Welcome back. We are in a demo
and now I'm going to focus on login functionality,
right?
I'm going to find out whether
now login and password
parameters are vulnerable to
SQL injection.
so what I have to do first is that
I'm going to put some login
like for example ABC
And password like DF whatever.
Just arbitrary data, and I'm going to
and intercept outgoing
request right? So first I have to well I
I see the form right like login and
password. So I know just from
the experience that the login and
password will be sent as post parameters, but
I need to learn the
exact structure and the names
of this parameters because this is well. I just see login
and password but you don't know what are the names
of the corresponding parameters, right? So you have
to intercept outgoing request and then you can start building your
SQL and map come on.
Okay, so I've got here.
In my in my lab. I got burp Suite
burps sweet proxy.
Actually burp Suite is a is an integrated
tool for web app security testing very popular
one used by many many
pentasters that take a hackers and buck hunters
and I'm going to focus just on a proxy functionality
here. There is a so-called Interceptor. I'm going
to intercept the outgoing request from
my browser just to learn how this request looks
like. Okay. So the Interceptor
is turned on now. I'm going
to click login.
And you see this is my request.
So you see that indeed we are talking about post request
to login.php.
And the post parameters
are logging and the value
is ABC for example, and there is password.
and with value DF and
the host is example.com.
Here because well
we are just sending this data to our
web application that is hosted on the domain example.com.
Okay, great. So having
this information we
can start building our Command
right SQL map command. So
a SQL map, right?
Now we need to specify the URL.
So
let's jump here back.
We are talking about example.com Slash
login PHP, right
and here you can see actually the
the traffic is going over https
Port 443. So
this is https protected traffic cool.
So let's just put this information to
ask SQL map so https.
example.com and the
login
dot PHP, right
So far so good. Now we need to
specify our post parameters so data.
equals sign
and in between the
quotes what we're gonna put we've got
login ABC password DF right
instead of ABC in the F. You can put whatever you want.
What's important is the name of the parameter?
Um, I'll let me just do it
like this logging equal sign ABC but
you can just put whatever and password.
This is the name of this parameter with a
value.
d e f right
so
far so good.
now
Let's put risk.
to the value of free
and level
to the value of 5, right?
And in case of successful SQL
injection detection, we're gonna
fetch the banner, right? That's what
we want to do.
Let me double check the command. I
think that everything is clear. So we are also going to send the
maximum number of payloads just to increase the
likelihood of finding the school injection
either in login parameter or
password parameter, and I'm going to hit enter.
Okay, so it has just started.
And we need to wait. It's
sometimes it takes seconds. Sometimes
it it takes minutes, right?
It depends on the number of parameters, right? It can
take hours to detect the vulnerabilities. The
SQL map also is trying to figure out what
database is used out there. Right? It's
trying to send different payloads for different
databases. Okay, but what I can see here is
is well, I'm talking and here we've
got just a result. So post parameterogeneous vulnerable.
I don't want to test others. Let's let's
focus on this one.
And yeah.
Blazing fast again. The banner has
been extracted and here you see.
The version right of the database again five
point five point forty
eight. This is what you already know. So the banner has
been extracted. So yeah, and this is
how it works. So now I'm
happy because you know more and
more about SQL map detection and exploitation. And
of course the core part is automation here,
right?
So, you know how to test post parameters.
For SQL injection, you know how to maximize the
number of payloads with risk and level does risk
dash level. So that's cool. You see
how it works exam in action.
So yeah, it's time to jump
to another module and
Play with web application firewalls. Thanks for
your attention.