We've seen some websites that have SQL databases connected
to them.
We're going to now investigate how
we can interact with those databases on a website.
This is separate from when we saw SQL or MySQL databases that
were just part of a server.
Similar interaction.
But this, we can all do through the web application
itself, our command line not necessarily targeting
the server.
It is going to target the server but in a less direct way.
And again, this is tied to the web app portion of this.
So let's get into the lab and take a look.
First, let's pull up our IP address.
I do this because it changes with each lab iteration.
With this lab environment, every time
you create a new lab environment, this,
your network is actually going to change,
your network in subnet.
But it's always going to be a .2.
That's you.
And the .3, that's the target.
And .1 going to be the router.
So you see, it's got port 80 open and 3306 for mysql.
We could dive deeper into that.
I don't think it's MySQL.
I think it's SQL on Ubuntu.
It's fine.
And we've got bWAPP up again.
bWAPP is great.
We're going to do a combination of things.
We're going to use the terminal.
We're going to use Burp Suite.
Turn that on and open it up.
And we will use sqlmap in our command line.
So let's get Burp started, B-U-R-P. Get it running.
Next, start Burp.
Hit OK.
And we're in.
I'm going to log in with b and bug.
Intercept is on.
And the reason we're doing this is because we're
going to get this cookie.
We want this cookie.
We're going to log in.
And our interaction is going to be
all based off of this cookie.
So we'll pass it through.
Will this one go?
Actually, I'll turn off intercept for a second.
We are in.
We want to go to the SQL Injection.
GET/Search.
Hit Hack.
It brings us to that page.
And I'll turn Intercept on.
Refresh this page.
And now we catch it.
So we have a PHPSESSID.
That is based off of being logged in.
We logged in as b.
That's why we have access to everything.
And as an authenticated user, now we're
going to have access to the SQL database through this page
right here.
So we could type anything in here.
I'm going to type in joe because I know it's on the list
from playing around in here.
We caught it.
We asked for-- or rather, I'll send that through.
Joe.
That was caught.
The way it sends it, it's got variables in the URL.
And we can see that up here, title=joe.
action=search.
These variables are what drives the SQL database.
And that is what we will mess with.
We'll mess with that URL.
So knowing that we have it all set up and that it captured,
we're going to take this all over to sqlmap.
Or sqlmap.
Potato, potato.
Either way, someone's going to be upset with how I said it.
sqlmap is a neat tool.
It's easier to say sqlmap.
So I'll just say it that way.
We need to give it a URL.
So http://.
And .3/.
And we will just pass, oops, all of that into there.
title equals hello, or joe in this case.
And action=search.
And for the cookie, we need that cookie.
We'll grab it right out of here, PHPSESSID all the way through
security_level=0.
There is so much wrong with this web app.
But that's on purpose.
And then, we're going to target title right there, title.
Boom.
So based on what is in the title,
sqlmap is going to do some neat stuff.
I'll have it run.
It made a connection doing heuristic based off of title.
It might be injectable.
Possible database management system is MySQL.
It sounds about right.
So it's testing for SQL injection
on the GET parameter title.
And it should find it because it's supposed to.
All right.
We have our results back.
So it looks like the parameter title is vulnerable.
And it gave us some things to try out.
There is these payloads here.
We do OR NOT.
And here's this code.
Or we could input this longer one
and see if that does something.
Well, let's play around with it.
So what we'll do, I'm going to copy this.
Go into Burp Suite, where we've captured this.
Go to Actions.
And we'll Send it to Repeater.
Repeater is going to let us take this GET request,
change some things on it.
And let's see what happens.
So if we do--
let's just check, make sure that we had it right.
php?title=.
And after joe, we're going to throw in this backtick OR NOT.
One-- 2377=2377.
And then, action=search.
So we'll throw all that in there and see what that does.
We'll send that.
And we get back something.
Search for movie.
We should see results.
There it is.
Error, you have an error in your SQL syntax.
Check the manual that corresponds.
Bummer.
So that, in the end, errored out, because the way the page
works, it presents it down here at the bottom
when it runs something.
That's what it's showing here.
So in this attempt, it didn't work.
Well, let's try this other one.
This is really long.
Let's see if it works.
We're still in the Repeater tab.
So I can just replace all of that title all
the way through search.
And we'll see if that does anything.
Scroll all the way to the bottom.
And we still get an error.
Well, let's see why these ones.
Place this one.
See if any of them work.
Just to get a sqlmap, I found something that might work.
It doesn't mean it really will.
It is a tool.
And sometimes, you get something.
Sometimes, you don't.
If we did have SQL injection here, what we might see
is the whole database spitting out.
It doesn't look like it's going to do anything.
This one's pretty crazy.
Well, why not?
Why not try it?
Replace title through search.
And you can send any information in this header.
Whether it works or not really depends
on the database on the other end.
Bummer.
Another error.
That's fine.
Let's move on.
That errored out a few times.
Let's try something just a little different.
Now that we have access, we know that sqlmap was
able to try these things out.
It tested out a mess of them and came up with some feedback.
So we'll keep that, everything the same.
Except instead of finding payloads for title,
we want it to check databases and/or--
yeah, databases.
So we'll do a --dbs.
And it'll try to do some SQL injection to turn back what all
the databases are accessible.
Wow, that was fast.
We've got four databases.
There's bWAPP, information_schema, mysql,
and performance_schema.
That was a nice little quick thing.
Let's see what tables are in bWAPP.
So -D. Now we'll look at bWAPP.
And tell me the tables.
Pretty quick.
We have these tables, blog, heroes, movies, users,
visitors.
Now this is where you've got to start understanding databases.
And we haven't taught anything on databases.
We haven't taught anything on SQL specific to how
the database works.
But they're very common.
Databases hold information.
Hopefully, someone's worked with an Excel spreadsheet
or just columns of data where you have different rows.
And each row has different columns.
Well, those rows and columns are stored in tables.
And the tables are stored in databases.
Boom, there it is.
So we've got users.
Let's dive in even more.
So now that we've identified a table, we use capital T.
And we want to look at users.
And let's see what all the columns are.
Boom, find out all the columns.
There's an admin column, password column.
Ooh, and you can see what type of information they could hold.
That's quite useful.
Let's dump this whole table.
Why not?
So we know that we have users as a table.
Capital C for columns.
We'll do admin, and password, and email.
Let's get all those.
And then --dump.
Now it's going to read all that.
And sure.
No.
[INAUDIBLE]
Hmm, I stopped it.
But it came up with some hashes.
Yeah, that works.
That's it.
That's what I had.
So it's got these hashed passwords.
It came up with the hashed passwords.
I didn't read what it was asking.
It noticed that they're hashes.
And it said, hey, do you want to crack the hashes?
And I didn't give it a dictionary to crack with.
So it used the default dictionary.
It went very quickly.
I had boarded it.
So it didn't actually find the passwords from the hashes.
But you could take this offline through John or Hashcat
and actually crack it.
All right.
Let's change it up just a little bit.
I want intercept to work.
But we'll go to the SQL Injection with a POST.
And let's forward it on so we see what that looks like.
Did it not go where I wanted it to go?
POST/Search.
Oh, I didn't hit Hack.
Hack.
There you go.
Now it's on POST/Search.
Fun.
And here, I turned intercept back on now that I've got it.
[LAUGHTER]
Search the right place, sqli_6.
And in this one, it looks like it's
going to send it in the POST data, in the form data.
So let's not intercept that.
Let's intercept if I pass hello.
There it is.
It passes it in this form data.
Forget requests.
You pass variables in the URL, usually.
For a form or for a POST, you're going
to pass it in the body of your POST request.
So now, we're going to do very much similar stuff.
What we want is to copy all of this to a file.
So Action.
And then, Copy to File.
And in root's fine.
We'll just call this the request.
And now, we've got that request, the POST request.
Let's see here.
We've got request.
And it did not save everything that it was supposed to save.
It only saved what I highlighted.
Be careful.
That's why we check things.
Copy it all.
Save it.
Override it, Yes.
There we go.
Now it's got everything.
Request has the full POST, including
the variables at the end.
There is no new line at the end.
So yay Linux, it didn't even put the new line when it catted.
That will work.
We can work with that.
So it doesn't look so freaky to you to do that.
All right.
Now we're going to use sqlmap on this.
So sqlmap.
And we will use the request.
And we'll look at the payload of title
because that's still there.
Go the defaults.
It's testing.
[INAUDIBLE]
We've got new payloads back.
So we could try these ones.
Let's give them a try.
Let's Send this over to Repeater.
Go to Repeater.
What does it normally look like?
It would normally look like all this.
So nothing terribly crazy.
Let's write hello.
Did we put it in here?
Nope, because it didn't find anything with a hello.
Let's look at our payloads.
If we replace our variables with these payloads
and then send that, what do we get?
It looks like-- yeah, it just stops right in here.
It looks like we got an error.
That's where it should have shown up.
But it didn't.
And so we've got this gobbledygook.
Well, let's try another one.
Ooh, maybe this one hit.
No movies were found.
Bummer.
All right.
So that one didn't work either.
sqlmap is useful, but also not always useful.
How about-- this first one did work.
What it did is it threw in this hash information.
So let's use that again just to show.
BIGINT value is out of the range.
So how about instead of this, we send version?
Oh, it didn't like that one either.
Well, how annoying.
Oh, no.
It is in there.
It found the version.
It's right here.
It's 5.5.47 on ubuntu.
Ta da.
I just wasn't reading it properly.
Well, sqlmap can get confusing.
But with understanding the tools in sqlmap, and Burp Suite,
and some of the others, you can really
take advantage of the vulnerabilities
and some of the access available to you as a penetration tester.
There's more tools.
There's some neat stuff that can happen.
This is just starting it off, showing you a little bit
of what you can do.
And we'll dig into more in the following lessons and labs.
So hang on for this.