Press this button to create the target database and simple web app, before we explore SQL testing/attack methods. If your machine is reset or you reboot then you may have to press this button again.

Web App | Test Valid Use Case

A number of database tables and web app scripts have been installed on your kali machine. These are very simple scripts, but should allow you to explore some of the key methods in an end-to-end SQLi process, as covered in the lecture materials.

Start a browser from within Kali. Connect to localhost (or 127.0.0.1) web server, which the web app is running on. Start with the Stock webpage. Edit the address line by adding the following to the end of the URL:

/cgi-bin/stock.py

Try a valid use case from this page. Check the price of eggs by clicking on the link, and information from the database should be returned about eggs. Analyse this request and response. HINT: look at the URL in your browser address field, or the source code for the form.

What is the HTTP request method used to get the price of eggs? PUT POST GET INDEX OPTIONS COOKIE
What is the form variable name/parameter used in generating the eggs information? variable name:

Check for SQLi Vulnerability/Injection Point - Check if the code data value in the HTTP Request is Vulnerable

Modify the HTTP form variable to inject a ' after the valid code for eggs, or replace the code with a ':

stock.py?code=01550041'
stock.py?code='

This should check if we can send our own SQL through to the database query created by the web app, unbalancing the string in the WHERE clause in this case.

What is the database type reported in the error?

Tautology SQLi - Inject SQL to try to force SELECT to return all rows

In the URL, modify the form variable to inject

' OR 2=2 --%20

As the comment needs a space after it in order to be valid, remember to add the URL encoded space value %20 after the "--". This should set the SQL WHERE clause to TRUE for all rows, not just for requesting data about eggs. The in line comment -- means any other SQL in the original query is ignored. This data may be useful for later questions.

How many different items are stored in the database?
number of items:
What is the name of the item with the highest code number?
item name:

Enumeration of SQL Query | Columns in SQL Query | Inject SQL to try to find the number of columns in the query being run

We have shown that the the stock.py script has a SQL query in it, returning a number of columns which are being used to create the web page content.

Use the SQLi UNION SELECT NULL technique, to try to identify how many columns are being returned by this SQL query.

Number of columns that it confirms in the SQL query:
Column number:

Enumeration of SQL Query | Table in SQL Query | Inject SQL to try to find the name of the table being queried - fuzzing

Take your previous SQL injection you used to work out the number of columns and add to the end "from TABLENAME", where the TABLENAME needs to be guessed. As this is all about stock and inventory, try one of the following tablename candidates:

stock
stocklist
stockinfo
items
inventory
stockinventory
iteminventory
investorylist

Name of the table:
stock stocklist stockinfo items inventory stockinventory iteminventory inventorylist

Enumeration of SQL Query | Columns in SQL Query | Inject SQL to try to find the name of the columns in this table - fuzzing

Combine your previous SQL injection which you used to work out the number of columns, and replace one of the NULL entries with a guess as to the item codes column name. Try the following candidates:

code
item
id
barcode
itemid
codeid
barid
idcode

Name of the barcode column:
code item id barcde itemid codeid barid idcode

Find out the name of another missing column in this table using fuzzing.

Combine your previous SQL injection and replace one of the other NULL entries with a guess as to the item codes column name. As this is about stock it seems plausable that the missing column is about how much stock is available. Try the following candidates:

stockno
stocknumber
itemsinstock
instock
totalstock
totalitems
total
available
itemsavailable

Name of the stock count column:
stockno stocknumber itemsinstock instock totalstock totalitems total available itemsavailable

Recall your first injection where you discovered all the items in the database and their codes? Use that to find the row for milk in this injection. How much milk is in stock?

Milk in stock:

Enumerate Database | SQLi using built-in Db Functions/Variables

In your SELECT injection go back to the enumerating no of columns using UNION SELECT NULLs. Explore the metadata of the database using this UNION SELECT, making use of the first column to run some database functions.

Use the first attribute and find out the username of the database user. This is in the form of "thename@machinename". This is done using a common mysql function.

database user:

Use the first attribute and find out the version of the mysql database being hacked. This is done using a mysql variable. The output with have numbers, dots, minus signs, and potentially extra information after a plus character.

database version:

Use the first attribute and find out the name of the database (i.e. the schema name) which we are using. This is a mysql function.

database schema name:

Enumerate using DB Metadata Tables | SQLi to find Web App Database/Schema Table and Column information

Use your working SQLi to query the metadata tables. Use the fist NULL column to select the "table_name" from the metadata table "information_schema.tables". This will return all tables including system tables.

Once you have the query working, return only the tables form the web app we are interested in. So those which have the "table_schema" set to the database/schema name identified above.

Number of tables:
Likely table name of the application users:

Using "information_schema.columns", what are the column names (known as column_name) of the table which you suspect of being the user information table in this database schema? In your query restrict the injected query to only the correct table_schema and table_name. Enter the column names in alphabetical order.

Column 1:
Column 2:

Exploit | SQLi to retrieve Web App Database/Schema Table data

Now extend your original SQL injection, using the name of the web app user's table and the newly discovered column names to access the web application's user table data, retrieving the usernames and passwords from the database.

What is the password for user "clever"?
password:

Exploit | SQLi to retrieve data from the Server

Again extending your original SQL injection, make use of the LOAD_FILE function to access /etc/passwd. The password file has the following repeating format:

username:x:userid:groupid:/home:/bin/bash

Using this information, what is the first username seen in /etc/passwd using this injection?
username:

The output of the above is a little messy to read. Use the CONCAT command and concat the output of LOAD_FILE between the html strings "<pre>" and "</pre>" Repeat your experiment with this new formatting...

Using this information, what is the userid for the username postgres? In /etc/passwd, columns are seperated by ':', and userid is column 3.
postgres user id:

Consider the script /cgi-bin/card.py

Although this is technically using the POST method, the script takes information via the GET method too, as this makes life a lot nicer for us!

Look at the html source for the form. What is the name of the text box?

text box form name:

Try looking at "tony", using a GET request (so put the parameter in the URL). Their credit card details are obscured...

Inject SQL to negate the test restricting the checks to "tony" using an OR, so that all user's details can be returned.

How many credit cards are stored in the database?

How many columns are used in the SQL query related to this injection attack in card.py? Use UNION in your solution.

Number of columns that it confirms in the SQL query:
Column number:

Which of the columns is the one related to the credit card number? Inject the card "9999-9999-9999-9999" into each column and see which appears in the output.

Column number of the card column (numbered from 1).
Column number:

On the basis that the credit card information is held in a table called "ccards", and the username field is "uname" and the credit card number in "code", use substring and concat to access characters 1-4 of the credit card number associated with "tony".

BE WARNED. The format of the credit card number has to be groups of 4 with hyphens or the script will block the display.

Digits 1-4 of tony's card
First 4 codes:

Continue that technique and build tony's complete credit card number.

Tony's complete card in the form XXXX-XXXX-XXXX-XXXX.
Card Codes:

Not you have seen the weaknesses that exist in the two target scripts, and exploited those manually... now experience the power of the automated tools!

Use sqlmap from a Kali Linux terminal window to fingerprint the target app and db. Use the same injection point:

http://127.0.0.1/cgi-bin/stock.py?code=

Run sqlmap on the URL, and enumerate all of the Db's, and the current User and Db

sqlmap -u http://127.0.0.1/cgi-bin/stock.py?code= -f -b -v 2 --dbs --current-user --current-db

What does sqlmap say is the number of databases?
number of databases:

Enumerate Db Tables and Columns

Now keep the same injection point, but this time use only "--tables" and "--columns" using only "-D hack". Use this information to discover the maximum VARCHAR length of "uname" in the "ccards" table.

uname length:

Exploit | Retrieve Data From Db Tables

Keeping the same injection point and database, but this time lets query some user data. Try to "dump" the "table" ccards data using sqlmap. Use the man page to discover how to "dump" and how to select a specific "T"able. You still need the "-D hack" Use this information to view the whole of the ccard table data.

When does Tony's card expire? Use the format 12/99 expiry:

Definitely easier than doing it manually...

Exploit | SQLMap SQL Shell

Again using sqlmap, with the same injection point and database, use the "--sql-shell" flag to open a SQL interface to the database via the injection point.

Use that to run the SQL command:

select * from theusers;

Who has the password "magic"?
user: