Hello everybody and welcome to this tutorial. Today, I will begin a chapter on
SQL injections. Now before we actually begin the chapter itself and before I
get into the injections themselves, before I do demos with this
attack method and demonstrate in great detail how you can perform it, I do need
to explain a few things first. So, what is a SQL injection, in general? What
do you think it is? Well, basically, as the name itself says, you're just
injecting SQL queries into your HTTP request methods, or somewhere else on the
site? What you are doing with this, you are effectively
pulling the database information that exists
behind a web server. Basically, there's a website, and that
website pulls the information from a certain database in order to be
displayed on that particular website. That is a way in
which usernames and passwords are actually verified. You type it in, the
server the web server takes it in, your website takes it in. Actually, not the web
server itself, rather instead the web app that you have on your web server. It
takes in your user credentials, it compares them to the user credentials
which are stored in the database. If they match, you get logged in.
If not, your access is denied. However, more often than not, user
credentials, especially passwords, within the databases are encrypted, and that can
be a problem. Especially if they have md5 hashes. It's not easy to break. There is a
possibility always, but it can take a longer period of time, and if somebody is
using like a crazy long password, or something of a kind, yeah, that's not
gonna happen. And you might think now, oh, wow, why do
we have to do this? Why should we do this at all? Because if we can't get the user
credentials then what does it matter? It does matter, it does matter a great
deal. First of all, you can get encrypted user credentials, and then you can use
multiple computers to decrypt them in a shorter amount of time. That's one thing,
that's one way, or you can extract other useful information. And you might wonder,
well, what other useful information is there? What can we use?
Well, let me just remind you of a case that happened. Actually, this
happens on daily basis but you don't really find it in the news, or anything
of a kind. A group of hackers, blackhat hackers, they broke into a
database. And even though the user credentials were encrypted, they were
very well encrypted, and they had really good policies for passwords, so it really
wasn't likely that they would ever get decrypted, that they would ever login as
those particular users. However, credit card information, credit card numbers,
they were in plain text format, and they could be read. So they took about 50,000
credit cards, just imagine how many people were affected by this. 50,000
credit cards were stolen. I mean, what they did with them was probably that
they sell them, or they try to use some of them on the net, or something of a
kind to wash the money. But either way, I'm just trying to make a point here
that user credentials are not the only useful type of information in a database.
There's loads of stuff, and not just credit card credentials, or something of a
kind, there's loads of other stuff that you can find there, that you can extract
depending on what the site is. Sometimes you won't be able to get the password
but you would get a large amount of information in regard to a certain user.
You will get pretty much whatever you want to get without actually
authenticating at all. So whatever you want you to do after the
authentication, so if you want to steal a password, for example, then log in as that
user and do something, take some
information there, you will be able to take it this way without ever having to
login. Which is fantastic because you don't leave, I mean still your
connection of course gets logged by the server, and that can be problematic, but
you can also issue commands to delete certain entries in the
database, not just the SQL but others as well, and if there are some logs there
you can delete them. Sometimes you can even inject code, but that's not likely.
However, you can actually inject SQL queries, and that is code in and of
itself, so you can do a lot of stuff there. Anyway, without further ado, let's
go ahead and set up a virtual lab, because we can't actually go about
doing this to random websites. As I said before, it's illegal and you
can't do it, you shouldn't do it. I mean, physically you can of course, technically
you can, but you really shouldn't. Primarily because it's legal, and I know
I'm getting on somebody's nerves by
repeating this. I am sorry for that, but it is necessary. I feel a
bit better by just saying that you shouldn't do it like that.
There's no reason to do it illegally, or anything of a kind, when you can set up a
perfectly functional pen-testing lab on your own computer, on your own machine,
where you can tune the difficulties, tune the defensive measures, etc., and then
attempt to bypass them in peace without thinking that you're gonna get caught, or
something or kind. Anyway, one of the first things that we're gonna need to
download for this tutorial is Damn Vulnerable Web Application. So we
need this, pardon for the expression but that's the actual name of the
web app. You need to go ahead and visit this website, so www.dvwa.co.uk.
Go ahead and click on download. I think I've downloaded it like five times
by now because surprisingly somehow I've been managing to mess up my
recordings. Save file, press OK, go ahead and navigate over to your downloads folder,
or you can just go ahead and directly open it from here. So one more time click
on the arrow in the upper right corner, click on the zip file, you will see
there's something here. Just click extract, and once you click extract here,
files will be extracted to your default folder. Click quit, and your default folder
for downloads is actually downloads. So go ahead and navigate over to your home
folder, there we go, and go ahead and click on downloads, there we go.
So it says dvwa, that's that's the file which we have extracted, I'm pretty sure
that I've extracted it here, yep, there we go. Anyway, so it's DVWA-1.0.8. I have
extracted it several times, and not sure where the files are going anymore, but
it's gonna be in the downloads folder. If you don't want to open it from here, from
the browser, just go ahead and navigate over to your downloads folder, and there
you go we have a zip file, I have three of them, three exactly the
same files, double click on it, click extract again, and click extract here, and
that's it. No problems there. My existing one just got overwritten, that's
why I was a bit confused, I didn't have two of them. It says here
overwrite existing files, recreate folders, but, anyway, that's why
I was confused. I thought I would have two of them, but apparently I
have one because it was overwritten. Anyway, enough of that. So we have our
folder here, it's downloaded, and now we need to copy it to our default
web servers folder. You go ahead and open up your terminal, type in the following
command: cp -Rv. Capital R is for recursive mode, so it copies
for all the subfolders as well, and v for
verbosity so the cp command will tell you what exactly is it copying. Go
ahead and type in /home/...no, sorry,
root. Oh, come on, why are you doing this to me? /home...
I'm amazing, I am truly amazing. Let's see where this
is. Oh, it's in /home/test/downloads. OK, sorry, I
am logged in as my regular user at the moment. I didn't I didn't realize that. So
just type in cp -Rv /home/test, your username, my
username is test, yours is probably something that you typed in, but
mine is test, and type in /Downloads, and then you need to type in
DVWA-1.0.8. There we go. So this folder is the one that you need
to copy, and this folder you're going to copy into /var/www/, press enter,
and there we go. I have completed the copy. You can see the machine has
actually told me every single file that it has copied. Clear the screen. Now if you have
been following through my other tutorials, you might have noticed, you
might have some other files in this folder. Before I actually began this
tutorial I've cleaned this folder. It's slash, actually I'm going to do it like this. pwd,
print working directory. So if you have anything within this folder you should
really delete it prior to copying this. Or, you can
actually copy this and then delete everything else, but it's gonna be easier
before the copying itself happens just to make sure that there is nothing
that will interfere in any way or manner with your web application. However, if you
know what you're doing, you can have other things lying around here, no
problems. Anyway, that would be it for this introductory video. I will
continue immediately in in the next tutorial from exactly where we left off
now. However, until then I bid you all
farewell, and before I finish this tutorial I would like to mention that I
have been reviewing user requests, and there have been some people who have
been asking for some additional tutorials on some very specific subjects.
I will take them into consideration, I'll see if I can do them. If I can
timewise I will. However, please feel free to keep on posting your requests, demands,
or whatever you wish. If you have a specific wish, okay, I want to have
a tutorial on how to do this particular thing within the realm of ethical
hacking. Feel free to post it. I mean, I can't promise that I'll do it, but I'll
definitely read it, and there is a chance that I will if I manage to get the time,
or if I get enough requests, or something of a kind. But I will read
it and I will consider it for sure. That much I guarantee it to you. Anyway, I bid
you farewell, and I hope to see you in the next tutorial.