Scribd
Upload
23 views9 pages

Ism TH Da 4

The document describes steps taken in a SQL injection attack against a mySQL database, including verifying the database is vulnerable, retrieving database and user information, finding database tables, and ultimately retrieving user passwords. The attack is observed through network traffic captured in Wireshark.

Uploaded by

pandeaditya1507
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
23 views9 pages

Ism TH Da 4

The document describes steps taken in a SQL injection attack against a mySQL database, including verifying the database is vulnerable, retrieving database and user information, finding database tables, and ultimately retrieving user passwords. The attack is observed through network traffic captured in Wireshark.

Uploaded by

pandeaditya1507
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 9

Lab - Attacking a mySQL Database

ADITYA SANTOSH PANDE


21BCE0309
INFORMATION SECURITY AND MANAGEMENT

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 1 of 7 www.netacad.com
Lab - Attacking a mySQL Database

a. The PCAP file opens within Wireshark and displays the captured network traffic. This capture file extends
over an 8-minute (441 second) period, the duration of this SQL injection attack.

What are the two IP addresses involved in this SQL injection attack based on the information displayed?

10.0.2.4 and 10.0.2.15

Part 2: View the SQL Injection Attack.


In this step, you will be viewing the beginning of an attack.
a. Within the Wireshark capture, right-click line 13 and select Follow > HTTP Stream. Line 13 was chosen
because it is a GET HTTP request. This will be very helpful in following the data stream as the application
layers sees it and leads up to the query testing for the SQL injection.

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 2 of 7 www.netacad.com
Lab - Attacking a mySQL Database

The source traffic is shown in red. The source has sent a GET request to host 10.0.2.15. In blue, the
destination device is responding back to the source.

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 3 of 7 www.netacad.com
Lab - Attacking a mySQL Database

b. In the Find field, enter 1=1. Click Find Next.

c. The attacker has entered a query (1=1) into a UserID search box on the target 10.0.2.15 to see if the
application is vulnerable to SQL injection. Instead of the application responding with a login failure
message, it responded with a record from a database. The attacker has verified they can input an SQL
command and the database will respond. The search string 1=1 creates an SQL statement that will be
always true. In the example, it does not matter what is entered into the field, it will always be true.

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 4 of 7 www.netacad.com
Lab - Attacking a mySQL Database

d. Close the Follow HTTP Stream window.

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 5 of 7 www.netacad.com
Lab - Attacking a mySQL Database

Part 3: The SQL Injection Attack continues...


In this step, you will be viewing the continuation of an attack.
a. Within the Wireshark capture, right-click line 19, and click Follow > HTTP Stream.
b. In the Find field, enter 1=1. Click Find Next.
c. The attacker has entered a query (1’ or 1=1 union select database(), user()#) into a UserID search box on
the target 10.0.2.15. Instead of the application responding with a login failure message, it responded with
the following information:

The database name is dvwa and the database user is root@localhost. There are also multiple user
accounts being displayed.
d. Close the Follow HTTP Stream window.
e. Click Clear display filter to display the entire Wireshark conversation.

Part 4: The SQL Injection Attack and Table Information.


The attacker knows that there is a large number of SQL tables that are full of information. The attacker
attempts to find them.
a. Within the Wireshark capture, right-click on line 25 and select Follow > HTTP Stream. The source is
 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 6 of 7 www.netacad.com
Lab - Attacking a mySQL Database
shown in red. It has sent a GET request to host 10.0.2.15. In blue, the destination device is responding
back to the source.
b. In the Find field, enter users. Click Find Next.
c. The attacker has entered a query (1’or 1=1 union select null, table_name from
information_schema.tables#) into a UserID search box on the target 10.0.2.15 to view all the tables in th

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 7 of 7 www.netacad.com
Lab - Attacking a mySQL Database

database. This provides a huge output of many tables, as the attacker specified “null” without any furtherspecifications.

What would the modified command of (1' OR 1=1 UNION SELECT null, column_name FROM
INFORMATION_SCHEMA.columns WHERE table_name='users') do for the attacker?

d. Close the Follow HTTP Stream window.


e. Click Clear display filter to display the entire Wireshark conversation.

Part 6: The SQL Injection Attack Concludes.


The attack ends with the best prize of all; password hashes.
a. Within the Wireshark capture, right-click line 28 and select Follow > HTTP Stream. The source is shown
in red. It has sent a GET request to host 10.0.2.15. In blue, the destination device is responding back to
the source.
b. Click Find and type in 1=1. Search for this entry. When the text is located, click Cancel in the Find text
search box.

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 8 of 7 www.netacad.com
Lab - Attacking a mySQL Database

The attacker has entered a query (1’or 1=1 union select user, password from users#) into a UserID
search box on the target 10.0.2.15 to pull usernames and password hashes!

Which user has the password hash of 8d3533d75ae2c3966d7e0d4fcc69216b?

c. Using a website such as https://crackstation.net/, copy the password hash into the password hash
cracker and get cracking.

What is the plain-text password?

d. Close the Follow HTTP Stream window. Close any open windows.

Reflection Questions
1. What is the risk of having platforms use the SQL langauge?

2. Browse the internet and perform a search on “prevent SQL injection attacks”. What are 2 methods or steps
that can be taken to prevent SQL injection attacks?

 2018 - 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public Page 9 of 7 www.netacad.com

You might also like