How to Attack Web Applications with Burp Suite & SQL Injection « Null Byte :: WonderHowTo

Web applications are becoming more and more popular, replacing traditional desktop programs at an accelerated rate. With all these new apps out on the web comes various security implications associated with being connected to the internet where anyone can poke and prod at them. One of the simplest, yet the most prevalent types of security flaws found in modern web apps areSQL injections.A typical web app doesn't actually store any information in the app itself, but rather it communicates with a backend database where data is stored. These requests are handled by SQL queries in which the application passes a statement to the database, thus returning the requested data to the application.What Is SQL Injection?SQL injection is a technique used to attack applications utilizing a database by sending malicious code with the intention of accessing or modifying restricted information in the database. There are many reasons why this vulnerability exists, including improper input filtering and sanitation.This type of attack allows one to retrieve sensitive information, modify existing data, or even destroy entire databases. The most common attack vector for SQL injection is through input fields — login forms, search forms, text boxes, and file upload functions are all excellent candidates for exploitation.Recommended on Amazon:SQL Injection Strategies: Practical Techniques to Secure Old Vulnerabilities Against Modern AttacksIn this guide, our target will be Mutillidae, an intentionally vulnerable web app included as part ofMetasploitable 2, an intentionally vulnerable Linux virtual machine (VM) designed for testing and practicing purposes. We will be connected to Metasploitable 2 on an isolated network withKalias the attacking machine.Step 1: Install a Metasploitable 2 Virtual MachineBurp Suiteis a popular tool that can be used to automate testing web apps for vulnerabilities and is conveniently included withKali. Before we get to that though, we need to set up our target machine.I will be using Metasploitable 2 in this guide, which you candownload from Rapid7's website, but any vulnerable VM will work. If you need help getting it installed, it's just like installing any other VM on your computer, and Null Byte hasa fewguidesthat could helpyou get yourvirtual labset up.Don't Miss:Hacking Web Form Authentication with Burp Suite Using a Cluster Bomb AttackOne thing to be careful with when using an intentionally vulnerable machine is exposing it to hostile networks. This means that unless you are completely unplugged from the internet, you should be usingnetwork address translation(NAT) or host-only mode.Once everything is set up, log into Metasploitable 2 — both the username and password should bemsfadmin— and find its IP address usingifconfig. What you're looking for in the eth0 is the "inet" address, which will be your IP address for testing purposes.Step 2: Configure Mutillidae in Your Attack BrowserAfter finding Metasploitable 2's IP address, navigate to it to connect to the web server. I'm using Firefox in Kali to do this.Click on "Mutillidae" to enter the web app, then navigate to "OWASP Top 10." Now, select "Injection (SQL)," followed by "Extract Data," then "User Info." You will be greeted with a login screen.Step 3: Configure Your Attack Browser for Burp SuiteNext, we need to configure the browser to work with Burp Suite since it acts as a proxy to intercept and modify requests. I'm using Firefox here, but most browsers will be similar.Open up the browser's "Preferences," click on "Advanced," then the "Network" tab. Select "Settings" next to theConnectionspot, then make sure it's set to "Manual proxy configuration" and enter127.0.0.1as theHTTP Proxyand8080as thePort. Next, check "Use this proxy server for all protocols," make sure there is nothing listed underNo Proxy for, then click "OK." We're now ready to fire up Burp Suite.Step 4: Intercept the Request with Burp SuiteOpen up the Burp Suite app in Kali, start a new project, then go to the "Proxy" tab and ensure that "Intercept is on" is pressed. This will allow us to modify the request from the webpage and insert different values to test for SQL injection. Back on the login page, I have entered an arbitrary username and attempted to log in. You can view the raw request as well as parameters, headers, and even hex information.We're primarily interested in the username field since this is what we will modify to test for SQL injection flaws. Click on the "Action" button, then "Send to Intruder." Alternatively, right-click anywhere in the request area and do the same.Step 5: Configure Positions & Payloads in Burp SuiteNext, go to the "Intruder" tab, and click on "Positions." Burp Suite automatically configures the positions where payloads are inserted when a request is sent to intruder, but since we are only interested in the username field, we can clear all positions by pressing "Clear" on the right. Highlight the value entered for username, and click the "Add" button. We will use the "Sniper" attack type which will run through a list of values in the payload and try them one at a time.Now our position is set, and we're ready to configure the payload. SQL queries work by interacting with data in the database through the use of statements. TheSELECTstatement is used to retrieve data, so a login query would look like:SELECT username, password FROM users WHERE username='myname' AND password='mypassword';Let's look at the classic SQL injection command' or 1=1--. Here is what the SQL statement looks like when entered into the login field:SELECT username, password FROM users WHERE username='' or 1=1-- AND password='';The single quote effectively turns the first part into a blank string, and 1=1 always evaluates to true, so the username query will now run as "blank" or "true." The double dashes comment out the rest of the query so the password field is ignored. Since "blank" or "true" is always true, and the password field is ignored, the database will return account data.Don't Miss:The Essential Newbie's Guide to SQL Injections & Manipulating Data in a MySQL DatabaseClick on the "Payloads" tab, and go to "Payload Options" — we can leave all the default settings for now. Here we can enter our payloads into a simple list by either adding them one by one or loading an existing list. Kali comes with a variety of wordlists including one specifically for testing SQL injection vulnerabilities. Hit "Load," and navigate to/usr/share/wordlists/wfuzz/injection/SQL.txt. Now, we are prepared to launch our attack.Step 6: Run an Intruder Attack in Burp SuiteClick the "Start attack" button, and a new window will pop up showing the intruder attack. Here you can view the progress of the requests plus their payload and status. Be patient as this can take quite some time to complete depending on the length of the list.Once intruder is finished, you can view the details of any request simply by clicking on it.Step 7: Analyze the Results in Burp SuiteWhat we are after here is the response. Every single request that was made returned astatus code200 response, but oftentimes when a payload is successful you will see a different code. Usually another way to tell if a query succeeded is if the length of the response is noticeably different from the others. I have selected the request containing the SQL query of' or 1=1 or "='because I had previously tested this injection manually, so I knew it would work.Don't Miss:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteBurp Suite is useful because you can actually render the webpage that is returned in the response by going to the "Response" tab and clicking "Render." We can see below that our SQL injection was successful and we now have usernames and passwords. If this was an administrative panel or something similar, we could log in with the admin credentials and wreak all kinds of havoc.SQL Injection in the WildAlthough SQL injection has been known as a severe vulnerability for quite some time, it continues to be one of the most common methods of exploitation today. Part of this is because anyone can piece together a semi-functioning web app and deploy it out on the internet. Even professional software developers often have a hard time adhering to secure coding principles, so it's no surprise when Jimmy down the street makes an insecure application.To become truly effective with SQL injection, it's probably best tolearn SQL itself. After all, the best way to break something is by knowing how it works and using that knowledge for abuse. While conducting your tests, once you've found a vulnerability and a payload that works, you can customize the SQL to execute your own commands. This is useful for figuring out the layout of tables, modifying data, and even discovering other tables within the database. There really is no limit to what you can do once a genuine grasp of SQL is attained.Until the day comes when proper security is the highest priority, there will continue to be SQL injection flaws in web applications. This means that there will always be plenty of work for all you white hatters, so get out there and hack away.Learn SQL:"SQL QuickStart Guide: The Simplified Beginner's Guide to Managing, Analyzing & Manipulating Data with SQL" on AmazonWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byAichi8Seiran/Pixabay; Screenshots by drd_/Null ByteRelatedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:How to Hack Web Apps, Part 3 (Web-Based Authentication)Hack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)SQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowHow To:Generate a Clickjacking Attack with Burp Suite to Steal User ClicksHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Use Burp & FoxyProxy to Easily Switch Between Proxy SettingsSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackSQL Injection 101:How to Avoid Detection & Bypass DefensesHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionSQL Injection 101:Advanced Techniques for Maximum ExploitationHow To:Use SQL Injection to Run OS Commands & Get a ShellHack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteSQL Injection 101:Common Defense Methods Hackers Should Be Aware OfHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How To:SQL Injection Finding Vulnerable Websites..How To:SQL Injection! -- Detailed Introduction.How To:Protect against SQL injection attacks when programming in PHPHow To:Hack SAML Single Sign-on with Burp SuiteBecome an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:Use Metasploit's Web Delivery Script & Command Injection to Pop a ShellHow To:Use Command Injection to Pop a Reverse Shell on a Web ServerHow To:Hack websites with SQL injectionHow To:Perform Directory Traversal & Extract Sensitive InformationHow to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHow To:Hack websites with SQL injection and WebGoatHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow Null Byte Injections Work:A History of Our NamesakeIPsec Tools of the Trade:Don't Bring a Knife to a GunfightGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Protect Your PHP Website from SQL Injection Hacks