- [Instructor] Let's go over some
of the most popular SQL injection tools that pen testers use
in the industry.
Basically, I have a list
of those popular tools in my GitHub repository.
So if you go under web_application_testing
you will see a markdown page
called SQL-injection-tools that I'm highlighting here.
And this is not a complete list or an exhaustive list
but these are definitely some of the top
most popular SQL injection tools
that pen testers use nowadays.
Now I'm gonna be using some
of these tools, especially SQLmap.
And in combination with others like Burb Suite
and talking about tools, hacking is not about tools.
It's about the methodology.
It's about you thinking like the attacker
and also demonstrating what an attacker can do
before they actually find vulnerabilities
that they can leverage
but at any rate we know some of the tools
that we're highlighting here start
with SQLmap, jSQL Injection, BBQ,
and yes, the name is BBQSQL.
There's also a tool that you can use to interact
with no SQL databases and find vulnerabilities
that an attacker can manipulate
and leverage to compromise a NoSQL database.
And there are other tools like DSSS, explo,
Blind SQL injection via Bitshifting and Blisqy.
So let's actually go and see some of these tools in action.
So what I'm going to do, so I'm gonna go to Burp,
I'm gonna go under proxy
and then I'm gonna open the builtin browser
just to make it easy here.
And then all the transactions between my browser
and the web applications will be intercepted by the proxy.
And I'm gonna log in
to the popular DVWA, intentional vulnerable application.
And I'm typing, the default username and password
is admin and password.
I'm going to make sure that the security level is not set
to impossible, if you leave it as impossible
that means that all the vulnerabilities are actually fixed.
So I'm gonna set that to low, to make the intentional
vulnerable application vulnerable.
Now I'm gonna navigate to SQL Injection.
And as you see in here, we have a form that you
can put any information and under the user ID
I'm entering my name.
And then I'm gonna go back to Burp Suite, turn on Intercept
so I can intercept the transactions between the browser
and the web application.
I'm gonna click submit, and then as you can see
the proxy was actually able to intercept that transaction.
You actually see the ID equals to omar.
So my name, and then of course
you see that we actually submitted this, or we
attempted to submit this to the web application.
The proxy actually intercepted that transaction,
that get request.
I am not gonna modify these transactions,
or this get request in here.
What I'm going to do is I'm gonna highlight everything.
I'm gonna right click on it.
And I'm gonna copy this to a file.
And then in my home directory
I'm basically going to name these sql-test.
And as a matter of fact
I actually already have a file called sql-test.txt.
I'm gonna override that file.
Now I'm gonna open a terminal window
and I'm gonna show you the contents of that file
that we just created, just so you can see that, of course
it's actually stored in this file.
And what we're gonna be doing is actually we're gonna
be using the SQL map or sqlmap tool
and we are gonna read the contents
of that file that we just created.
And first I'm gonna try to enumerate the type of database
and also any types of database names that we
can potentially enumerate using the --dbs option.
So if I launch that, you see that right away
it actually tells you
that the database may actually be a MySQL database.
And basically the tool is asking us
if we want to skip the test payloads for all the databases.
And in this case, I'm actually gonna say yes
which is the default in there.
And right away, you actually are seeing
that the tool is interacting
with the application in an automated fashion.
And it's actually trying to determine the type
of database and doing a few of the attacks.
Like for example, you see UNION queries,
you're gonna see in a few minutes, a few other types
of techniques that is actually trying to send
to the application to cause some
either error messages or to obtain additional information
about the underlying system.
Now it says that if you want to actually keep testing
for any other types of implementations
we already know that it's a MySQL database.
So I'm actually gonna be selecting no in here.
Now right away, it actually found four databases.
So you see here DVWA, information_schema,
mysql and performance_schema.
Now information_schema, mysql and performance_schema,
they're all the built in databases that come by default
with MySQL.
So the one that we did not know that existed is
the DVWA database.
So that's the underlying database in the DVWA application.
We probably could have guessed it because you know
the name of course is very intuitive.
However, we didn't know that actually
that was the actual name itself.
Now the tool itself was able to enumerate a few other things
like the Linux operating system
and is running an old version of Debian.
It's also running an old version of Apache httpd server.
So the underlying web server is Apache 2.4.10,
very old version, and also a very old version of MySQL.
Now, if you scroll up,
this is what I want you to pay attention to
of the different types of payloads that it actually sent
to the application to basically be able to determine
and to enumerate these databases, right?
So the first one is a boolean-based blind SQL injection.
And remember, in the previous lessons that we were going
over a few examples of Boolean statements
and where two numbers were evaluated
to themselves to cause a true statement.
Well you see that in action here.
You also see an error-based payload trying to
cause different error messages.
So it can enumerate probably the type of database.
And that's what it actually did in here.
And other types of information.
Now you also see another query
which is a time-based blind cycle injection.
And in this case
you see the sleep statement to basically cause the database
to wait for x amount of time,
in this case for five seconds.
And then the attacker is actually able to
do further enumeration as well.
Now the UNION query is the last one.
And remember in the previous lesson
when we're going over all the different methodologies
and UNION queries is basically one
of the methodologies that attackers can do
to concatenate other SQL statements,
just like it's actually doing right now
in an automated fashion of course,
and this is causing additional behavior
in the web application and the database
that the attacker can then leverage to reveal information
just like we did a few seconds ago.
Now that we know that the database is called DVWA
we can basically use the same exact tool
so we can use exactly the same file to read that
get request, to send that get request to the application.
But in this case, what we're gonna be doing is
we're gonna specify the database name
by using the uppercase D option.
So dash uppercase D
and then the name of the database, which is DVWA.
And then we are actually gonna be trying to
dump everything that the tool can actually find.
So in this case, I'm using the dump all option.
Right away it basically went over different payloads
as you saw in here, and it found a table,
it found a table called users.
And that table appears to have a column called
passwords that may be possible password hashes
that you can potentially save
in a different file for other tools,
to potentially crack the passwords
with other tools like Hashcat or John the Ripper.
And some of the other tools that you learn
in this course.
Now, in this case, of course
we can actually save that to a different file.
It saves it to a temporary file
and you see the location here and also the tool itself,
so SQLmap comes
with a functionality that is able to crack those passwords
Of course, depending on the compute power
and many different factors, like the effectiveness
of the word list that it's actually gonna be using
and there's a built in word list
that you're gonna see in a second.
And of course the compute power
and the password complexity and so on, right?
This can take anywhere
between seconds, minutes, days, weeks, months, or never.
However, in this case, these are very, very
simple passwords that the application is actually using.
And of course, this is a fictitious environment
and I'm gonna say yes to crack them automatically.
And you see that it's actually using a builtin
word list that it comes with a tool
or you can select a custom dictionary file
or a custom work list, right?
In this case
I'm actually just gonna select number one to
use the default one
or I could have actually just pressed enter, right?
And then it says
do you want to use the common password suffixes, maybe slow,
in this case, I'm actually just gonna use the default one.
And you see that right away is actually
determining the hashes and it's cracking the passwords.
And wow, that was actually fairly fast.
Let me scroll up a little bit
so you can see some of the results
but this was the hash for one of the passwords.
The password was abc123, this is another one.
The other password was charley, letmein and password.
That's why it
didn't take that long to of course, crack those passwords.
Now, in this case, you also see a table,
the table of the users,
and the formatting is a little bit challenging here,
I'll make it just a little bit tinier
so you can see in the screen, probably actually
that's even worse.
Let me make it a little bit bigger then.
But the admin user, the password is actually password.
There's another user called Gordon Brown
and the password is abc.
There's another one called Hack Me
and the password is charley.
There's another one called Pablo Picasso.
The password is letmein
and Bob Smith and the password is password.
Now, if you keep going down below, this is basically
another database table that was actually able to dump
and we were able to actually dump all the records.
So think about that.
This may be a sensitive table getting some personal
identifiable information or some critical data in a system.
And just like this, that has been many different breaches
in the industry because of SQL injection attacks
like this one, right?
Now in this case was actually
the guestbook application or the guestbook table
that is used by the guestbook application within DVWA.
And as a matter of fact, you notice that one
of the entries in this table is the script tags
or the script payloads that we use in the cross-site
scripting example previously in this course.
So remember that we were going
over stored cross-site scripting.
Well, you actually see
that the payload is stored in the database.
And we were able to retrieve that using
and leveraging an SQL injection attack.
So again, these are very popular tools that you can use
in combination to find
and exploit SQL injection vulnerabilities.