I've setup this blog as prompt for all my computer security research tips notes guides and videos, the majority of research will be conducted on vulnerable web apps
ok so things are moving quite rapidly now and to be honest I'm truly overwhelmed with all this pentetsing, from duplicate reports to writing detailed reports and, you are literally learning everyday, the experts are 100% correct web applications are completely full of holes,rest assured im working hard in the background and will give this blog some much need love when I get the chance.
I had my first confirmed bug last week, I've not asked for pubic disclosure yet but will do in the future, although now I'm participating in these bug bounty program I see why some researchers are at logger heads with whether to publicly disclose their vulns or not, well watch this space.
Some things I've learned quickly
Do not under estimate the power of reading publicly disclosed vulnerabilities.
Do not underestimate the knowledge you get from reading the web application hackers handbook [pdf didnt help] I needed the physical book for sure
OWASP top 10
The wide range of deliberate vulnerable apps [mutilidae, DVWA, BWAPPS, webgoat etc]
be patient there are lots of bounty hunters, but there is more than enough bugs for everyone and they wont be going away anytime some.
some annoyances I've come across.
vendors paying out for bounties which are out scope, while its good vendors pay and/or acknowledge bugs that are out of scope, just think whats been missed by researchers as they didn't know a particular domain was in scope.
people begging bounty, yes we all need to eat and i'll be the first to say I'm doing this firstly for the money and as each day goes by and im seeing more and bugs in applications I use I see why people also do this not for the money but for the benefit of everybody involved.
finally
no body was born (as far as I know) with the ability to walk or run, yes we had the means to (legs) but they had to learn first (knowledge) this applies here in this field to, in a nutshell
beginners
dont try run before you can walk
experts/seniors/elders
we all have to start from somewhere
I see i haven't posted anything in a while, well fear not, ive created a lot of content, truth is I just dont have time to blog or upload, all that precious time is been spent bug hunting, Still I thought i'd share something you may find valuable on your adventures, a post exploitation guide, which is really handy,
A new version of mutillidae has been released, the current version is 2.6.34, dont forget to download the md5 checksum for the zip file and then verify the integrity of the download
update I've sent jeremy druin aka webpwnized a message stating that after install etc the version shows as 2.6.32 not sure if the error is in the upload or directly in web app it self
awaiting response
update: according to webpwnized this will be fixed in a coming update, for know I can edit the the /includes/constants.php file myself and correct it
Practice sql injection hacking skills using this vulnerable sql framework
browser:iceweasel
os: kali linux
Web App: SQL-Labs
SQLi-LABS can be downloaded from
https://github.com/Audi-1/sqli-labs
There are several lessons and I will iterate through them all starting with less-1
lesson: number 1 Object: GET - Error based - Single quotes - String
This is simple stuff, simply visit
http://192.168.0.9/sqli-labs/Less-1/
we are met with an info message
Please input the ID as parameter with numeric value
we can achieve simply appending the following to the url
?id=1
so our full url will now look like
http://192.168.0.9/sqli-labs/Less-1/?id=1
a users username & password are returned to the screen changing ?id=1 to for example ?id=2 will display different credentials.
To get a simple error message produced on the screen simply append ' (a single quote) to the url which returns the following error message
You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right
syntax to use near ''1'' LIMIT 0,1' at line 1 this bares all the hallmarks of a sql injection vulnerability, so therefore lets fire up sqlmap
sqlmap --url="http://192.168.0.9/sqli-labs/Less-1/?id=1" --dbs this gives us the names of the databases
if your not sure which database to look in you'll have to poke around and see, our target is the security database, next we want to have a look at the available tables therefore our next command is
now then the users table looks interesting, lets go ahead and see whats inside, we have the database name and table name now we need to see whats in the column, heres the new command
we have sucessfully a exploited the sql injection vulnerability to retrieve all id's usernames and passwords from the mysql database remember in the previous post sqlmap-database-takeover-tool-old-skool we had to use the --data="" switch this was because the method was post and in this example the method is get therefore there was no need use --data=""
previously in this blog post we used passed some parameters to sqlmap to aid in our attack, well there is a faster method of passing data to sqlmap from burpsuite and its easy
next part of the command
--data="ENTER_DATA_HERE" (this is actually the body of the post request)
--data="username=admin&password=admcdicndsjcn&login-php-submit-button=Login" and finally --banner (retrieves database banner) the sqlmap command is now complete. our full sqlmap command is;
(a truncated video displaying the outcome of the injection)(**banner**)
BYPASSING A LOGIN USING SQLMAP
so we are 100% certain that the mysql database is vulnerable to sql injection, now we will escalate our attack and see what credentials we can grab
So now as we know we need to bypass the loggin presented to us on the login page, we know now that the application vulnerable to sql injection so we will mount an attack to verify this. We already have the main command for the attack already
we simply need to append the command slightly, first new command/switch/paramemter we enter is
--dbs (this tells us the available databases)
there was 6 options
form experience I know that the database we need to attack is named nowasp, now we can further ammend our sqlmap command to ;
remove --dbs (as we now know the name of the databse that we need to hack) add -D owasp and add --tables (the tables switch will list all tables within the database owasp)
again experience tells me i want to retrieve the info held within the accounts table we can now further ammend our command remove --tables add -T accounts add --Columns (gives us a list of columns to select info from
bingo we know have a full list of all the columns of info we want to retrieve, in this case i want
firstname
lastname
password
username
we are now ready to complete our sqlmap command and hack so we
remove --columns
and add -C firstname,lastname,password,username
we need to --dump all credentials retrieved so we can see them so we us the --dump command, our full sqlmap injection command is
when downloading files especially from the Internet, its crucial that you verify your download, this will help you release if the actual you file you have just downloaded has been tampered with in any way by another party.
In this example we have just downloaded WebGoat from the interweb the filename and checksum is displayed in the pic below
