In this lesson, I'm going to show you
how to conduct an SQL injection.
Now for the exam, you are not going to be expected
to use any of the tools I'm about to show you,
and this is just for your education and awareness
of how easy it is for an attacker
to perform an SQL injection,
so you can understand why it's so important
to use input validation and input sanitization
to prevent an SQL injection from occurring.
Now as I go through this demonstration,
I want you to focus just on the idea of what is being done
and not the specific tools or commands that I'm using,
because all of these are things you'll learn about
if you go on to PenTest+ later on in the future.
All right, let's go ahead and get started.
So to begin this SQL injection,
we first need an SQL injection vulnerable website
or database.
And so, on the left of my screen you can see
the Damn Vulnerable Web App v1.0.7,
which is being run inside
the Metasploitable 2 virtual machine.
My calling machine is going to make a connection to it,
which I've done here,
to be able to access this website.
Now the way this form works is,
if you put in a user ID,
for instance, record number 2, and hit submit,
that will pop up the first and last name of the person.
That's all this database interaction is doing for us.
Now what I want to do is I want to be able to grab
that information, stop it from being sent to the web server
from my browser by using my web proxy,
and then I can capture the data from it that I need.
To do that I have to go
to my proxy setting inside of Burp Suite.
And right now you can see my intercept is on.
Now, I need to configure my web browser
to actually use that proxy.
So, I'm going to go down to my preferences,
and from preferences we're going to go to advanced,
click on Network
and then click on Settings under Connection.
From here we can set up the manual proxy
and I'm going to use the local host,
127.0.0.1 on Port 8080.
This will tell it to use my Burp Suite tool.
So if I go ahead and close that,
now if I go in and say I want to get record number 3,
notice when I submit it,
I don't get the answer back in my web browser
because my web browser hasn't actually made a connection
to the web server
that's going to give me that information.
Instead, it's sent it to the right,
over to Burp Suite, which has captured it.
And notice that Burp Suite now has
that cookie information that I need.
It tells me the security level,
it tells me the PHP session ID,
and I'm going to be able to use that as part
of my attack against this web server.
So, the first thing I want to do is I want to capture some
of this information.
First, I need to know the website
that we were trying to go to.
So I'm going to go ahead and copy that
and I'm going to go ahead and go into my terminal.
And so what we're going to do is
we're going to use "sqlmap -u"
and we're going to provide the website that we're going to.
So I'm just going to paste that in
and then I'm going to use --cookie=
and I'm going to copy the information from my cookie.
So I'm going to go ahead
and bring that back over to Burp Suite
and we will copy this cookie information.
And then we will paste that in.
And from there we're going to go ahead and hit enter.
So, at this point it's going to start querying the database.
The first thing you notice is,
is that this is an MySQL database.
So it's asking, "Do I want to skip all the test payloads
for other databases?"
And in this case,
we're going to just use the default of "Yes."
And it's going to say, "Do you want to include all
of the tests from MySQL?"
And we'll go ahead and say, "Yes."
And it's going to go through and start querying that database
and trying to do different injections.
So you'll notice here that it is trying
to do different testing based on the version of MySQL,
trying to do things that are stack queries
and other errors to figure out what this is vulnerable to.
So now it finds that it found an ID parameter
that was vulnerable, that said ID=2 or ID=3.
"Do we want to keep testing others?"
We'll go ahead and say, "No,"
because we already found a way into this database.
And now we're going to see everything that it found.
So if I go ahead and scroll up a little bit,
we find that the GET ID is vulnerable.
We also found that it was vulnerable
based on a Boolean-based blind.
It was vulnerable based on an AND/OR time-based blind,
and it was vulnerable based on a UNION query.
We also were able to find out
that the web server was Linux Ubuntu 8.04.
We found the version of Apache,
the version of PHP,
and the version of this database.
And all that information is now saved
to this file, as shown in green on the screen.
But that really didn't give me a lot of details yet
that I want to use.
It just tells me information about our target.
And so now what I want to do is I want
to enumerate the databases.
So I'm going to add a --dbs at the end and hit enter.
This is going to go through and find
what databases are on that server.
Notice it found seven databases.
DVWA, Information Schema, Metasploit,
MySQL, Owasp 10,
TikiWiki and TikiWiki195.
Now the one we want to target here is the DVWA,
the Damn Vulnerable Web App.
And so now that we know what database we want to target,
which is the DVWA,
I want to select that database with my command.
So I'm going to go arrow up again,
go backspace, put a capital -D,
which stands for database,
and the database I want to select.
And then I want to enumerate it for the table,
to figure out what tables exist inside that database.
So I'm going to put --tables
and that will tell me what tables are associated with it.
Go ahead and hit enter and it goes through and scans
and it finds two tables, guestbook, and users.
So now I want to be able to dump the columns
from those tables.
Again, I went from the database down to the table.
Now I want to dig in a little bit further
and get those columns.
So to do that we're going to arrow up,
we're going to backspace out of tables
and do -T and give it the table we want,
which is users.
And then --columns.
And off we go.
We now have six columns, the user, avatar,
first name, last name, password, and user ID.
Wouldn't it be great if we can get those passwords
for those users?
I think it would.
So let's go a little bit further here.
And what we're going to do is arrow up,
take out the word columns and put in the word dump.
And here we go.
"Do we want to save this hashes to a temporary file?"
We'll say, "No."
And what it's doing is it's grabbing any password hashes
from the password column
and it's going to attempt to do a dictionary attack
to crack them.
And then we're just going to go ahead
and use the standard default dictionary of number 1.
And, "Do we want to use common suffixes?"
No, we're just going to use the default things.
And it's grabbed those hashes
and it's already starting to crack those passwords.
Notice that I already have a password for charley
and ABC1 and password and letmein.
And here it is on the screen.
And so you can see that the first user ID is admin
and their password in parentheses is password.
The second user is gordonb,
and his password was abc123.
The third username was 1337
and their password was charley.
The fourth was pablo with letmein.
And the fifth was smithy with password.
Again, these were all very simple passwords
and easy to crack,
but you can see the power of an SQL injection.
We can interact directly with that database
because we've been able to break through the PHP front end
and be able to inject into the database
and get information back
that we shouldn't be able to get back.
And because sqlmap is such an easy to use program,
it makes our injections very automated and very easy to use.