- Let's go over a quick introduction
of what is SQL injection or SQL injection.
Basically what it is,
is an input validation vulnerability in a web application,
where if you have a web application
and you do not sanitize input from a user,
basically that user or that attacker
can potentially inject their own SQL statement
to then manipulate a database,
and basically in that database,
either modify records,
retrieve records that he or she should not have access to,
or delete data, right?
Drop tables, in other words, delete a table of the database,
and so on.
Now, SQL injection happens
in both relational databases and NoSQL databases as well.
Now, in order for you to understand what SQL injection is,
first let's actually take a look at a database, right?
What I'm using here is a W3Schools' Try SQL or Try SQL tool.
It's a free tool,
you have the link here in your screen
and you can interact with the database.
It has different tables as you can see,
one called Customers, other one called Categories,
Employees, and so on.
So from this table,
you see that has 10 records of 10 employees,
I can do things like filtering, right?
I can filter by FirstName, by this field,
and let's say I actually filter
just for the record of Nancy.
So for that,
I can do SELECT * FROM Employees
WHERE FirstName LIKE '%Nancy%'
And if I run that SQL statement,
of course, only gives me one record, right?
So, you know, the application is actually doing
all these behind the scenes, right?
All these SELECT statement,
so the SELECT * from Employees
WHERE FirstName LIKE,
and then including the single quote.
Of course, I'm doing a wildcard here
to match anything that matches Nancy.
But all these that I'm highlighting in this screen here,
is sent from the application
directly to the database
without, you know, the user knowing, right?
The user should not know that.
Now these here, the word "Nancy",
think of this as probably something like a hidden field
or in a form, some input field
where you actually enter the name,
you know, or a search,
and then if the attacker is actually able
not only to enter some data there
but escape and then add their own SQL statement,
then he or she can potentially manipulate the application
to get access to the database,
or erase data from the database and so on.
And whenever I mention escape, you know,
I can do a single quote,
and then something like,
OR 1=1,
and then of course send that to the database,
and then you see that, of course, you know,
I'm receiving all the information from the database.
Now, of course, this is a fictitious database.
What I can do is I can go over a specific application,
and in this case, I'm not gonna,
I'm gonna navigate to an application called DVWA
or the Damn Vulnerable Web Application.
It's an intentional vulnerable application
that I have running on top of WebSploit or WebSploit Labs.
If you don't know what WebSploit Lab is
I have mentioned it a few times in this course,
but if you go to websploit.org,
basically I have a learning environment
that I created for many different cybersecurity trainings,
books, video courses that I have written,
and it has over 400 different exercises.
And basically is a series of scripts
that will install tools that do not come
with Kali Linux or Parrot OS.
So basically, first you install Kali or Parrot in a VM,
and then you run a command
to install a whole bunch of different tools,
and also a different Docker containers
that have intentional vulnerable applications.
Now, in this case,
what I'm doing is I'm navigating
to one of these intentional vulnerable applications, right?
Now, by default,
the setting for the security level in DVWA
is set to "Impossible".
So if I go to DVWA security,
"Impossible" means that all the vulnerabilities are fixed.
So what we want to do
is either play with "Low", "Medium" or "High".
And "Low" is for low complexity,
"Medium" for medium complexity
and "High" is for a high complexity,
"Impossible" means that it's actually fixed.
Now, if I navigate to the SQL Injection section,
I can do something similar.
And what I'm doing here is I'm putting a single quote
to escape and inject my own SQL statement.
And this statement
is basically a Boolean SQL injection vector,
or where I put OR 1=1.
And 1=1 equals to True,
so that's a true statement.
If I submit this to the database,
you see that it's actually allowing me
to see all the records for all the different user IDs,
so in this case, the user for admin,
there's another user called Gordon Brown,
another one called Hack Me,
another one called Pablo Picasso,
and another one called Bob Smith.
In the next section,
we're gonna go over a whole bunch
of different types of SQL injection
and also a lot of different payloads
that you can use to launch SQL injection attacks.