Instructor: Welcome back.
Let's talk about another big vulnerability
in web applications that involves databases
and that is called SQL injection.
So we already talked about how this works.
So you find a user input on a website
that communicates with the database.
Usually, those inputs are something like usernames
or passwords or a page
where you're searching for some type of a product.
Once you input product,
the website communicates with the database to see
if it has it.
Then the database responds back.
And all of that is done with the help
of SQL language and SQL queries.
But as usual, user input might not be well filtered,
and we might be able to inject SQL code there
and send our own SQL queries to the database.
Maybe on that website there are online accounts
and their passwords are stored in a database.
If we were to find SQL injection on a website like that,
we could potentially extract usernames
and passwords of all of the accounts
through that SQL injection.
This is an example of how an SQL query could look like.
It is very similar to English language.
And what this statement essentially does
is it selects some type of element from a table
where some condition is fulfilled.
And table is just a part of database.
Databases are consisted of tables and columns.
Now, I will be real right here.
If you are encountering SQL injection
for the first time or SQL language for the first time,
you might find this a little bit hard.
However, through practice,
this will become easier and easier.
Here, we can see an example of
how a real-world SQL query could look like.
Here, books are our table from the database,
ID is our condition,
and this star sign indicates
that we want to extract everything.
Usually, in programming world, star sign means everything.
Great.
Now that we know behind the scenes
of how an SQL injection works,
let's try to perform one on our DVWA page.
So let's go right here,
log in as usual to our DVWA page.
And let's first select the DVWA security to low
and navigate to the SQL injection.
Now, you might notice that we also have SQL injection blind.
And this is something that we are going
to talk about later on.
For now, let's just focus on this SQL Injection tab.
So what do we have right here?
We have something called user ID.
And usually, we would input something
like a number right here.
So let's give it a try.
If we, for example, input number one and click on Submit,
well, it'll tell me that the ID
of one is a user with the first name admin
and surname admin.
And that user has ID one.
What if we type two, for example?
We click on Submit.
Well, we got a user with ID two.
His name is Gordon, and his last name is Brown.
And we can go for each and every number if we want.
For example, the ID five has first name Bob
and last name Smith.
But to search for the SQL injection,
what we can do is we can type some special characters,
and that might throw an error
if there is an SQL injection.
For example, if I type apostrophe
or a single quote and I click on Submit,
it'll throw me this error.
It'll say, "You have an error in your SQL syntax;
check the manual that corresponds
to your MySQL server version
for the right syntax to use near line one."
And this already is an indication
that we have SQL injection bug
since it interpreted our apostrophe as a part of SQL syntax.
So for now, we know that there is an SQL error
because we got an SQL error syntax.
But before we continue,
let's first explain why does this give an error.
Why using a single quote gives us an error.
Well, let me show you like this.
If I open terminal,
let's just go and find a program
that will allow us to write text.
And here we got some text editor
under the Usual Applications.
I'm going to open that,
and I'm going to enlarge it just
so we can type something right here.
And now that we've opened this,
let's explain why apostrophe gives an error in SQL syntax.
Well, as we already mentioned in our slides,
usually, we will have an SQL syntax
or an SQL query that will look something like this.
So SELECT, and then something from a certain table
where some condition is fulfilled.
And for our page right here, if I go back,
since we have user IDs, first names, and last names,
it could possibly look something like this.
So SELECT Name, comma, Surname
FROM the table that could be named something like accounts.
We don't know that yet.
Where ID equals,
and then the ID number goes between single quotes.
So this could possibly be our SQL query
that we send to the database,
and then the database retrieves the user under the ID two.
But what happens when we type apostrophe
is instead of this two
and instead of it filtering the apostrophe,
it just writes it between these two single quotes.
And then we get three single quotes:
The opening single quote,
and then our single quote
that we injected becomes the closing single quote,
and then the third one is the single quote that's hanging.
It doesn't belong to anything.
Therefore, the SQL throws an error
that it has one single quote more than it should have.
And whenever that happens, you got an SQL injection bug.
And this is also called the error-based SQL injection
because it throws us an error.
On the other hand,
we got the blind SQL injection that doesn't throw an error.
So there are some other methods
that we must use for that one
in order to figure out whether it exists.
Now that we know that there is an SQL injection,
what we can do is we can type some other statements as well.
For example, we can select the ID number two,
and then close the single quote inside of that SQL query.
And we can type some logical statement
such as, for example, and 1 = 1.
And keep in mind that this right here,
if I copy it and write it down,
has single quotes between the numbers.
And it doesn't have the single quote at the end
because inside of our SQL query,
we already have a single quote at the end.
So this single quote will cover the last part of this one,
and this first single quote will cover the first part
of this two.
So essentially, once added to our as SQL query,
it would look something like this.
Instead of this single quote, we would have this.
And you can see this opening
and closing single quote fulfills our statement.
Let's give it a try and run this.
And we'll just get the information
about user under the ID two.
And that is because our statement is correct.
So we select the user ID two,
and we say, "Do that in case one is equal to one."
And one is equal to one, so there are no problems.
It just brings the username.
But if we were to type the same command,
just change 1 = 2, and click on Submit,
we wouldn't get any output right here.
That is because one is not equal to two.
Therefore, it won't print the user under the ID two.
That could be another sign that there is an SQL injection.
Now that we know for sure that there is an SQL injection,
we can try some other commands,
such as, for example, this one.
So if I go down here and type two, single quote,
and this is just us selecting the ID number two,
and then use a statement called order by one
and add dash, dash, then space, and single quote at the end.
So let's explain this command.
The reason we have this dash, dash, space,
and then single quote is because that is referred
to as a comment.
This dash, dash is a comment,
and we must add this at the end of our statement
at the end of our SQL query
because otherwise it would throw us an error.
We must have it so we don't get error
when running our SQL commands.
And order by one will just check
whether there is column one.
And we are going to do that for two, for three as well.
And we are going to see how many columns do we have.
So if I copy this
and go back to here,
paste this, click on Submit,
we'll get an output first name Gordon
and surname Brown.
That means this is a valid statement.
Let's try with order by two.
So just change from one to two and click on Submit.
And this is also a valid statement
because we get the first name and surname.
And if we try number three and click on Submit,
well, there is an error:
Unknown column three in order clause.
And that's how we know that we have two columns.
Now, let's see what those two columns are.
If I go and type this command,
and I'm going to type it right here first,
two as our ID,
and then union select one and two.
And let's not forget our comment
at the end by specifying dash, dash,
and then single quote.
If I copy this
and I paste it right here, click on Submit.
Okay, so we get this output right here:
The first name for the ID two,
and we get the first name one and surname two.
Now that we know that we have two columns
and that we have an SQL injection vulnerability,
we're going to start extracting data.
So we know that we have two output fields:
the first name and the surname field.
So we are going to try to extract the database name
and the user of the database.
To do that, we can type the command two
to select the user ID, and then union select.
And we are going to type database,
open and closed brackets,
and comma, user, open and closed brackets.
At the end, we add our comment with a single quote.
And here, we are specifying
the functions called database and user.
These two functions are already defined in MySQL.
So let's copy this command just
to see the name of the database and the name of the user
and type it right here.
And we get the first name,
which will store the database name, which is dvwa,
and the surname, or the user,
which is going to be root@localhost.
Now that we know this,
we can try to extract the list of the databases
by injecting the following command.
So after this, we once again start with two,
and then union SELECT.
These select statements you can also type
in capital letters.
It doesn't really matter.
You can type capital or lowercase letters.
What matters is is that you type the correct command syntax.
So right now we're going
to call for schema_name,
comma, two FROM information underscore.
And let me just enlarge this
so the entire command can fit.
So two FROM information_ schema.schemata,
dash, dash, and then closed single quote.
Okay.
So let's just copy this and see what do we get
with this command.
If I copy, go to my page,
and paste it right here,
well, we get quite a few results back.
And we essentially get different databases
outputted right here.
We got our dvwa database,
we got metasploit database,
mysql database, owasp10.
And since we are doing this all inside
of the DVWA application on our Metasploitable,
we would most likely be interested in this dvwa result.
So let's try to extract even more from it.
We can use the following command,
which is ID two,
and then union SELECT table_name,
comma, two FROM information_schema
dot tables.
So you might be wondering what even are these.
And this is just regular syntax for the SQL language.
These are just something
that you will get used to over time.
Once we type FROM information_schema.tables,
WHERE the table_schema is going to be equal
to the one that we want.
And in our case, that is dvwa.
So we can just type equal,
open single quote, dvwa,
closed single quote,
and then our comment, dash, dash, quote.
Let's copy this entire command,
copy and paste it right here.
Now, I'm not sure if I copied the entire command,
so I'm just going to go back
and add what's missing, which is two,
and then single quote, and then union.
Click on Submit. And here is the output.
So with this command,
we sent a query where we requested names
of all the tables inside the dvwa database.
We got two results, which is guestbook and users.
And this users right here could be interesting for us,
so let's dive deep into it.
We want to extract columns inside of this users table.
We can do that by injecting this command right here.
So let me just make a few spaces
and type the next command,
which we, as usual, start with two,
and then apostrophe, union SELECT.
And now we are selecting columns,
so we are going to type, instead of table_name,
we're going to type column_name,
comma, column_type
FROM information_schema.columns.
Remember, in the last command we used dot tables.
Now we are using dot columns
because we are furthermore diving into our database.
And we need a condition at the end.
So WHERE table_schema
is going to be equal to dvwa
and table_name equals users.
So remember, we got two results right here,
and we want to go with the users one first
because that looks more interesting to us
than this guestbook table.
Okay, so let's copy this command.
And now I'm going to copy the entire command.
So select, copy, and paste right here
and click on Submit.
And again, we get a lot of results.
Here they are.
Can you guess which one out of all
of these columns are most interesting to us?
If you guessed the password one,
well, you've guessed right.
But we also want to extract other columns as well,
such as usernames, which we get right here,
such as first names, last names, IDs as well.
And all of that we want to extract.
To do this, we will need to use the concat function
because we only have two fields available
to input our result.
So we must concat a few results in one field
and the rest of the results in the other field.
We can concat, for example, user_id,
first name, and last name in the first name field.
And we can concat the usernames and passwords
in the surname field.
So let's see how that command would look like.
If I go back and add a few more spaces,
let's type two, and then apostrophe, union SELECT,
and then use the concat function
to concat multiple fields into one.
And we can do that by specifying
which fields we want inside of this function.
Let's type user_id as a first field,
comma, and we are going to separate them with two dots.
So comma, and then first_name,
which is going to be our second field, comma.
Let's use, again, two dots to separate
that also from the last name.
And these are the three fields that we are going
to concat into first result.
Then, after it, we want to type comma,
and concat the usernames and passwords into second result.
So let's type it like this, password.
And at the end,
we must specify from where are we extracting all of this.
And in our case, since our database is called dvwa,
we're also accessing the user's table,
so we must type it like this.
So extract all of this from dvwa.users.
Add the comment at the end.
And let's copy all of this
and submit.
Well, here it is.
Here is all of the information
about all of the users from this database.
In the first name field,
we get the user ID followed by the first name,
followed by the last name.
And in the surname field,
we get the username and the password.
So we successfully performed SQL injection,
and we extracted all of the information
about all of the users inside of their database.
But you will notice the passwords are rather strange, right?
This is because they're hashed.
Usually, websites store hashed value of passwords
inside their database for security reasons
since even if something like an SQL injection happened
and someone managed to extract the entire database,
they wouldn't get passwords in plain text,
but rather as hashed value
that they need to run a dictionary attack on
in order to find it in plain text.
And by looking at them,
I would say that this is probably MD5 hash.
We can figure this out by coping one of these passwords.
So let's go with this one, for example.
Going to Google and just pasting it
inside of the search bar.
And we can see most of the results are MD5, MD5, MD5,
so we can guess that this is an MD5 hash.
And since this is an easy password,
if I click on this link,
it'll even tell me which password this MD5 hash is.
So it is the password abc123.
So if I go back to this page,
we can conclude that Cordon has a password of abc123
because this website showed us what
is the string of this hash that we pasted.
We can do that for any other hash as well.
As long as it is a simple password,
it should manage to find it online.
If I go and paste this one, for example,
go right here, click on this website,
MD5 hash for password, it is this.
So it seems that our MD5 hash is a string of password.
So our user called admin has a password
that is simply just password.
And that is how you extract the entire database
with the SQL injection vulnerability.
Now, this is probably the hardest bug
that we are going to cover
inside of our web application section.
And it might take some time for you to get used to it
and to get used to all of this SQL syntax
that we performed right here.
For example, these database functions,
user functions could be known
by someone that already knows SQL
since these are already the inbuilt functions.
And that also stands for all of this syntax,
like table_name,
like information_schema.columns,
and the rest of these commands.
But if you practice it more and more,
you will eventually get better at performing SQL injection.
Okay, great. So we performed SQL injection.
And in the next video,
we're ready to continue discovering even more bugs
on our DVWA application.
See you there.