Pentester Lab SQL Injection Exercise

Pentesterlab.com is one of the online course provider for Penetration testing. One of its exercise ask you to test for a SQL injection on one of the vulnerable application. Before you started, you need an ISO file of the vulnerable application. You can download the ISO image here.

Now lets try the exercise.

Notes:

• Attacker IP: 192.1668.0.103

• Target IP: 192.168.0.102, midway change to 192.168.0.105

First run sqlmap on Kali along with the banner scanner. The banner will tell the version of MySQL running on the targeted application. Use the command on the following image.

The sqlmap will do some operations needed to detect the version

Next, the version of the MySQL will be revealed along with the version of the web server. The version of the MySQL was revealed to be the 5.1.63 version which is still has the vulnerabilities of SQL injection. Once we know that it is still vulnerable, I tried to get more information regarding the database.

The following command is used to get the database available inside the target.

The available databases will be retrieved. Now we know that there are two available databases, information_schema and photoblog. Since the name of the web application is photoblog, I’m pretty sure that the database that contains the information of the web application is the photoblog db. The next step is to get the available tables inside the photoblog database.

The following command is used to get the tables of the photoblog database. –tables is used to get the list of the tables. Notes that this time the IP is changed, but it will not affect the result of the command.

The available tables will be shown once the command execution is finished. Now we see that there are three available tables on the photoblog database. There are categories, pictures, and users. Based on the common knowledge, the categories will contain the photo categories, while pictures will be the list of the photo/images on the photoblog sites. The last tables which is users must be contains the information of registered users along with the admin. The next step is to look on the available columns on the users table.

Use to following command to get the columns of the users table.

This resulted in the columns id, login, and password. The next step is to dump all the contents of the users table.

The –dump command will generate the table of the users table.

This is the users table, along with the content of it Now we know that the username for the login is called admin and the password is P4ssw0rd. The next step is to test the login using admin as the login username and P4ssw0rd

Now go to the login screen of the web application.

There you go. Now you has an access as the admin who can upload the image.

Now you know how dangerous if you exposing the parameter on the URL. Therefore in designing web application, you need to carefully measure what the user need to see. Moreover, avoid constructing SQL queries with user input. Using a framework when creating a php based web application is also important since this framework usually provide the means to query that is free from SQL injection vulnerability. Codeigniter for example, use Active Record for accessing the query.

References:

• http://www.esecurityplanet.com/hackers/how-to-prevent-sql-injection-attacks.html

• https://pentesterlab.com/exercises/from_sqli_to_shell