Hi and welcome back to Section 8 web application
attacks.
In this video, you will learn how to automate SQL
injection and discover hidden databases
within a web application.
I hope you excited. So let's dive on in.
This video you will learn how to use a tool
called SQL map to Simply automate SQL injections as
an ethical hacker any painstreation tester to
Simply discover any sort of SQL injection
be security flows with any web
application.
For this exercise. We are not going to use shoe shop.
However, our Target machine will be Kali Linux.
But we are going to use metasploitable 2
virtual machine simply select it like so and
hit start to power it on.
Create so no mattersploitable 2 is powered on we can
log in using the username msf. Admin
and the password is the same msf. Admin.
Let's type ipaddr to get a
IP address of this server.
And here you can see the IP address of my metasoloidable to
Virtual Machine. It's 172 tt1.37
create now,
let's open our web browser like
so let's head over to dot URL.
This should be your welcome page.
We are going to use.
The DV w e web
application simply click it and you
will get a slogan page.
If you scroll down you will see the user credential.
The username is admin are the password is password simply log
in ases.
once you're logged in
To dvwe Simply scroll down. Let's
set a security level to Loop.
Let's click submit.
Great.
next let's click on SQL injection like
so
and here we have a user input field.
We can simply insert a value and try to
retrieve the user account for that value.
For instance. If we insert one, we
would like to retrieve the first account that was
ever created which is most likely the administrator account.
But before we do, so, let's click on
foxy proxy and turn on the boob Suite
proxy feature like so
And now let's execute Boop Suite.
Let's click on proxy.
Let's click on options.
And let's check these boxes.
Next let's turn on intercept create.
Let's have a back to all web application.
On the user input field, let's press 1 like so
and hit submit.
And here you can see we were able to retrieve the first record. This indicate.
There is some type of security flow that
exists within this web application.
Let's check boob Suite.
Unfortunately, we did not see the request schemean.
So let's actually click on target.
Let's click this first option up
here.
As you can see it was able to capture all the get
messages. Let's filter this properly.
So you can simply right click and add to scope.
simply click on this row
and show only in school items great.
If I widen this URL just a little bit we can
see it's slash dvwe vulnerabilities
/ SQL.
followed by some additional shrinks
But let's look at the actual request message.
in this request message
We sent a get requests for this particular resource,
and we submitted it.
We can see this is a target. The user agenda was
used which is Mozilla Firefox, but most
importantly we have a session ID
value.
together with actual requests one
but notice the cookie information contains the
security level to be low.
In addition to the session ID.
So therefore we can use this cookie information to try
to extract additional details.
As we can see this here's a requested URL.
On this URL should be similar or the same
within a web browser. Let's check.
And it is the same. So let's copy this entire
URL from our web browser and let's
open a terminal.
In this terminal we can use the details
that Loop so it was able to capture such as
the actual cookie information.
with a session ID
Firstly let's type sudo. We'll type
SQL map like so
dash dash URL
followed by the actual URL. However,
we need to make some modifications since SQL
map cannot recognize these and
symbols.
We need to put a slash like Zoo.
then we'll specify dash dash cookie like
so
Equals, let's have a back to both suite and
copy the cookie information.
We'll specify a single open quotation marks
like so
I will simply peace the cookie
details.
with a close quotation mark
and next we'll specify - DBS.
This simply allows SQL map to
check for any sort of potential SQL injection vulnerabilities
within the web application. Simply hit
enter when you are ready.
For any of these problems that appear simply enter the
select the default.
On the scan is complete. I'll shown it has found
70 devices and these are the seven
databases that exists behind the web application.
So what can we do next?
The great thing is we can try to extract any sort of
sensitive details from these databases such as
identify what tables exists
any database we can first Target this
database Swiss, which is a d v
w a database now we can
press the up button and now we'll specify dash dash
tables.
Then we'll specify Dash capital b as specified the
name of the d2bs.
The name of the database is d v w
e
Simply hit enter.
And it will show us whether there are any tables under the
name of the tables within the database.
As you can see there are two tables. There's a
table called guesswork and there's another table called
users.
What if you want to see The Columns that
are found within the database?
Simply press up once more and we can
remove tables and specify columns.
like so
simply enter
and great. We have found various columns.
There's a column called user Avatar this
name last name password and
even the user ID and for
the guest book.
There's comment comment ID under the
name.
Between these tables the users table seems
to be more interesting.
Simply because most likely.
We can extract the passwords and perhaps the curb
them or even use a password hashes to gain
access into user's accounts. Let's try
to extract this information. Let's press up
one more time and this time and this
time let's delete columns and actually
dump the actual results like so
so what we're doing is that we are dumping the
details from the users table from the dvw80 to
be
Simply hit enter and notice asking do you
want to store the hashes to a temporary file? We
can simply type enter for now and just
use the default settings.
Let's see whether or not SQL map is able to crack those
password hashes.
As you can see it is actually cracking some
of the hashes one by one.
So from the password hashes, we are able to crack users passwords.
We can see the first User it's called admin.
We have the Avatar file.
There's a password hash.
and actual password
for the second user
We have the two user the fourth.
And so on.
So now that we have the users username.
and their password hashes
We can simply log in.
To the web application while pretending to be these users.
As you have seen SQL map is
a very valuable tool as it allows us to check
fatals D2 pieces and even extract
the records and even perform password cracking.
During the course of this video you have learned how to use
SQL map to automate SQL injection
attacks against a vulnerable web application server.
In the next video, we'll be starting section 9. I hope
this section on this video has been informative for
you and I will see you in the next one.