DVWA: SQL Injection

Sumber: https://pentestlab.wordpress.com/2012/09/18/sql-injection-exploitation-dvwa/

SQL injection dianggap sebagai kerentanan berisiko tinggi karena faktanya SQL injection yang dapat menyebabkan system dapat di kompromi secara penuh. Hal ini mengapa di hampir semua pengujian penetrasi aplikasi web, aplikasi selalu diperiksa untuk kelemahan SQL injection. Definisi umum dan sederhana ketika sebuah aplikasi rentan terhadap SQL injection adalah saat aplikasi memungkinkan anda untuk berinteraksi dengan database dan mengeksekusi query pada database maka aplikasi tersebut rentan terhadap serangan injeksi SQL.

Ada banyak aplikasi yang rentan yang dapat anda coba untuk belajar tentang eksploitasi injeksi SQL tapi dalam artikel ini kita akan fokus pada Damn Vulnerable Web Application (DVWA) dan bagaimana kita dapat mengekstrak informasi dari database dengan menggunakan SQL injection. Tentu saja metoda ini dapat digunakan dan untuk setiap skenario kehidupan nyata dalam tes penetrasi aplikasi web.

Untuk dapat mengeksploitasi kerentanan SQL injection kita perlu mengetahui bagaimana query dibangun untuk menyuntikkan parameter kita dalam situasi bahwa permintaan akan tetap benar / true. Sebagai contoh dalam DVWA kita dapat melihat kolom teks di mana dia meminta untuk user ID . Jika kita masukkan nomor 1 dan kita klik pada tombol submit kita akan melihat bahwa itu akan mengembalikan nama pertama dan nama keluarga dari pengguna dengan ID = 1.

Ekstrak First Name dan Surname dari ID Field

Ini berarti bahwa query yang di eksekusi di database belakang adalah sebagai berikut,

SELECT First_Name,Last_Name FROM users WHERE ID=’1′;

Now let’s have a look at the URL:

http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#

The injectable parameter on the URL is of course the id field so before we do anything else we can try to change the ID number on the URL to other values (i.e 2,3,4 etc.) in order to find the first names and surnames of all the users.For example we have discovered the following:

id=2 —–> First Name: Gordon Surname: Brown
id=3 —–> First Name: Hack Surname: Me
id=4 —–> First Name: Pablo Surname: Picasso
id=5 —–> First Name: Bob Surname: Smith

An alternative solution that would extract all the First names and Surnames from the table it would be to use the following injection string.The SQL query in this case will be something like this:

SELECT First_Name,Last_Name FROM users WHERE ID=a’ OR ”=’;

The above statement it is always true so it will cause the application to return all the results.

Extracting all the First names and Surnames with one query

The next step will be to try to identify what kind of database is running on the back-end in order to construct the queries accordingly and to extract the information that we want.This is very important because If we don’t know the database that exists behind we will not be able to exploit successfully the SQL injection vulnerability.Most of the times the web application technology (Java,ASP.NET,PHP etc.) will give us an idea of the database that the application is using.For example ASP.NET applications often using Microsoft SQL Server,PHP applications is likely to use MySQL and Java probably Oracle or MySQL.Additionally we can assume the database type from the web server and operating system of the target.For example if the web server is running Apache and PHP and it is a Linux host then the database has more possibilities to be MySQL.If it is an IIS then it is probably Microsoft SQL Server.Of course we cannot rely on these information,this is just for giving us an indication in order to speed the database fingerprint process.

We can very easily identify the database type especially if we are in a non-blind situation.The basic idea is to make the database to respond in a way that it will produce an error message that it will contain the database type and version. For example this can be achieved by a single quote because it will force the database to consider any characters that are following the quote as a string and not as SQL code and it will cause a syntax error.So now if we add a single quote on the vulnerable parameter id=’ this will make the database to generate an error message which as we can see from the image below it contains the database type which is MySQL server.

Identifying the Database type via database error message

Unfortunately in this example the web application didn’t return and the exact version of the database.However now that we know that the database is MySQL we can use the appropriate queries to find and the version.In MySQL the queries that will return the version of the database are the following:

Select version()
Select @@version

So we will use the UNION statement in order to join two queries and to be able to discover the version of the database.Lets try to see what will happen if we give the following query:

‘ union select @@version#

Different number of columns when the UNION statement was used

This error indicates that the two select statements have not the same number of columns.That’s why we cannot have a proper result.In order to bypass this error there are two methods.Either we can increase the number of columns gradually of the second query until it returns the same number of columns with the first or we can use instead the null value as the null value can be converted to any data type.

So we have the query ‘ union select @@version# which provides us an error before.if we try to increase the number of columns by 1 the query will be: ‘ union select 1,@@version#

The hash (#) sign is used in order to comment out the following SQL.We can see the result that we will have in the following image:

UNION statement – Same number of columns

The query was executed successfully and we now have and the exact version of the MySQL.Alternatively we could have used the null value in order to fingerprint the database.The result would been exactly the same.

UNION statement with null value usage

The hostname of our target can be discovered with the @@hostname statement.Specifically we will have:

‘ union select null,@@hostname #

which will produce the following result:

Hostname Discovery through SQL Injection

Now that we have identify the database version and the hostname is time to find the number of columns.The order by command is used to sort information in a table.So we know from above that the structure of the query is the following:

SELECT First_Name,Last_Name FROM users WHERE ID=’1′;

We can query the available columns of the table by using the order by syntax.So for example the query will be:

SELECT First_Name,Last_Name FROM users WHERE ID=’ ‘ order by 1 #

Discovery of the number of columns

As we can see and from the image above we didn’t get any error once the query has executed.This means that there is at least one column returned from the above query.Now if we try to increase the number of the columns by one making the query ‘ order by 2 # we will not notice any changes and the page will be displayed properly.This also means that there are at least 2 columns.However if we try to increase by 3 (‘ order by 3 #) then we will notice the following error:

Wrong number of columns

This means that the are only 2 columns returned when the above query is executed which in this case are the First_Name and Last_Name.

Next we will try to find the current database user.In MySQL the queries that can retrieve the current database user are two:

SELECT user();

SELECT current_user;

So if we try the following statement ‘ union all select system_user(),user() # it will combine the two select queries and it will allow also duplicate values in the results because we have used the union all operator.We can see the result of the following query in the next image:

Discovery of the current database user

As we can see the current database user and the system user as well is the root@localhost.Now we can use the ‘ union select null,database() # to find the database name which in this case is the dvwa as we can see and from the image below:

Database Name Discovery

The database version is 5.0.51a this means that we can list all the available databases on the remote MySQL installation with the command select schema_name from information_schema.schemata which allows us to extract that kind of information regardless if we have administrator level privileges.So in our case and based on the previous query we will have:

‘ union select null,schema_name from information_schema.schemata

and this will return to us the current databases which are the following:dvwa,metasploit,mysql,owasp10,tikiwiki and tikiwiki195.

Current MySQL databases

Now that we have retrieved the databases we can try to discover the table names of the information_schema by using the following query:

‘ union select null,table_name from information_schema.tables #

Sample of the tables of Information_Schema

The information_schema is the database that contains information for all others databases that the MySQL maintains.Alternatively we can retrieve the tables from any database we want.In this example we will extract the tables from the database owasp10.So the query will be:

‘ union select null,table_name from information_schema.tables where table_schema = ‘owasp10’ #

owasp10 – tables

String concatenation can be also used in case that we want to join two or three strings to a single string.For example the following query will extract the column names of the table users:

‘ union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name= ‘users’ #

Discover Column Names of Table users

So we now have the columns from the table users.We can see that there is a column with the name password so we might want to display the contents of this along with the first name or last name of the user.So we need to execute the following query:

‘ union select null,concat(first_name,0x0a,password) from users #

Display the first name and the password hash of the table users

Now we have all the hashes for all the users which can be cracked offline.Another simple query that we can execute and it will return us the location of the database on the remote system system is the

‘ union select null,@@datadir #

Location of Database Files

We can also try to read a file from the remote system.The path that we are always looking for is of course the /etc/passwd where older Linux systems were storing the passwords.We will execute the following query:

‘ union all select load_file(‘/etc/passwd’),null #

and we will get the following result:

Read the contents of passwd file

Conclusion

As we saw from this article SQL injection is a high critical vulnerability because once it has been discovered it allows us with the use of the appropriate queries to extract information both from the database and the system.Damn vulnerable web application give us the opportunity to exploit this vulnerability in order to understand better how sql injection works and of course to stay ethical.

Referensi

• https://pentestlab.wordpress.com/2012/09/18/sql-injection-exploitation-dvwa/
• https://nav1n0x.gitbook.io/a-guide-to-manually-hunting-sql-injection