1 1 00:00:00,120 --> 00:00:02,220 Analyzing Web Applications. 2 2 00:00:02,220 --> 00:00:04,200 In this lesson, we're going to go through 3 3 00:00:04,200 --> 00:00:07,080 a couple of different ways to look at web applications. 4 4 00:00:07,080 --> 00:00:09,930 We're going to use Nikto, which is a vulnerability scanner. 5 5 00:00:09,930 --> 00:00:12,810 We're going to use Burp Suite, which is an interception proxy, 6 6 00:00:12,810 --> 00:00:14,610 and we're even going to go through and look 7 7 00:00:14,610 --> 00:00:17,970 at some SQL injections and some hands-on injections. 8 8 00:00:17,970 --> 00:00:19,950 So let's go ahead and get started. 9 9 00:00:19,950 --> 00:00:22,110 What I'm going to do first is jump into my lab environment 10 10 00:00:22,110 --> 00:00:23,970 and we're going to start with Nikto. 11 11 00:00:23,970 --> 00:00:27,900 As I said, Nikto is a web application vulnerability scanner. 12 12 00:00:27,900 --> 00:00:30,750 If you think about Nessus and Qualys and things like that, 13 13 00:00:30,750 --> 00:00:33,720 those are used against your infrastructure servers, 14 14 00:00:33,720 --> 00:00:35,790 routers, switches, and hosts. 15 15 00:00:35,790 --> 00:00:38,160 But if you want to look at a web application in-depth, 16 16 00:00:38,160 --> 00:00:40,050 you really want to use something like Nikto. 17 17 00:00:40,050 --> 00:00:41,610 So you're going to go into your terminal 18 18 00:00:41,610 --> 00:00:44,370 and you're going to run the command nikto -host 19 19 00:00:44,370 --> 00:00:46,350 and the IP of the host you're trying to scan. 20 20 00:00:46,350 --> 00:00:49,530 In my case, it's 10.1.0.10. 21 21 00:00:49,530 --> 00:00:50,580 Now, once you do that, 22 22 00:00:50,580 --> 00:00:52,950 you're going to see some of the issues that were found. 23 23 00:00:52,950 --> 00:00:54,660 For instance, you can see on this first line 24 24 00:00:54,660 --> 00:00:57,870 that the server is an Apache 2.4.6 server 25 25 00:00:57,870 --> 00:00:59,667 being run on CentOS. 26 26 00:00:59,667 --> 00:01:01,320 Now as you go through, you can see there are 27 27 00:01:01,320 --> 00:01:03,810 some anti-clickjacking options that are not present. 28 28 00:01:03,810 --> 00:01:04,890 You can see some cross-site 29 29 00:01:04,890 --> 00:01:07,080 scripting protection headers are not defined. 30 30 00:01:07,080 --> 00:01:10,260 You can see some X-Content-Type-Options is not set, 31 31 00:01:10,260 --> 00:01:11,093 and as you go down, 32 32 00:01:11,093 --> 00:01:13,140 you're going to see all the different vulnerabilities. 33 33 00:01:13,140 --> 00:01:14,550 As you get even further down, 34 34 00:01:14,550 --> 00:01:17,010 you're going to see things that say OSVDB, 35 35 00:01:17,010 --> 00:01:19,230 which are some vulnerability database files 36 36 00:01:19,230 --> 00:01:21,600 that are going to tell you exactly what was tested. 37 37 00:01:21,600 --> 00:01:24,120 So you could see that under 877, 38 38 00:01:24,120 --> 00:01:26,970 there is an HTTP TRACE method that is activated, 39 39 00:01:26,970 --> 00:01:29,790 and this suggests that the host is vulnerable to an attack. 40 40 00:01:29,790 --> 00:01:30,780 And so as you go through, 41 41 00:01:30,780 --> 00:01:33,060 you can identify each of these different things, 42 42 00:01:33,060 --> 00:01:35,340 and then you can look them up, research them, 43 43 00:01:35,340 --> 00:01:37,620 and figure out how to solve those issues. 44 44 00:01:37,620 --> 00:01:40,290 Now the next thing we want to do is test our website 45 45 00:01:40,290 --> 00:01:42,270 and look at it from a probing perspective 46 46 00:01:42,270 --> 00:01:43,920 for directories and files. 47 47 00:01:43,920 --> 00:01:46,980 We can do this using a different plugin inside of Nikto. 48 48 00:01:46,980 --> 00:01:51,980 So I'm going to use nikto -host 10.1.0.10 -plugins, 49 49 00:01:52,710 --> 00:01:54,330 and then the plugin I want to use, 50 50 00:01:54,330 --> 00:01:56,430 in my case, it's going to be a dictionary 51 51 00:01:56,430 --> 00:02:01,430 under dictionary:/usr/share/wordlists/dirb/common.txt. 52 52 00:02:03,810 --> 00:02:05,910 When I do that, I'm going to be able to run a scan 53 53 00:02:05,910 --> 00:02:09,270 for common file and directory names on that server. 54 54 00:02:09,270 --> 00:02:11,820 Next, let's run a command to find any files 55 55 00:02:11,820 --> 00:02:13,920 that require authorization to view. 56 56 00:02:13,920 --> 00:02:18,920 I can do this by using nikto -host 10.1.0.10 -display 57 57 00:02:19,830 --> 00:02:21,360 and the number 4. 58 58 00:02:21,360 --> 00:02:22,470 Note, this will show me 59 59 00:02:22,470 --> 00:02:24,840 all of the files that are now identified 60 60 00:02:24,840 --> 00:02:27,720 that would've required authorization to view. 61 61 00:02:27,720 --> 00:02:29,640 The next thing I want to do is try to perform 62 62 00:02:29,640 --> 00:02:32,670 a credentialed scan against that web application 63 63 00:02:32,670 --> 00:02:35,610 and I want to save that output as an HTML report. 64 64 00:02:35,610 --> 00:02:37,140 Nikto can do this as well. 65 65 00:02:37,140 --> 00:02:42,140 We're going to type in nikto -host http://10.1.0.10/dvwa, 66 66 00:02:45,240 --> 00:02:47,580 which is the web application that I want to go after, 67 67 00:02:47,580 --> 00:02:49,710 then -ID and the credentials, 68 68 00:02:49,710 --> 00:02:53,010 in my case admin with a password of password. 69 69 00:02:53,010 --> 00:02:55,470 And then I want to output that by using -o 70 70 00:02:55,470 --> 00:03:00,470 and then/root/downloads/dvwa.htm 71 71 00:03:00,720 --> 00:03:03,690 and then -format and put it into HTML format, 72 72 00:03:03,690 --> 00:03:05,820 so I'll type in htm. 73 73 00:03:05,820 --> 00:03:08,580 Once I do that, I'm going to now have that file 74 74 00:03:08,580 --> 00:03:11,820 inside that root directory underneath the downloads folder. 75 75 00:03:11,820 --> 00:03:14,670 If I want to see that, because it's an HTML file, 76 76 00:03:14,670 --> 00:03:16,500 I need to open it using Firefox. 77 77 00:03:16,500 --> 00:03:21,500 So I'll type in firefox /root/Downloads/dvwa.html 78 78 00:03:23,310 --> 00:03:26,820 and this will show me all of the information in that report. 79 79 00:03:26,820 --> 00:03:28,320 Now as I go through that report, 80 80 00:03:28,320 --> 00:03:30,780 I can see all of the different issues that were found. 81 81 00:03:30,780 --> 00:03:33,390 For instance, there's directory indexing not found, 82 82 00:03:33,390 --> 00:03:34,890 there's configuration information 83 83 00:03:34,890 --> 00:03:36,330 that could be remotely available, 84 84 00:03:36,330 --> 00:03:38,640 and there's other things like that as we go through it, 85 85 00:03:38,640 --> 00:03:41,100 for instance, this PHP reveal that's being shown 86 86 00:03:41,100 --> 00:03:43,050 where sensitive information is being displayed 87 87 00:03:43,050 --> 00:03:46,080 to the client as they go into that application. 88 88 00:03:46,080 --> 00:03:48,240 So these are all just a quick summary 89 89 00:03:48,240 --> 00:03:49,440 of some of the issues we found 90 90 00:03:49,440 --> 00:03:51,420 with this vulnerable web application. 91 91 00:03:51,420 --> 00:03:52,950 Now, the next thing I want to test, 92 92 00:03:52,950 --> 00:03:54,360 is I want to move beyond Nikto 93 93 00:03:54,360 --> 00:03:55,380 So we've done Nikto, 94 94 00:03:55,380 --> 00:03:58,680 and we have some good baseline knowledge of how this works. 95 95 00:03:58,680 --> 00:04:00,840 Now, let's move into Burp Suite. 96 96 00:04:00,840 --> 00:04:02,940 Burp Suite is an interception proxy, 97 97 00:04:02,940 --> 00:04:05,520 and so the first thing I need to do is configure it. 98 98 00:04:05,520 --> 00:04:07,380 To be able to configure an interception proxy, 99 99 00:04:07,380 --> 00:04:09,630 I have to set up my proxy on my web browser. 100 100 00:04:09,630 --> 00:04:11,700 So I'm going to go into my web browser 101 101 00:04:11,700 --> 00:04:16,080 and I'm going to type in about:preferences #advanced 102 102 00:04:16,080 --> 00:04:17,220 and then press Enter. 103 103 00:04:17,220 --> 00:04:18,747 When I do this, it's going to bring up a page 104 104 00:04:18,747 --> 00:04:20,970 and I need to scroll all the way to the end of the page 105 105 00:04:20,970 --> 00:04:22,710 and click Settings. 106 106 00:04:22,710 --> 00:04:24,990 Once I click on Settings, I now need to select 107 107 00:04:24,990 --> 00:04:27,510 the manual proxy configuration radio button, 108 108 00:04:27,510 --> 00:04:30,180 and then type in the web proxies address, 109 109 00:04:30,180 --> 00:04:35,180 in my case, 127.0.0.1, that's my local host, 110 110 00:04:35,250 --> 00:04:38,040 that's the machine where I'm going to be running Burp Suite. 111 111 00:04:38,040 --> 00:04:40,740 Then under the port, I'm going to type in 8080 112 112 00:04:40,740 --> 00:04:43,230 which is the common HTTP proxy port, 113 113 00:04:43,230 --> 00:04:45,660 And then I'm going to check Use this proxy server 114 114 00:04:45,660 --> 00:04:47,010 for all protocols. 115 115 00:04:47,010 --> 00:04:49,800 So anything running on this machine that uses the network 116 116 00:04:49,800 --> 00:04:53,430 will use this local host as my proxy. 117 117 00:04:53,430 --> 00:04:55,740 And then I'm going to click Okay. 118 118 00:04:55,740 --> 00:04:57,630 And next I need to open up Burp Suite, 119 119 00:04:57,630 --> 00:05:00,750 and I need to accept the default configurations. 120 120 00:05:00,750 --> 00:05:02,730 Now we're ready to start inspecting sessions 121 121 00:05:02,730 --> 00:05:04,320 and header data. 122 122 00:05:04,320 --> 00:05:06,300 To do this, we are going to use Burp Suite 123 123 00:05:06,300 --> 00:05:08,760 to monitor and record those web sessions. 124 124 00:05:08,760 --> 00:05:10,110 This will allow us to inspect it, 125 125 00:05:10,110 --> 00:05:12,360 and, if we want, modify the data 126 126 00:05:12,360 --> 00:05:14,850 that's going between the browser and the server. 127 127 00:05:14,850 --> 00:05:17,100 This can include things like your headers, your cookies, 128 128 00:05:17,100 --> 00:05:18,900 and your form field submissions. 129 129 00:05:18,900 --> 00:05:21,600 Now, the first thing I want to do is click on the Proxy tab 130 130 00:05:21,600 --> 00:05:23,970 and then click the Intercept is on button 131 131 00:05:23,970 --> 00:05:26,340 to toggle that intercept off. 132 132 00:05:26,340 --> 00:05:29,670 Now, I want to arrange my Firefox and my Burp Suite windows 133 133 00:05:29,670 --> 00:05:32,550 so I can see both of them as I'm going through this process. 134 134 00:05:32,550 --> 00:05:35,070 So you'll see I have them on the left and the right. 135 135 00:05:35,070 --> 00:05:36,900 In Firefox, I'm going to go to the website 136 136 00:05:36,900 --> 00:05:37,740 that I want to look at, 137 137 00:05:37,740 --> 00:05:41,703 in my case, www.515support.com/dvwa. 138 138 00:05:43,680 --> 00:05:45,930 And then I'm going to log into that web application 139 139 00:05:45,930 --> 00:05:47,490 using my credentials. 140 140 00:05:47,490 --> 00:05:50,550 Now, as a regular user, I have user names and passwords. 141 141 00:05:50,550 --> 00:05:52,530 In this case, I have admin as the username 142 142 00:05:52,530 --> 00:05:54,390 and password as the password. 143 143 00:05:54,390 --> 00:05:58,350 Now in Burp Suite, I can click on the HTTP History tab 144 144 00:05:58,350 --> 00:06:00,330 and this is going to list all the different requests 145 145 00:06:00,330 --> 00:06:03,450 that have been proxied while Burp Suite was on. 146 146 00:06:03,450 --> 00:06:05,430 Now, if I select the GET row, 147 147 00:06:05,430 --> 00:06:08,670 I can see the request here for dvwa. 148 148 00:06:08,670 --> 00:06:10,260 Note the servers response here, 149 149 00:06:10,260 --> 00:06:13,410 they're issuing a redirect to the login page. 150 150 00:06:13,410 --> 00:06:15,120 Now, if I select the GET row, 151 151 00:06:15,120 --> 00:06:18,810 requesting that dvwa/login.php form, 152 152 00:06:18,810 --> 00:06:21,900 this is going to show me exactly what happened here. 153 153 00:06:21,900 --> 00:06:22,733 I can go ahead 154 154 00:06:22,733 --> 00:06:24,570 and check the output of the various tabs here, 155 155 00:06:24,570 --> 00:06:28,320 things like Raw, Headers, HTML, and Render, 156 156 00:06:28,320 --> 00:06:31,380 and as I look at those, I can see the browser's request 157 157 00:06:31,380 --> 00:06:33,360 and the server's response. 158 158 00:06:33,360 --> 00:06:35,160 Now you can see here that the application 159 159 00:06:35,160 --> 00:06:37,080 has set two different cookies. 160 160 00:06:37,080 --> 00:06:38,850 One is to identify the security level 161 161 00:06:38,850 --> 00:06:39,900 that we're going to be issued, 162 162 00:06:39,900 --> 00:06:42,570 and the other is to set up a session ID. 163 163 00:06:42,570 --> 00:06:45,360 Now remember HTTP is a stateless protocol, 164 164 00:06:45,360 --> 00:06:47,940 so if I want to be able to tell who is talking to my server, 165 165 00:06:47,940 --> 00:06:49,020 I have to use cookies 166 166 00:06:49,020 --> 00:06:51,510 or some other session management technique. 167 167 00:06:51,510 --> 00:06:53,700 All right, now if I select the POST row, 168 168 00:06:53,700 --> 00:06:54,870 I can see the information 169 169 00:06:54,870 --> 00:06:57,030 that was submitted from my browser. 170 170 00:06:57,030 --> 00:06:59,640 In here, you can actually view the clear text credentials 171 171 00:06:59,640 --> 00:07:01,020 inside of Burp suite. 172 172 00:07:01,020 --> 00:07:03,420 So I can see that the username was admin 173 173 00:07:03,420 --> 00:07:05,220 and the password was password, 174 174 00:07:05,220 --> 00:07:07,080 and that they used this user token 175 175 00:07:07,080 --> 00:07:08,790 of this random long string. 176 176 00:07:08,790 --> 00:07:11,460 Now why could I see this credential information? 177 177 00:07:11,460 --> 00:07:15,090 Well, because we use HTTP instead of HTTPS. 178 178 00:07:15,090 --> 00:07:16,800 And so you can see why it's so important 179 179 00:07:16,800 --> 00:07:18,210 that you use secure connections 180 180 00:07:18,210 --> 00:07:21,420 when you're transiting information back and forth. 181 181 00:07:21,420 --> 00:07:23,100 The next thing I want to start working on 182 182 00:07:23,100 --> 00:07:25,080 is testing command injection. 183 183 00:07:25,080 --> 00:07:27,360 And so to do this, I'm going to go into the browser 184 184 00:07:27,360 --> 00:07:29,190 and select the Command Injection tab 185 185 00:07:29,190 --> 00:07:31,770 in the DVWA web application. 186 186 00:07:31,770 --> 00:07:34,050 Now, obviously in a real world experience 187 187 00:07:34,050 --> 00:07:35,820 the attack would have to spend a lot of time 188 188 00:07:35,820 --> 00:07:37,440 mapping out pages and forms 189 189 00:07:37,440 --> 00:07:39,720 and finding things through their reconnaissance, 190 190 00:07:39,720 --> 00:07:43,560 but DVWA is built for us as cybersecurity analysts 191 191 00:07:43,560 --> 00:07:46,830 to be able to use this with known sets of bad issues 192 192 00:07:46,830 --> 00:07:48,180 so we can test things against it 193 193 00:07:48,180 --> 00:07:50,130 and see what they look like in the field. 194 194 00:07:50,130 --> 00:07:52,920 Now when we do this, we see that there is a box here 195 195 00:07:52,920 --> 00:07:55,050 that's going to allow us to put a command in. 196 196 00:07:55,050 --> 00:07:56,940 Now, it's supposed to be used for the ping command, 197 197 00:07:56,940 --> 00:07:59,070 but if somebody didn't program this right, 198 198 00:07:59,070 --> 00:08:01,620 that means you might be able to run any command you want. 199 199 00:08:01,620 --> 00:08:03,180 So let's go ahead and try it. 200 200 00:08:03,180 --> 00:08:06,780 All right, so I'm going to enter 10.1.0.1 in the box 201 201 00:08:06,780 --> 00:08:08,220 and click Submit. 202 202 00:08:08,220 --> 00:08:11,100 This is going to allow me to ping that device, that web server. 203 203 00:08:11,100 --> 00:08:12,360 Now that works great, 204 204 00:08:12,360 --> 00:08:15,780 but what if this person didn't do their coding right? 205 205 00:08:15,780 --> 00:08:17,730 And instead of just issuing the ping command, 206 206 00:08:17,730 --> 00:08:19,920 I could issue other commands, maybe. 207 207 00:08:19,920 --> 00:08:21,600 Well, let's try a couple of Linux commands 208 208 00:08:21,600 --> 00:08:24,120 and see if we can do a command injection. 209 209 00:08:24,120 --> 00:08:27,420 Let's try inserting LS and typing Submit. 210 210 00:08:27,420 --> 00:08:28,590 What do we see? 211 211 00:08:28,590 --> 00:08:30,570 Nothing, it didn't work for us. 212 212 00:08:30,570 --> 00:08:32,250 All right, let's try something else. 213 213 00:08:32,250 --> 00:08:36,000 Let's try typing in 10.1.0.1 like we did before, 214 214 00:08:36,000 --> 00:08:36,950 and then put && ls. 215 215 00:08:38,640 --> 00:08:39,990 What happens this time? 216 216 00:08:39,990 --> 00:08:40,920 Well, there you go. 217 217 00:08:40,920 --> 00:08:42,690 We got the ping that we are expecting, 218 218 00:08:42,690 --> 00:08:44,940 but we also got the directory listing, 219 219 00:08:44,940 --> 00:08:47,340 so we were able to do a command injection here. 220 220 00:08:47,340 --> 00:08:48,780 Let's go ahead and try another one. 221 221 00:08:48,780 --> 00:08:53,580 Let's try 1 && ps -e. 222 222 00:08:53,580 --> 00:08:55,230 This will tell us if it's going to accept anything 223 223 00:08:55,230 --> 00:08:57,543 with a number first and then going from there. 224 224 00:08:58,440 --> 00:08:59,790 Well, that one didn't do anything. 225 225 00:08:59,790 --> 00:09:01,590 Hmm, let's try something else. 226 226 00:09:01,590 --> 00:09:06,070 Let's try putting in 10.1.0.1 && ps -e and click Submit. 227 227 00:09:08,310 --> 00:09:09,420 Yes, that one worked. 228 228 00:09:09,420 --> 00:09:12,330 It does the ping and then it shows me the processes 229 229 00:09:12,330 --> 00:09:13,920 that are being executed here. 230 230 00:09:13,920 --> 00:09:15,660 So it is allowing me to do command chaining, 231 231 00:09:15,660 --> 00:09:17,550 as long as I start with an IP address. 232 232 00:09:17,550 --> 00:09:18,720 Let's try some more. 233 233 00:09:18,720 --> 00:09:23,370 How about 10.1.0.1 && netstat -tlnp 234 234 00:09:24,690 --> 00:09:26,070 and then click Submit. 235 235 00:09:26,070 --> 00:09:27,840 Is this going to work? 236 236 00:09:27,840 --> 00:09:28,950 Yes, it is. 237 237 00:09:28,950 --> 00:09:30,210 We're going to get that ping 238 238 00:09:30,210 --> 00:09:32,340 and then the executing of that command, 239 239 00:09:32,340 --> 00:09:34,530 because we're chaining these commands together 240 240 00:09:34,530 --> 00:09:35,970 inside this box. 241 241 00:09:35,970 --> 00:09:38,820 It appears to me that all this box is doing 242 242 00:09:38,820 --> 00:09:41,250 is checking "Did you put in an IP address?" 243 243 00:09:41,250 --> 00:09:43,050 And it's going to execute that by a ping. 244 244 00:09:43,050 --> 00:09:44,820 And then if you use the &&, 245 245 00:09:44,820 --> 00:09:47,070 you could put any command you want afterwards. 246 246 00:09:47,070 --> 00:09:49,290 So, I might be able to access files. 247 247 00:09:49,290 --> 00:09:53,259 For instance, what if I could go in there and use 10.1.0.1, 248 248 00:09:53,259 --> 00:09:58,259 && cat/etc/password and click Submit. 249 249 00:09:58,590 --> 00:09:59,423 Look at that. 250 250 00:09:59,423 --> 00:10:00,390 We were able to get the ping, 251 251 00:10:00,390 --> 00:10:02,640 and then we got the password file. 252 252 00:10:02,640 --> 00:10:03,990 Well, if we get the password file, 253 253 00:10:03,990 --> 00:10:05,850 let's go ahead and grab the shadow file. 254 254 00:10:05,850 --> 00:10:10,850 Let's try 10.1.0.1 && cat/etc/shadow 255 255 00:10:11,910 --> 00:10:12,990 and click Submit. 256 256 00:10:12,990 --> 00:10:16,230 Now, unfortunately reading the shadow file didn't work. 257 257 00:10:16,230 --> 00:10:17,370 Why is that? 258 258 00:10:17,370 --> 00:10:18,600 Well, because the shadow file 259 259 00:10:18,600 --> 00:10:20,010 has specific permissions on it 260 260 00:10:20,010 --> 00:10:22,170 to protect it from things like this happening. 261 261 00:10:22,170 --> 00:10:25,680 Now, the command cat/etc/shadow did work, 262 262 00:10:25,680 --> 00:10:28,020 but it couldn't display the shadow file 263 263 00:10:28,020 --> 00:10:30,360 because that shadow file is protected. 264 264 00:10:30,360 --> 00:10:31,410 Now, to confirm this, 265 265 00:10:31,410 --> 00:10:33,570 let's go ahead and check a couple more commands. 266 266 00:10:33,570 --> 00:10:38,400 Let's try 10.1.0.1 && whoami. 267 267 00:10:38,400 --> 00:10:41,160 This will tell us who we are actually operating as. 268 268 00:10:41,160 --> 00:10:43,020 And in this case you could see we're operating 269 269 00:10:43,020 --> 00:10:44,970 as the user known as Apache 270 270 00:10:44,970 --> 00:10:47,340 because we're running it through the web server. 271 271 00:10:47,340 --> 00:10:49,500 Let's go ahead and see if we can get some more information. 272 272 00:10:49,500 --> 00:10:54,000 What if we did 10.1.0.1 && getent passwd 0. 273 273 00:10:57,900 --> 00:10:59,220 What is this going to do? 274 274 00:10:59,220 --> 00:11:01,470 Well, this is going to get us the root user, 275 275 00:11:01,470 --> 00:11:03,210 which is user ID zero. 276 276 00:11:03,210 --> 00:11:05,580 It's going to get their information from the password file 277 277 00:11:05,580 --> 00:11:07,590 and display it to the screen. 278 278 00:11:07,590 --> 00:11:08,423 Now, if we do this 279 279 00:11:08,423 --> 00:11:09,840 and we want to see what the group is for that, 280 280 00:11:09,840 --> 00:11:14,840 we could try that by doing 10.1 0.01 && getent group 281 281 00:11:15,960 --> 00:11:16,950 and then root. 282 282 00:11:16,950 --> 00:11:18,270 And when we do that, you're going to see 283 283 00:11:18,270 --> 00:11:21,360 that we have the root user is a member with group X 284 284 00:11:21,360 --> 00:11:23,433 and is the user ID of zero. 285 285 00:11:24,300 --> 00:11:27,270 Next, let's go ahead and try doing some fuzzed input 286 286 00:11:27,270 --> 00:11:29,520 and see if that's going to do anything for us. 287 287 00:11:29,520 --> 00:11:30,690 So, what we're going to do here is 288 288 00:11:30,690 --> 00:11:32,490 instead of just inventing different commands 289 289 00:11:32,490 --> 00:11:34,440 to throw at this misbehaving inbox, 290 290 00:11:34,440 --> 00:11:36,720 we can start doing a more structured approach 291 291 00:11:36,720 --> 00:11:38,700 by sending in fuzz data. 292 292 00:11:38,700 --> 00:11:39,780 This is a fuzzer 293 293 00:11:39,780 --> 00:11:43,080 and essentially we can use Burp Suite as that fuzzer. 294 294 00:11:43,080 --> 00:11:44,970 This will help us to automate a lot of this testing 295 295 00:11:44,970 --> 00:11:45,803 instead of me sitting here 296 296 00:11:45,803 --> 00:11:47,700 and typing in all these commands by myself. 297 297 00:11:47,700 --> 00:11:50,700 So let's go ahead and click on the SQL Injections tab 298 298 00:11:50,700 --> 00:11:54,060 and here we're going to type a 1 in the box and click Submit. 299 299 00:11:54,060 --> 00:11:56,430 When we do that, we see what the function is supposed to do. 300 300 00:11:56,430 --> 00:11:57,930 When you give it a user ID, 301 301 00:11:57,930 --> 00:12:00,330 it's going to give you their first name and their last name, 302 302 00:12:00,330 --> 00:12:03,060 in this case Admin and Admin. 303 303 00:12:03,060 --> 00:12:06,180 Now in Burp Suite, if I go to the HTTP history tab, 304 304 00:12:06,180 --> 00:12:08,160 I can Right Click on that last request 305 305 00:12:08,160 --> 00:12:10,140 and click Send to Intruder. 306 306 00:12:10,140 --> 00:12:12,000 Now, once I go to the Intruder tab 307 307 00:12:12,000 --> 00:12:13,620 within the intruder module, 308 308 00:12:13,620 --> 00:12:15,390 I can select the Positions tab 309 309 00:12:15,390 --> 00:12:17,250 and then click the clear button. 310 310 00:12:17,250 --> 00:12:20,610 Here, I'm going to select the character 1 following the ID= 311 311 00:12:20,610 --> 00:12:23,880 in the first line, and then I'm going to click Add. 312 312 00:12:23,880 --> 00:12:26,190 Next, I'm going to click on the Payloads tab 313 313 00:12:26,190 --> 00:12:28,410 and from here I'm going to click the Load button 314 314 00:12:28,410 --> 00:12:29,243 and then browse to 315 315 00:12:29,243 --> 00:12:33,760 /user/share/wordless/wfuzz/injections/sql.txt. 316 316 00:12:37,200 --> 00:12:39,390 And then I'll click Start attack. 317 317 00:12:39,390 --> 00:12:40,980 Now what is this doing? 318 318 00:12:40,980 --> 00:12:43,320 Well, what I just did was I selected the variable 319 319 00:12:43,320 --> 00:12:45,870 that I want to change, that ID=1, 320 320 00:12:45,870 --> 00:12:47,580 and I want to start putting ID= 321 321 00:12:47,580 --> 00:12:50,190 whatever the lines are of this SQL file. 322 322 00:12:50,190 --> 00:12:52,380 And so this is going to automate my attack for me. 323 323 00:12:52,380 --> 00:12:54,030 So as I go through, it's going to go through 324 324 00:12:54,030 --> 00:12:55,770 and put each and every one in there. 325 325 00:12:55,770 --> 00:12:57,210 And as that attack progresses, 326 326 00:12:57,210 --> 00:12:59,190 you're going to observe the length column. 327 327 00:12:59,190 --> 00:13:01,560 The unmodified input is going to return a page 328 328 00:13:01,560 --> 00:13:04,440 that is 4868 bytes in length. 329 329 00:13:04,440 --> 00:13:07,680 Now if you look at the response with a length of 4809, 330 330 00:13:07,680 --> 00:13:09,420 you're going to see they're basically blank, 331 331 00:13:09,420 --> 00:13:10,440 while anything smaller 332 332 00:13:10,440 --> 00:13:13,200 has returned an unformatted error message. 333 333 00:13:13,200 --> 00:13:15,240 Now, if we want to sort the output by length, 334 334 00:13:15,240 --> 00:13:16,920 we can click on the length column 335 335 00:13:16,920 --> 00:13:18,510 and then we can look for any response 336 336 00:13:18,510 --> 00:13:21,540 that's larger than 4868. 337 337 00:13:21,540 --> 00:13:24,750 For instance, I have one that is 5176. 338 338 00:13:24,750 --> 00:13:29,750 This is a apostrophe or 1=1 or quote=apostrophe. 339 339 00:13:31,200 --> 00:13:32,820 Now what does that look like to you? 340 340 00:13:32,820 --> 00:13:35,460 To me, it looks like an SQL injection, right? 341 341 00:13:35,460 --> 00:13:36,480 And if you look through this, 342 342 00:13:36,480 --> 00:13:38,580 all of these different things being shown here 343 343 00:13:38,580 --> 00:13:41,580 that are above that threshold of 4868 344 344 00:13:41,580 --> 00:13:44,700 are different forms of SQL injections. 345 345 00:13:44,700 --> 00:13:46,260 Now, I want you to look at the response 346 346 00:13:46,260 --> 00:13:48,150 for anything with that single quote payload 347 347 00:13:48,150 --> 00:13:50,490 because again this is a simple SQL statement. 348 348 00:13:50,490 --> 00:13:53,610 And basically if this form that we have on the DVWA 349 349 00:13:53,610 --> 00:13:55,320 isn't doing input validation, 350 350 00:13:55,320 --> 00:13:58,470 it's going to allow me to do these SQL injections. 351 351 00:13:58,470 --> 00:14:00,240 All right, enough of that for now, let's go ahead 352 352 00:14:00,240 --> 00:14:02,790 and close the Intruder window to stop our attack. 353 353 00:14:02,790 --> 00:14:04,020 All right, so now that we know 354 354 00:14:04,020 --> 00:14:06,180 that this thing is vulnerable to SQL injection, 355 355 00:14:06,180 --> 00:14:08,040 let's take a look at the code itself, 356 356 00:14:08,040 --> 00:14:09,930 and do a manual analysis of it 357 357 00:14:09,930 --> 00:14:12,060 so we can review that vulnerable code. 358 358 00:14:12,060 --> 00:14:13,560 If I switch back to my browser 359 359 00:14:13,560 --> 00:14:15,630 and I click on the SQL injection page, 360 360 00:14:15,630 --> 00:14:18,720 I can click it and then look at View Source. 361 361 00:14:18,720 --> 00:14:21,480 When I do this, the source code is going to pop up. 362 362 00:14:21,480 --> 00:14:23,880 When we look at that, we're going to compare all levels 363 363 00:14:23,880 --> 00:14:25,710 by clicking on that button. 364 364 00:14:25,710 --> 00:14:28,200 Now, as we compare each iteration of the code, 365 365 00:14:28,200 --> 00:14:30,300 we can see that the higher security code 366 366 00:14:30,300 --> 00:14:33,510 has some input validation, while the lower ones don't. 367 367 00:14:33,510 --> 00:14:37,170 For example, you can see the is numeric function here 368 368 00:14:37,170 --> 00:14:38,970 within this first if block. 369 369 00:14:38,970 --> 00:14:41,370 Now, basically what this does is any input that comes in 370 370 00:14:41,370 --> 00:14:43,860 is checked using if it's numeric. 371 371 00:14:43,860 --> 00:14:46,110 And if it is numeric, it's going to process it. 372 372 00:14:46,110 --> 00:14:48,660 If it is not numeric, it's going to delete it 373 373 00:14:48,660 --> 00:14:49,950 and just ignore that. 374 374 00:14:49,950 --> 00:14:53,130 This essentially is a basic form of input validation. 375 375 00:14:53,130 --> 00:14:55,740 Now, this only is going to check this number, 376 376 00:14:55,740 --> 00:14:57,090 this input, if it is a number 377 377 00:14:57,090 --> 00:15:00,150 because we're expecting ID to equal some number, 378 378 00:15:00,150 --> 00:15:02,340 and so we want to prevent anything else from being there. 379 379 00:15:02,340 --> 00:15:05,400 So if I put apostrophe, that would prevent this, right? 380 380 00:15:05,400 --> 00:15:07,200 Because it's not numeric. 381 381 00:15:07,200 --> 00:15:08,310 Now you'll notice at the bottom, 382 382 00:15:08,310 --> 00:15:09,780 under the commented code here, 383 383 00:15:09,780 --> 00:15:11,730 we also have this little validation statement 384 384 00:15:11,730 --> 00:15:14,340 that's going to make sure only one result is returned. 385 385 00:15:14,340 --> 00:15:15,600 So if I put in a number one, 386 386 00:15:15,600 --> 00:15:18,390 I should only get the first entry, the Admin/Admin. 387 387 00:15:18,390 --> 00:15:20,820 If I put in two, I should get that for the second user, 388 388 00:15:20,820 --> 00:15:22,890 and not the third, fourth, and fifth user. 389 389 00:15:22,890 --> 00:15:24,570 This should only give us one row at a time 390 390 00:15:24,570 --> 00:15:25,830 from the database. 391 391 00:15:25,830 --> 00:15:26,663 And so you can see here, 392 392 00:15:26,663 --> 00:15:29,820 that the data inside the row count has to be equal to one. 393 393 00:15:29,820 --> 00:15:31,350 If it is, get the values. 394 394 00:15:31,350 --> 00:15:33,240 If not, we're going to ignore it. 395 395 00:15:33,240 --> 00:15:34,073 So that's the way 396 396 00:15:34,073 --> 00:15:35,670 that we can do some basic input validation. 397 397 00:15:35,670 --> 00:15:37,920 So this is a good input validation method 398 398 00:15:37,920 --> 00:15:39,633 to prevent an SQL injection.