-: In this lesson, I'm going to show you
how we use something like Burp Suite,
which is a web proxy, to grab cookie and session data,
to be able to feed it into an SQL injection.
So to begin this SQL injection, we first
need an SQL injection vulnerable website or database.
And so on the left of my screen,
you can see the Damn Vulnerable Web App
version 1.0.7 which is being run
inside the Metasploitable 2 virtual machine.
My Kali machine is going to make a connection to it,
which I've done here, to be able to access this website.
Now the way this form works is if you put in
a user ID, for instance, record number two
and hit submit, back will pop up
the first and last name of the person.
That's all this database interaction is doing for us.
Now, what I want to do is I want to be able
to grab that information, stop it from being sent
to the web server, from my browser,
by using my web proxy, and then I can
capture the data from it that I need.
To do that, I have to go to my proxy setting
inside of Burp Suite, and right now
you can see my intercept is on.
Now, I need to configure my web
browser to actually use that proxy.
So, I'm going to go down to my preferences,
and from preferences, we're going to go to advanced,
click on network, and then click
on settings under connection.
From here, we can set up the manual proxy,
and I'm going to use the local host 127.0.0.1 on port 8080.
This will tell it to use my burp suite tool.
So, if I go ahead and close that,
now if I go in and say I want to get
record number three, notice when I submit it
I don't get the answer back in my web browser,
because my web browser hasn't actually
made a connection to the web server
that's going to get me that information.
Instead, it sent it to the right, over to Burp Suite
which has captured it, and notice that Burp Suite
now has that cookie information that I need.
It tells me the security level.
It tells me the PHP session ID,
and I'm going to be able to use that as part
of my attack against this web server.
So, the first thing I want to do
is I want to capture some of this information.
First, I need to know the website
that we were trying to go to, so I'm going to
go ahead and copy that, and I'm going to
go ahead and go into my terminal.
And so what we're going to do is we're
going to use SQLmap -u, and we're going to
provide the website that we're going to.
So, I'm just going to paste that in,
and then I'm going to use --cookie=,
and I'm going to copy the information from my cookie.
So, let me go ahead and bring that back over to Burp Suite,
and we will copy this cookie information,
and then we will paste that in,
and from there, we're going to go ahead and hit enter.
So, at this point, it's going to start querying the database.
The first thing it notices is that
this isn't at my SQL database,
so it's asking do I want to skip all
the test payloads for other databases,
and in this case, we're going to just use the default of yes.
And it's going to say do you want to include
all the tests from my SQL, and we'll go ahead
and say yes, and it's going to go through
and start querying that database,
and trying to do different injections.
So, you'll notice here that it is trying
to do different testing based on
the version of my SQL, trying to do things
that are stacked queries and other errors,
to figure out what this is vulnerable to.
So now it finds that it found an ID parameter
that was vulnerable, that's that ID=2 or ID=3.
Do we want to keep testing others,
we'll go ahead and say no, 'cause
we already found a way into this database.
And now we're going to see everything that it found.
So, if I go ahead and scroll up a little bit,
we find that the get ID is vulnerable.
We also found that it was vulnerable
based on a Boolean-based blind.
It was vulnerable based on an and/or time-based blind,
and it was vulnerable based on a union query.
We also were able to find out that
the web server was Linux Ubuntu 8.04.
We found the version of Apache,
the version of PHP, and the version of this database.
And all of that information is now saved
to this file, as shown in green on the screen,
but that really didn't give me a lot
of details yet that I want to use.
It just tells me information about our target.
And so now what I want to do, is I want
to enumerate the databases, so I'm going to
add a --dbs at the end, and hit enter.
This is going to go through and find
what databases are on that server.
Notice it found seven databases.
dvwa, information_schema, metasploit,
mysql, owasp10, tikiwiki, and tikiwiki195.
Now, the one we want to target here is
the dvwa, the Damn Vulnerable Web App.
And so now that we know what database
we want to target, which is the dvwa,
I want to select that database with my commands.
I'm going to go arrow up again, go backspace,
put a capital -D, which stands for database,
and the database I want to select,
and then I want to enumerate it for the tables,
to figure out what tables exist inside that database.
So, I'm going to put --tables, and that will tell me
what tables are associated with it.
Go ahead and enter, and it goes through and scans,
and it finds two tables, guestbook and users.
So, now I want to be able to dump
the columns from those tables.
Again, I went from the database
down to the table, now I want to dig in
a little bit further and get those columns.
So to do that, we're going to arrow up.
We're going to backspace out of tables,
and do -T, and give it the table we want,
which is users, and then --columns.
And off we go, we now have six columns.
The user, avatar, first_name,
last_name, password, and user_id.
Wouldn't it be great if we can
get those passwords for those users?
I think it would, so let's go a little bit further here,
and what we're going to do is arrow up.
Take out the word columns, and put in
the word dump, and here we go.
Do we want to save this hashes to
a temporary file, we'll say no.
And what it's doing is it's grabbing
any password hashes from the password column,
and it's going to attempt to do
a dictionary attack to crack them.
And then we're just going to go ahead
and use the standard default dictionary of number 1,
and do we want to use common suffixes, no.
We're just going to use the default things,
and it's grabbed those hashes,
and it's already starting to crack those passwords.
Notice that I already have a password for charley,
and abc1, and password, and letmein,
and here it is on the screen.
And so you can see that the first user ID is admin,
and their password in parentheses is password.
The second user is gordonb, and his password was abc123.
The third username was 1337, and their password was charley.
The fourth was pablo with letmein,
and the fifth was smithy with password.
Again, these are all very simple passwords,
and easy to crack, but you can see
the power of an SQL injection.
We can interact directly with that database,
because we've been able to break through
the PHP front end, and be able to inject
into the database, and get information
back that we shouldn't be able to get back.
And because SQL Map is such an easy to use program,
it makes our injections very automated and easy to use.