Hi and welcome back to Section 8 web application
attack in this video. You will
learn how to manually perform SQL injection on
a vulnerable web application.
I hope you're excited. So let's dive on
in.
This exercise you will learn how to
perform SQL injection.
SQL injection is simply a type of injection visas
Arc that allows. Let's see the article
hacker or the penetration tester to inject customize
SQL statements into an input
form on a vulnerable web application.
If the web application does not validate or
sanitize input the code will be sent to
the SQL server on the backend for processing.
If the web application is vulnerable the
article hacker or the penetration tester will be
able to create modify retrieve or
even delete records are stored
on the database.
In this exercise, you will learn how to perform SQL
injection to gain administrative access
on the OS Juice Shop web application.
directly on the scoreboard
simply click on show all
And then let's click on hide all.
like so
great.
Let's filter for all injection based
attacks.
Let's click on injection.
Great.
Currently we can see there's a few injection based
attacks. The one that we are
looking to complete is a one that says login admin. This
one is where we need to find a
Wii to gain access to the administrators user
account in the situation where we do know the
actual administrative password to get
started.
Let's scroll up just a little bit on the web application.
And let's click on account.
like so
once you click on account, you will see a drop-down page
that says login simply click
on login.
Now we have the login page. Let's check bootsuit.
And we have a few web requests.
Let's follow these web requests.
Great. Let's take a look at a login page.
Currently it is asking.
for
a valid email address and a
password
So let's send some type of malformed eater
and intercept this data.
So we can simply type any username. So
let's type user one add.
email address Comm like
so
let's create a random password. Let's call it as password.
And simply click on login.
Once you click on login, let's head over back to
boob Suite.
And here we can see that there's a few more requests that
is waiting to be processed.
Let's click on forward until we see the post requests that
is actually trying to send the user credential across
the web application.
Great.
We have found the requests. Actually. It's not a requests.
It's a post message.
So you can see post and here we can see the
user email that we were sending across and
password.
Currently both Suite has intercepted this information preventing it
from being sent to the actual web app.
Let's right click.
Now let's choose send to repeater.
Next let's click on the repeater tab.
Repeater simply allows us to modify
any sorta requests unresponds between our
web browser and web application.
This tool is very good because we can simply modify
the data before sending it across to
the actual web application.
As you can see within this web requests
it contains on each TDP
postmessage, but simply includes a
random email address and password that we have sent currently.
The message was not deliver just
yet.
To deliver this web requests. Let's click on send.
Create so now repeater has captured the
response from the web application that is
being returned to our web browser.
Notice online 1 it says http.
4 0 1 or authorize this
means to see that the user credentials that
we are provided within the requests. It is invalid. It
is not the correct thing. Let's make
a simple modification to the original request.
At the end of the email address here.
Simply please a single quotation mark like
so now let's hit send one more
time to see what happens.
And noticed the entire response is completely different.
We got a lot more information than the
previous response.
So what exactly us up on here?
Simply by inserting a single quotation mark
at the end of the email address within the requests as
we can see on the left side.
It tests whether the web application is vulnerable to
an SQL injection vs attack.
Now, let's take a look at a response more carefully.
If you notice at line 14.
Well, actually at line 15, we got an honor
recognized tucan.
This honor recognize token specifies that there's
an SQL light error.
And at line 21, we can
see the actual SQL statement that
was sent from the web application to the
backend database.
Because we inserted a single quotation after the email
address. It will simply tell their scroll
database or the web application to Simply ignore
everything else that follows after that single
quotation.
So you could try to exploit this.
Let's head over back to the web application on our
web browser like so
Actually, let's click on proxy. Let's
forward all the request messages.
Great.
back to our web application
Let's change our user credentials.
This time at the end of the email address.
We are going to insert.
A single quotation like so we'll specify or lose
specify one equal one.
semicolon
space dash dash like so
and now let's click login.
At this point it should capture the new
web requests. Let's hello back to boost Suite.
Let's click on forward a few times until
we see this new web request.
Great currently we can see the new user input.
Let's right click and send this to repeater
once more.
Let's click on repeater.
So now we have an entirely new requests of
your Center repeater.
create
Own repeater let's click Send. So right
now both so you will actually send this
request to the web server and
we'll take a look at what responses.
And notice this time we actually got authentication and
we have an authentication token.
So what does this mean?
Well, this means that what we have just done is
we have performed on SQL injection.
On the web application and we are
successfully evil to gain access to the administrator
account.
And we have an authentication token that
we can use to log in to the user account.
Let's click on proxy.
Let's follow all of the requests.
Now let's head over back to our web browser
and detailing weather. We have completed a challenge
or not.
And currently we can see your successfully solved the
challenge.
for login admin
Let's click on account.
And notice now that we have more available options.
We can simply see.
the orders
and received addresses the digital wallet. We
can even log out from the actual administrator account.
Great.
So we have completed a challenge on the scoreboard.
If we had over back to the scoreboard we should see.
We have some points.
and here you can see
we have solved this challenge.
During this video you have learned how to perform manual SQL
injection on a vulnerable web application in
the next video. You will learn how to perform
brukon authentication attacks. I hope
this video has been a formative for you and I
will see you in the next one.