> 00:00:53,250 and the web server on my staging environment. 22 22 00:00:53,250 --> 00:00:55,080 Now from here, I'm going to open up the database 23 23 00:00:55,080 --> 00:00:56,910 administration using Firefox. 24 24 00:00:56,910 --> 00:00:58,950 To do this, I'll type in Firefox 25 25 00:00:58,950 --> 00:01:03,950 http://localhost/phpmyadmin and then Enter. 26 26 00:01:04,770 --> 00:01:06,960 At this point, Firefox will load up 27 27 00:01:06,960 --> 00:01:10,020 and I'll be brought to the login screen for php my admin. 28 28 00:01:10,020 --> 00:01:11,730 This is a web front end to interact 29 29 00:01:11,730 --> 00:01:13,350 with the backend database. 30 30 00:01:13,350 --> 00:01:14,940 From here, we'll be able to look at the tables 31 31 00:01:14,940 --> 00:01:17,580 inside the database and even run SQL queries. 32 32 00:01:17,580 --> 00:01:19,473 So all I'm going to do here is log in. 33 33 00:01:20,670 --> 00:01:22,140 Now that I'm in the backend 34 34 00:01:22,140 --> 00:01:24,990 I can click on dev tech_store 35 35 00:01:24,990 --> 00:01:27,300 which is the database that I want to look at. 36 36 00:01:27,300 --> 00:01:30,630 In here, you can see there is new, categories, products 37 37 00:01:30,630 --> 00:01:33,480 and users, and under categories, products and users. 38 38 00:01:33,480 --> 00:01:35,190 Those are my different tables. 39 39 00:01:35,190 --> 00:01:38,730 If I click on categories, I can see here the different rows 40 40 00:01:38,730 --> 00:01:40,950 that I'm going to have inside that table. 41 41 00:01:40,950 --> 00:01:43,020 Essentially, inside this table is a list 42 42 00:01:43,020 --> 00:01:44,610 of different product categories. 43 43 00:01:44,610 --> 00:01:45,900 Inside the ID column 44 44 00:01:45,900 --> 00:01:47,760 that's going to be our primary key 45 45 00:01:47,760 --> 00:01:49,500 and then the name column is going to list the name 46 46 00:01:49,500 --> 00:01:51,570 of each of the different product categories. 47 47 00:01:51,570 --> 00:01:53,910 There are a total of nine different categories here. 48 48 00:01:53,910 --> 00:01:56,400 Notice you can see the SQL statement at the top. 49 49 00:01:56,400 --> 00:01:59,430 It says select * from categories. 50 50 00:01:59,430 --> 00:02:00,600 That is what we're doing here. 51 51 00:02:00,600 --> 00:02:03,600 We're selecting everything from the categories table. 52 52 00:02:03,600 --> 00:02:06,810 Next, let's select the products table and review that data. 53 53 00:02:06,810 --> 00:02:08,250 Again, this is another table 54 54 00:02:08,250 --> 00:02:09,990 and it lists all the different products. 55 55 00:02:09,990 --> 00:02:11,220 Instead of looking at the categories 56 56 00:02:11,220 --> 00:02:13,650 we're looking at the individual products here, though. 57 57 00:02:13,650 --> 00:02:16,890 Each product has its own product code, description, price 58 58 00:02:16,890 --> 00:02:18,510 and whether or not it's going to be in stock 59 59 00:02:18,510 --> 00:02:20,460 and what category it belongs to. 60 60 00:02:20,460 --> 00:02:22,170 If we go and look at the user's table 61 61 00:02:22,170 --> 00:02:23,730 we can look at that data. 62 62 00:02:23,730 --> 00:02:25,740 Inside of here, we have a list of all the users 63 63 00:02:25,740 --> 00:02:27,450 who can sign into our website. 64 64 00:02:27,450 --> 00:02:29,790 Each user has a username, a password, 65 65 00:02:29,790 --> 00:02:32,820 a first name, a last name, and a level of permission. 66 66 00:02:32,820 --> 00:02:34,950 Now, notice one major vulnerability here. 67 67 00:02:34,950 --> 00:02:36,450 We are storing our usernames 68 68 00:02:36,450 --> 00:02:38,130 and passwords in plain text. 69 69 00:02:38,130 --> 00:02:39,720 So if you look in the password column 70 70 00:02:39,720 --> 00:02:41,400 you can see each person's password. 71 71 00:02:41,400 --> 00:02:43,500 This is a very dangerous practice. 72 72 00:02:43,500 --> 00:02:45,870 Instead, those passwords should have been hashed 73 73 00:02:45,870 --> 00:02:47,280 and then the hash should have been stored 74 74 00:02:47,280 --> 00:02:48,600 inside the database. 75 75 00:02:48,600 --> 00:02:51,810 Now look at the URL that's used to access this data. 76 76 00:02:51,810 --> 00:02:54,330 Notice it calls sql.php 77 77 00:02:54,330 --> 00:02:57,120 and that's a script that we're going to use, it's a PHP script. 78 78 00:02:57,120 --> 00:02:59,490 Now, when it does this it actually gives you parameters 79 79 00:02:59,490 --> 00:03:00,990 from the database. 80 80 00:03:00,990 --> 00:03:03,780 This is going to be something like the database, the table 81 81 00:03:03,780 --> 00:03:05,730 and the position within the table. 82 82 00:03:05,730 --> 00:03:08,190 So if we look under the SQL statement again here 83 83 00:03:08,190 --> 00:03:10,050 we can click the edit link, 84 84 00:03:10,050 --> 00:03:12,330 and from here we can change this SQL statement 85 85 00:03:12,330 --> 00:03:13,830 to say whatever we want. 86 86 00:03:13,830 --> 00:03:16,890 For example, if I wanted to see who has admin permissions 87 87 00:03:16,890 --> 00:03:19,860 I can type in select * from users 88 88 00:03:19,860 --> 00:03:22,410 where permissions equals admin. 89 89 00:03:22,410 --> 00:03:25,410 And this will actually return just one record for us. 90 90 00:03:25,410 --> 00:03:27,690 This website is going to go into that database 91 91 00:03:27,690 --> 00:03:30,210 using scripting languages like PHP 92 92 00:03:30,210 --> 00:03:33,060 to pass those SQL statements in a secure way 93 93 00:03:33,060 --> 00:03:36,030 so the user can't inject additional parameters. 94 94 00:03:36,030 --> 00:03:39,420 Now, as we see this php my admin, this is an admin tool. 95 95 00:03:39,420 --> 00:03:41,880 This is not where our users are going to be inputting data. 96 96 00:03:41,880 --> 00:03:44,160 Instead, they're going to do it from the website. 97 97 00:03:44,160 --> 00:03:47,340 So let's go ahead and take a look at the website itself. 98 98 00:03:47,340 --> 00:03:48,870 First, we're going to open the browser 99 99 00:03:48,870 --> 00:03:52,440 and go to http://devtech, 100 100 00:03:52,440 --> 00:03:54,420 which is a sample e-commerce website 101 101 00:03:54,420 --> 00:03:56,340 here inside my lab environment. 102 102 00:03:56,340 --> 00:03:58,080 Now, this is the website for the store 103 103 00:03:58,080 --> 00:04:00,240 and it's running on my local Apache web server 104 104 00:04:00,240 --> 00:04:02,580 that I started up at the beginning of this video. 105 105 00:04:02,580 --> 00:04:05,070 If you select the catalog tab, you're going to be able to see 106 106 00:04:05,070 --> 00:04:07,770 all the products inside the monitors category. 107 107 00:04:07,770 --> 00:04:09,810 They're all listed here from a table. 108 108 00:04:09,810 --> 00:04:13,440 Note that the URL here that's used to serve this webpage. 109 109 00:04:13,440 --> 00:04:15,330 It doesn't have that SQL query anymore. 110 110 00:04:15,330 --> 00:04:19,290 Instead, it says catalog.php:category=1 111 111 00:04:19,290 --> 00:04:21,960 which is selecting the first category, which was monitors. 112 112 00:04:21,960 --> 00:04:23,310 Now, there are better ways of doing this 113 113 00:04:23,310 --> 00:04:25,110 and this isn't necessarily the most secure way 114 114 00:04:25,110 --> 00:04:28,650 or the least secure way, it's just one way of doing things. 115 115 00:04:28,650 --> 00:04:31,230 Now, here we're actually passing in a parameter directly 116 116 00:04:31,230 --> 00:04:33,330 by saying category equals one. 117 117 00:04:33,330 --> 00:04:34,650 That means if this was something that was 118 118 00:04:34,650 --> 00:04:36,540 behind a secure paywall, for instance, 119 119 00:04:36,540 --> 00:04:38,310 we wouldn't want to do this because somebody could easily 120 120 00:04:38,310 --> 00:04:39,930 change that one to a two 121 121 00:04:39,930 --> 00:04:42,330 and that would select a different category directly. 122 122 00:04:42,330 --> 00:04:43,710 Next, I want to go ahead 123 123 00:04:43,710 --> 00:04:46,020 and try testing injection vulnerabilities. 124 124 00:04:46,020 --> 00:04:47,760 To do this, I'm going to put the website 125 125 00:04:47,760 --> 00:04:49,050 on the right side of my screen 126 126 00:04:49,050 --> 00:04:52,230 and the php my admin on the left side of my screen. 127 127 00:04:52,230 --> 00:04:54,180 Now from here, what we're going to do is we're going to verify 128 128 00:04:54,180 --> 00:04:56,070 the URL that's passing the parameters, 129 129 00:04:56,070 --> 00:04:58,230 in this case, category equals N, 130 130 00:04:58,230 --> 00:05:00,180 in this case, it was category equals one, 131 131 00:05:00,180 --> 00:05:02,370 to make sure that we're viewing the right category. 132 132 00:05:02,370 --> 00:05:03,630 So what I'm going to do is I'm actually going to go 133 133 00:05:03,630 --> 00:05:05,730 to the insertion point at the end of the URL 134 134 00:05:05,730 --> 00:05:08,100 and I'm going to add a space, and then I'm going to type 135 135 00:05:08,100 --> 00:05:11,190 or one equals one, which as you remember from our lessons 136 136 00:05:11,190 --> 00:05:13,350 one equals one is a very common way 137 137 00:05:13,350 --> 00:05:15,360 of doing an SQL injection. 138 138 00:05:15,360 --> 00:05:17,700 Now, once we do this, we're going to see what happens. 139 139 00:05:17,700 --> 00:05:19,350 Notice here that the listing page 140 140 00:05:19,350 --> 00:05:21,450 still says we're in the monitors category 141 141 00:05:21,450 --> 00:05:23,010 but we're not seeing just monitors. 142 142 00:05:23,010 --> 00:05:26,430 We're seeing every single product that this company has. 143 143 00:05:26,430 --> 00:05:29,430 That's because we just injected this or one equals one 144 144 00:05:29,430 --> 00:05:30,990 making every statement true 145 145 00:05:30,990 --> 00:05:33,090 and not just to display category one. 146 146 00:05:33,090 --> 00:05:35,580 This is a basic SQL injection. 147 147 00:05:35,580 --> 00:05:37,380 Now notice in the SQL query section 148 148 00:05:37,380 --> 00:05:39,420 we can verify the query that we executed based 149 149 00:05:39,420 --> 00:05:41,850 on the URL we inserted from the webpage. 150 150 00:05:41,850 --> 00:05:43,890 Notice the query is selecting four columns 151 151 00:05:43,890 --> 00:05:45,150 from the products table. 152 152 00:05:45,150 --> 00:05:47,340 Anytime it finds the product category is N, 153 153 00:05:47,340 --> 00:05:49,950 in our case one, or where one equals one. 154 154 00:05:49,950 --> 00:05:53,310 And because one equals one every single time, guess what? 155 155 00:05:53,310 --> 00:05:55,110 It's going to dump every single category 156 156 00:05:55,110 --> 00:05:56,700 all at once to the screen. 157 157 00:05:56,700 --> 00:05:58,680 Now that we've tested injection vulnerabilities 158 158 00:05:58,680 --> 00:06:01,470 let's go ahead and test an authentication vulnerability. 159 159 00:06:01,470 --> 00:06:02,910 We're going to go into the sign-in tab 160 160 00:06:02,910 --> 00:06:05,370 and we're going to attempt to sign in as Kevin. 161 161 00:06:05,370 --> 00:06:07,770 Now, when we try to sign in, if we don't know his password 162 162 00:06:07,770 --> 00:06:10,710 we're going to get an error and it's not going to let us sign in. 163 163 00:06:10,710 --> 00:06:12,660 Now, we don't have the ability to crack his password 164 164 00:06:12,660 --> 00:06:16,050 at this point, so instead, let's try an SQL injection. 165 165 00:06:16,050 --> 00:06:18,060 Now here we're going to put Kevin as the username 166 166 00:06:18,060 --> 00:06:19,680 and try to put something in the password field 167 167 00:06:19,680 --> 00:06:22,320 to cause a malicious SQL statement to be formed. 168 168 00:06:22,320 --> 00:06:24,000 This is an SQL injection. 169 169 00:06:24,000 --> 00:06:28,470 So if I do something like X and then a quote space 170 170 00:06:28,470 --> 00:06:33,270 or space quote X quote equals quote x, 171 171 00:06:33,270 --> 00:06:35,400 that will be able to do an SQL injection for us 172 172 00:06:35,400 --> 00:06:38,100 because the quote is going to break apart from that password 173 173 00:06:38,100 --> 00:06:39,990 and then test the second half of the statement, 174 174 00:06:39,990 --> 00:06:41,910 or something equals something. 175 175 00:06:41,910 --> 00:06:43,380 And so let's see how this looks. 176 176 00:06:43,380 --> 00:06:45,300 Now to see what I actually typed in, we're going to go 177 177 00:06:45,300 --> 00:06:48,420 and right click on the field and do inspect element. 178 178 00:06:48,420 --> 00:06:50,280 This will allow us to see what was there 179 179 00:06:50,280 --> 00:06:51,930 inside of the field. 180 180 00:06:51,930 --> 00:06:53,730 In HTML when it's a password field, 181 181 00:06:53,730 --> 00:06:56,730 it's going to show up with stars or dots instead of the text. 182 182 00:06:56,730 --> 00:06:58,860 So I'm going to change that password field to text 183 183 00:06:58,860 --> 00:07:01,140 and that will allow us to see what I actually put in. 184 184 00:07:01,140 --> 00:07:03,210 So now we'll go ahead and click on the sign-in button 185 185 00:07:03,210 --> 00:07:05,910 and you'll see that it sends that to the MySQL database. 186 186 00:07:05,910 --> 00:07:07,410 And we get back an error 187 187 00:07:07,410 --> 00:07:09,630 inside the database giving us a warning saying 188 188 00:07:09,630 --> 00:07:11,700 that there was a perimeter of one to be expected 189 189 00:07:11,700 --> 00:07:13,140 but instead we got the results 190 190 00:07:13,140 --> 00:07:17,270 of /var/www/devtech_store 191 191 00:07:17,270 --> 00:07:21,870 /html/sign in.php on line 37. 192 192 00:07:21,870 --> 00:07:24,180 Essentially, we caused an error in the program 193 193 00:07:24,180 --> 00:07:25,530 by doing this injection 194 194 00:07:25,530 --> 00:07:28,020 but we were still able to successfully sign in. 195 195 00:07:28,020 --> 00:07:29,580 Now notice we are logged in 196 196 00:07:29,580 --> 00:07:31,020 but we're not logged in as Kevin. 197 197 00:07:31,020 --> 00:07:33,180 It says Welcome comma space period. 198 198 00:07:33,180 --> 00:07:36,000 It doesn't say Welcome, Kevin. Why is that? 199 199 00:07:36,000 --> 00:07:38,190 Well, because our malicious query took advantage 200 200 00:07:38,190 --> 00:07:40,230 of the default apostrophe formatting, 201 201 00:07:40,230 --> 00:07:42,420 and because there was no sanitized input 202 202 00:07:42,420 --> 00:07:44,070 because they didn't do input validation, 203 203 00:07:44,070 --> 00:07:46,080 I was able to do an SQL injection. 204 204 00:07:46,080 --> 00:07:47,700 By doing that, it's going to go and look 205 205 00:07:47,700 --> 00:07:50,130 for the first authentication in the table. 206 206 00:07:50,130 --> 00:07:51,870 In our case, that first person 207 207 00:07:51,870 --> 00:07:53,850 is actually going to be Laura Anderson 208 208 00:07:53,850 --> 00:07:55,650 and that's the person who has administrative privileges. 209 209 00:07:55,650 --> 00:07:57,990 So we are now logged in as Laura Anderson, 210 210 00:07:57,990 --> 00:07:59,130 the database administrator. 211 211 00:07:59,130 --> 00:08:02,190 So you can see how powerful SQL injections can be 212 212 00:08:02,190 --> 00:08:03,450 and how easy they are to conduct 213 213 00:08:03,450 --> 00:08:05,190 when somebody doesn't do the right protections 214 214 00:08:05,190 --> 00:08:06,150 on their website 215 215 00:08:06,150 --> 00:08:08,250 either on the front end using input validation 216 216 00:08:08,250 --> 00:08:10,440 through the website, or on the backend 217 217 00:08:10,440 --> 00:08:12,690 when they don't have things configured quite right. 218 218 00:08:12,690 --> 00:08:15,150 Now in CySA+, it's not your job to figure out 219 219 00:08:15,150 --> 00:08:16,770 how to fix all these things 220 220 00:08:16,770 --> 00:08:18,270 but it is your job to figure out 221 221 00:08:18,270 --> 00:08:20,280 if they're vulnerable to these types of attacks. 222 222 00:08:20,280 --> 00:08:22,740 And so you need to understand what an SQL injection is, 223 223 00:08:22,740 --> 00:08:24,720 and usually when you see something like one equals one 224 224 00:08:24,720 --> 00:08:27,240 or X equals x, that's a dead giveaway. 225 225 00:08:27,240 --> 00:08:29,520 Now on the exam, if you're asked how to fix something 226 226 00:08:29,520 --> 00:08:32,820 like this, the best answer is going to be input validation. 227 227 00:08:32,820 --> 00:08:34,560 If they had done input validation on the website 228 228 00:08:34,560 --> 00:08:37,050 and took away my ability to insert that apostrophe 229 229 00:08:37,050 --> 00:08:38,670 it would've prevented this SQL injection 230 230 00:08:38,670 --> 00:08:40,370 from occurring in the first place.