1
00:00:00,210 --> 00:00:01,500
In this lesson, I'm going to show you

2
00:00:01,500 --> 00:00:03,690
how to conduct an SQL injection.

3
00:00:03,690 --> 00:00:05,610
Now for the exam, you are not going to be expected

4
00:00:05,610 --> 00:00:07,800
to use any of the tools I'm about to show you,

5
00:00:07,800 --> 00:00:10,200
and this is just for your education and awareness

6
00:00:10,200 --> 00:00:11,670
of how easy it is for an attacker

7
00:00:11,670 --> 00:00:13,410
to perform an SQL injection,

8
00:00:13,410 --> 00:00:15,030
so you can understand why it's so important

9
00:00:15,030 --> 00:00:17,700
to use input validation and input sanitization

10
00:00:17,700 --> 00:00:20,310
to prevent an SQL injection from occurring.

11
00:00:20,310 --> 00:00:22,110
Now as I go through this demonstration,

12
00:00:22,110 --> 00:00:25,200
I want you to focus just on the idea of what is being done

13
00:00:25,200 --> 00:00:28,080
and not the specific tools or commands that I'm using,

14
00:00:28,080 --> 00:00:30,030
because all of these are things you'll learn about

15
00:00:30,030 --> 00:00:32,880
if you go on to PenTest+ later on in the future.

16
00:00:32,880 --> 00:00:34,650
All right, let's go ahead and get started.

17
00:00:34,650 --> 00:00:36,750
So to begin this SQL injection,

18
00:00:36,750 --> 00:00:39,990
we first need an SQL injection vulnerable website

19
00:00:39,990 --> 00:00:41,010
or database.

20
00:00:41,010 --> 00:00:43,290
And so, on the left of my screen you can see

21
00:00:43,290 --> 00:00:46,480
the Damn Vulnerable Web App v1.0.7,

22
00:00:46,480 --> 00:00:48,390
which is being run inside

23
00:00:48,390 --> 00:00:50,790
the Metasploitable 2 virtual machine.

24
00:00:50,790 --> 00:00:53,280
My calling machine is going to make a connection to it,

25
00:00:53,280 --> 00:00:54,480
which I've done here,

26
00:00:54,480 --> 00:00:56,880
to be able to access this website.

27
00:00:56,880 --> 00:00:58,650
Now the way this form works is,

28
00:00:58,650 --> 00:00:59,970
if you put in a user ID,

29
00:00:59,970 --> 00:01:03,390
for instance, record number 2, and hit submit,

30
00:01:03,390 --> 00:01:06,660
that will pop up the first and last name of the person.

31
00:01:06,660 --> 00:01:09,510
That's all this database interaction is doing for us.

32
00:01:09,510 --> 00:01:12,120
Now what I want to do is I want to be able to grab

33
00:01:12,120 --> 00:01:15,660
that information, stop it from being sent to the web server

34
00:01:15,660 --> 00:01:18,450
from my browser by using my web proxy,

35
00:01:18,450 --> 00:01:21,450
and then I can capture the data from it that I need.

36
00:01:21,450 --> 00:01:23,370
To do that I have to go

37
00:01:23,370 --> 00:01:26,940
to my proxy setting inside of Burp Suite.

38
00:01:26,940 --> 00:01:30,480
And right now you can see my intercept is on.

39
00:01:30,480 --> 00:01:32,730
Now, I need to configure my web browser

40
00:01:32,730 --> 00:01:34,560
to actually use that proxy.

41
00:01:34,560 --> 00:01:36,560
So, I'm going to go down to my preferences,

42
00:01:38,250 --> 00:01:41,100
and from preferences we're going to go to advanced,

43
00:01:41,100 --> 00:01:42,240
click on Network

44
00:01:42,240 --> 00:01:44,850
and then click on Settings under Connection.

45
00:01:44,850 --> 00:01:47,370
From here we can set up the manual proxy

46
00:01:47,370 --> 00:01:48,660
and I'm going to use the local host,

47
00:01:48,660 --> 00:01:52,500
127.0.0.1 on Port 8080.

48
00:01:52,500 --> 00:01:55,710
This will tell it to use my Burp Suite tool.

49
00:01:55,710 --> 00:01:57,510
So if I go ahead and close that,

50
00:01:57,510 --> 00:02:00,930
now if I go in and say I want to get record number 3,

51
00:02:00,930 --> 00:02:02,070
notice when I submit it,

52
00:02:02,070 --> 00:02:04,440
I don't get the answer back in my web browser

53
00:02:04,440 --> 00:02:06,870
because my web browser hasn't actually made a connection

54
00:02:06,870 --> 00:02:08,310
to the web server

55
00:02:08,310 --> 00:02:09,690
that's going to give me that information.

56
00:02:09,690 --> 00:02:11,730
Instead, it's sent it to the right,

57
00:02:11,730 --> 00:02:14,190
over to Burp Suite, which has captured it.

58
00:02:14,190 --> 00:02:16,500
And notice that Burp Suite now has

59
00:02:16,500 --> 00:02:18,360
that cookie information that I need.

60
00:02:18,360 --> 00:02:20,040
It tells me the security level,

61
00:02:20,040 --> 00:02:22,230
it tells me the PHP session ID,

62
00:02:22,230 --> 00:02:24,030
and I'm going to be able to use that as part

63
00:02:24,030 --> 00:02:26,400
of my attack against this web server.

64
00:02:26,400 --> 00:02:28,530
So, the first thing I want to do is I want to capture some

65
00:02:28,530 --> 00:02:29,363
of this information.

66
00:02:29,363 --> 00:02:31,110
First, I need to know the website

67
00:02:31,110 --> 00:02:32,040
that we were trying to go to.

68
00:02:32,040 --> 00:02:33,990
So I'm going to go ahead and copy that

69
00:02:33,990 --> 00:02:36,810
and I'm going to go ahead and go into my terminal.

70
00:02:36,810 --> 00:02:37,920
And so what we're going to do is

71
00:02:37,920 --> 00:02:40,620
we're going to use "sqlmap -u"

72
00:02:40,620 --> 00:02:43,080
and we're going to provide the website that we're going to.

73
00:02:43,080 --> 00:02:45,390
So I'm just going to paste that in

74
00:02:45,390 --> 00:02:49,200
and then I'm going to use --cookie=

75
00:02:50,220 --> 00:02:52,980
and I'm going to copy the information from my cookie.

76
00:02:52,980 --> 00:02:53,813
So I'm going to go ahead

77
00:02:53,813 --> 00:02:56,070
and bring that back over to Burp Suite

78
00:02:56,070 --> 00:02:59,403
and we will copy this cookie information.

79
00:03:03,990 --> 00:03:05,583
And then we will paste that in.

80
00:03:10,980 --> 00:03:13,923
And from there we're going to go ahead and hit enter.

81
00:03:16,020 --> 00:03:18,540
So, at this point it's going to start querying the database.

82
00:03:18,540 --> 00:03:19,560
The first thing you notice is,

83
00:03:19,560 --> 00:03:21,600
is that this is an MySQL database.

84
00:03:21,600 --> 00:03:24,270
So it's asking, "Do I want to skip all the test payloads

85
00:03:24,270 --> 00:03:25,530
for other databases?"

86
00:03:25,530 --> 00:03:26,363
And in this case,

87
00:03:26,363 --> 00:03:28,590
we're going to just use the default of "Yes."

88
00:03:28,590 --> 00:03:29,970
And it's going to say, "Do you want to include all

89
00:03:29,970 --> 00:03:31,410
of the tests from MySQL?"

90
00:03:31,410 --> 00:03:33,420
And we'll go ahead and say, "Yes."

91
00:03:33,420 --> 00:03:36,090
And it's going to go through and start querying that database

92
00:03:36,090 --> 00:03:38,670
and trying to do different injections.

93
00:03:38,670 --> 00:03:40,410
So you'll notice here that it is trying

94
00:03:40,410 --> 00:03:44,070
to do different testing based on the version of MySQL,

95
00:03:44,070 --> 00:03:46,470
trying to do things that are stack queries

96
00:03:46,470 --> 00:03:49,830
and other errors to figure out what this is vulnerable to.

97
00:03:49,830 --> 00:03:52,530
So now it finds that it found an ID parameter

98
00:03:52,530 --> 00:03:56,137
that was vulnerable, that said ID=2 or ID=3.

99
00:03:56,137 --> 00:03:57,420
"Do we want to keep testing others?"

100
00:03:57,420 --> 00:03:58,260
We'll go ahead and say, "No,"

101
00:03:58,260 --> 00:04:00,710
because we already found a way into this database.

102
00:04:02,010 --> 00:04:04,320
And now we're going to see everything that it found.

103
00:04:04,320 --> 00:04:06,520
So if I go ahead and scroll up a little bit,

104
00:04:08,910 --> 00:04:11,190
we find that the GET ID is vulnerable.

105
00:04:11,190 --> 00:04:12,900
We also found that it was vulnerable

106
00:04:12,900 --> 00:04:14,760
based on a Boolean-based blind.

107
00:04:14,760 --> 00:04:17,940
It was vulnerable based on an AND/OR time-based blind,

108
00:04:17,940 --> 00:04:20,640
and it was vulnerable based on a UNION query.

109
00:04:20,640 --> 00:04:21,899
We also were able to find out

110
00:04:21,899 --> 00:04:25,350
that the web server was Linux Ubuntu 8.04.

111
00:04:25,350 --> 00:04:26,880
We found the version of Apache,

112
00:04:26,880 --> 00:04:28,170
the version of PHP,

113
00:04:28,170 --> 00:04:30,360
and the version of this database.

114
00:04:30,360 --> 00:04:32,340
And all that information is now saved

115
00:04:32,340 --> 00:04:36,030
to this file, as shown in green on the screen.

116
00:04:36,030 --> 00:04:38,850
But that really didn't give me a lot of details yet

117
00:04:38,850 --> 00:04:39,750
that I want to use.

118
00:04:39,750 --> 00:04:42,540
It just tells me information about our target.

119
00:04:42,540 --> 00:04:44,250
And so now what I want to do is I want

120
00:04:44,250 --> 00:04:45,360
to enumerate the databases.

121
00:04:45,360 --> 00:04:49,890
So I'm going to add a --dbs at the end and hit enter.

122
00:04:49,890 --> 00:04:51,120
This is going to go through and find

123
00:04:51,120 --> 00:04:53,580
what databases are on that server.

124
00:04:53,580 --> 00:04:56,190
Notice it found seven databases.

125
00:04:56,190 --> 00:04:59,640
DVWA, Information Schema, Metasploit,

126
00:04:59,640 --> 00:05:01,995
MySQL, Owasp 10,

127
00:05:01,995 --> 00:05:04,950
TikiWiki and TikiWiki195.

128
00:05:04,950 --> 00:05:07,890
Now the one we want to target here is the DVWA,

129
00:05:07,890 --> 00:05:09,240
the Damn Vulnerable Web App.

130
00:05:09,240 --> 00:05:11,400
And so now that we know what database we want to target,

131
00:05:11,400 --> 00:05:12,960
which is the DVWA,

132
00:05:12,960 --> 00:05:15,090
I want to select that database with my command.

133
00:05:15,090 --> 00:05:17,280
So I'm going to go arrow up again,

134
00:05:17,280 --> 00:05:20,400
go backspace, put a capital -D,

135
00:05:20,400 --> 00:05:21,960
which stands for database,

136
00:05:21,960 --> 00:05:23,850
and the database I want to select.

137
00:05:23,850 --> 00:05:25,830
And then I want to enumerate it for the table,

138
00:05:25,830 --> 00:05:28,590
to figure out what tables exist inside that database.

139
00:05:28,590 --> 00:05:31,620
So I'm going to put --tables

140
00:05:31,620 --> 00:05:33,600
and that will tell me what tables are associated with it.

141
00:05:33,600 --> 00:05:37,080
Go ahead and hit enter and it goes through and scans

142
00:05:37,080 --> 00:05:41,250
and it finds two tables, guestbook, and users.

143
00:05:41,250 --> 00:05:43,740
So now I want to be able to dump the columns

144
00:05:43,740 --> 00:05:44,573
from those tables.

145
00:05:44,573 --> 00:05:46,950
Again, I went from the database down to the table.

146
00:05:46,950 --> 00:05:48,600
Now I want to dig in a little bit further

147
00:05:48,600 --> 00:05:50,070
and get those columns.

148
00:05:50,070 --> 00:05:52,650
So to do that we're going to arrow up,

149
00:05:52,650 --> 00:05:54,510
we're going to backspace out of tables

150
00:05:54,510 --> 00:05:57,180
and do -T and give it the table we want,

151
00:05:57,180 --> 00:05:58,680
which is users.

152
00:05:58,680 --> 00:06:00,483
And then --columns.

153
00:06:02,280 --> 00:06:03,240
And off we go.

154
00:06:03,240 --> 00:06:07,170
We now have six columns, the user, avatar,

155
00:06:07,170 --> 00:06:10,170
first name, last name, password, and user ID.

156
00:06:10,170 --> 00:06:12,120
Wouldn't it be great if we can get those passwords

157
00:06:12,120 --> 00:06:13,260
for those users?

158
00:06:13,260 --> 00:06:14,190
I think it would.

159
00:06:14,190 --> 00:06:16,470
So let's go a little bit further here.

160
00:06:16,470 --> 00:06:18,270
And what we're going to do is arrow up,

161
00:06:18,270 --> 00:06:21,813
take out the word columns and put in the word dump.

162
00:06:23,460 --> 00:06:24,997
And here we go.

163
00:06:24,997 --> 00:06:27,570
"Do we want to save this hashes to a temporary file?"

164
00:06:27,570 --> 00:06:28,830
We'll say, "No."

165
00:06:28,830 --> 00:06:31,110
And what it's doing is it's grabbing any password hashes

166
00:06:31,110 --> 00:06:32,520
from the password column

167
00:06:32,520 --> 00:06:35,130
and it's going to attempt to do a dictionary attack

168
00:06:35,130 --> 00:06:36,750
to crack them.

169
00:06:36,750 --> 00:06:37,710
And then we're just going to go ahead

170
00:06:37,710 --> 00:06:40,593
and use the standard default dictionary of number 1.

171
00:06:41,730 --> 00:06:43,500
And, "Do we want to use common suffixes?"

172
00:06:43,500 --> 00:06:45,600
No, we're just going to use the default things.

173
00:06:45,600 --> 00:06:47,040
And it's grabbed those hashes

174
00:06:47,040 --> 00:06:49,230
and it's already starting to crack those passwords.

175
00:06:49,230 --> 00:06:51,270
Notice that I already have a password for charley

176
00:06:51,270 --> 00:06:54,270
and ABC1 and password and letmein.

177
00:06:54,270 --> 00:06:56,280
And here it is on the screen.

178
00:06:56,280 --> 00:06:58,860
And so you can see that the first user ID is admin

179
00:06:58,860 --> 00:07:01,410
and their password in parentheses is password.

180
00:07:01,410 --> 00:07:02,940
The second user is gordonb,

181
00:07:02,940 --> 00:07:05,370
and his password was abc123.

182
00:07:05,370 --> 00:07:07,740
The third username was 1337

183
00:07:07,740 --> 00:07:09,510
and their password was charley.

184
00:07:09,510 --> 00:07:11,610
The fourth was pablo with letmein.

185
00:07:11,610 --> 00:07:13,890
And the fifth was smithy with password.

186
00:07:13,890 --> 00:07:15,540
Again, these were all very simple passwords

187
00:07:15,540 --> 00:07:16,373
and easy to crack,

188
00:07:16,373 --> 00:07:19,500
but you can see the power of an SQL injection.

189
00:07:19,500 --> 00:07:21,690
We can interact directly with that database

190
00:07:21,690 --> 00:07:25,110
because we've been able to break through the PHP front end

191
00:07:25,110 --> 00:07:27,240
and be able to inject into the database

192
00:07:27,240 --> 00:07:28,440
and get information back

193
00:07:28,440 --> 00:07:30,330
that we shouldn't be able to get back.

194
00:07:30,330 --> 00:07:33,240
And because sqlmap is such an easy to use program,

195
00:07:33,240 --> 00:07:36,813
it makes our injections very automated and very easy to use.