Pentesterlab.com is one
of the online course provider for Penetration testing. One of its exercise ask
you to test for a SQL injection on one of the vulnerable application. Before
you started, you need an ISO file of the vulnerable application. You can download
the ISO image here.
Now lets try the
exercise.
Notes:
- Attacker IP: 192.1668.0.103
- Target IP: 192.168.0.102, midway change to 192.168.0.105
First run sqlmap on Kali along with the banner
scanner. The banner will tell the version of MySQL running on the targeted
application. Use the command on the following image.
The sqlmap will do some operations needed to
detect the version
Next, the version of the MySQL will be revealed
along with the version of the web server. The version of the MySQL was revealed to
be the 5.1.63 version which is still has the vulnerabilities of SQL injection.
Once we know that it is still vulnerable, I tried to get more information
regarding the database.
The following command is used to get the database
available inside the target.
The available databases will be retrieved. Now we
know that there are two available databases, information_schema and photoblog.
Since the name of the web application is photoblog, I’m pretty sure that the
database that contains the information of the web application is the photoblog
db. The next step is to get the available tables inside the photoblog database.
The following command is used to get the tables of
the photoblog database. –tables is used to get the list of the tables. Notes
that this time the IP is changed, but it will not affect the result of the
command.
The available tables will be shown once the
command execution is finished. Now we see that there are three available tables
on the photoblog database. There are categories, pictures, and users. Based on
the common knowledge, the categories will contain the photo categories, while
pictures will be the list of the photo/images on the photoblog sites. The last
tables which is users must be contains the information of registered users
along with the admin. The next step is to look on the available columns on the
users table.
Use to following command to get the columns of the
users table.
This resulted in the columns id, login, and
password. The next step is to dump all the contents of the users table.
The –dump command will generate the table of the
users table.
This is the users table, along with the content of
it Now we know that the username for the login is called admin and the password
is P4ssw0rd. The next step is to test the login using admin as the login
username and P4ssw0rd
Now go to the login screen of the web application.
There you go. Now you has an access as the admin
who can upload the image.
Now you know how dangerous if you exposing the parameter
on the URL. Therefore in designing web application, you need to carefully
measure what the user need to see. Moreover, avoid
constructing SQL queries with user input. Using a framework when creating a php based web application is also
important since this framework usually provide the means to query that is free
from SQL injection vulnerability. Codeigniter for example, use Active Record
for accessing the query.
References:
