Hello everybody and welcome to this tutorial.
Today I will begin a chapter on SQL injections.
Now before we actually begin the chapter itself and before I get into the injections themselves
before I do demos with this attack method
and demonstrate in great detail how you can perform it, I do need to explain a few things first.
So what is an SQL injection?
In general, what do you think it is?
Well basically, as the name itself says, you're just injecting SQL queries into your HTTP request methods
or somewhere else on the site.
What you are doing with this
you are effectively pulling the database information that exists behind a web server...
Basically there is a website, and that website pulls the information from a certain database
in order to be displayed on that particular website.
That is the way in which user names and passwords are actually verified.
You type it in
The web server takes it in...
Actually, not the web server itself
Rather instead, the web app that you have on your web server
takes in your user credentials.
It compares them to the user credentials, which are stored in the database.
If they match, you get logged in.
If not, your access is denied.
However, more often than not
user credentials, especially passwords, within the databases are encrypted
and that can be a problem, especially if they have MD5 hashes.
It's not easy to break.
There is a possibility always, but it can take a longer period of time
and if somebody is using a crazy long password or something of a kind
yeah, that's not gonna happen
and you might think now "Well, why do we have to do this?"
"Why should we do this at all, because if we can't get the user credentials, then why does it matter?"
It DOES matter. It does matter to a great deal.
First of all, you can get encrypted user credentials
and then you can use multiple computers to decrypt them in a shorter amount of time.
That's one way
or you can extract other useful information
and you might wonder "Well, what other useful information is there?
"What can we use?"
Well, let me just remind you of a case that happened...
Actually this happens on a daily basis, but you don't really find it in the news or anything of a kind.
A group of hackers, black hat hackers
they broke into a database, and even though the user credentials were encrypted
they were very well encrypted and they had really good policies for passwords.
So it really wasn't likely that they would ever get decrypted
that they would ever log in as those particular users.
However, credit card information
credit card numbers
they were in plain text format and they could be read
so they took about 50,000 credit cards.
Just imagine how many people were affected by this.
50,000 credit cards were stolen!
I mean, what they did with them was probably that they sell them
or they tried to use some of them on the net, or something of a kind, to wash the money
but either way, I'm just trying to make a point here
that user credentials are not the only useful type of information in a database.
There is loads of stuff, and not just credit card credentials or something of a kind
there is loads of other stuff that you can find there
that you can extract, depending on what the site is.
Sometimes you won't be able to get the password
but you will get a large amount of information in regard to a certain user.
You will get pretty much whatever you want to get without actually authenticated at all.
So whatever you wanted to do after the deauthentications
if you wanted to steal a password, for example
then log in as that user and then do something
take some information there
you will be able to take it this way without ever having to log in, which is fantastic
because you leave....you don't leave...
I mean still, your connection of course
gets logged by the server and it can be problematic
but you can also issue commands to delete certain entries in the database
not just the SQL, but others as well
and there are some logs there, you can delete them.
Sometimes you can even inject code, but that's not likely.
However, you can actually inject SQL queries and that is code in it of itself
so you can do a lot of stuff there.
Anyway, without further ado, let's go ahead and set up a virtual lab
because we can't actually go doing this on random websites.
As I said before, it's illegal and you can't do it...
You shouldn't do it
I mean physically you can, of course
technically you can, but you really shouldn't
primarily because it's illegal
and I know I'm probably getting on somebody's nerves by repeating this.
I am sorry for that, but it is necessary.
I don't now, I feel a bit better by just saying that you shouldn't do it like that.
There is no reason to do it illegally or anything of a kind
when you can set up a perfectly functional pen testing lab on your own computer
on your own machine, where you can tune the difficulties, tune the defensive measures, etc
and then attempt to bypass them in peace
without thinking that you're going to get caught or something of a kind.
Anyway, one of the first things that we're gonna need to download for this tutorial
is Damn Vulnerable Web Application.
So we need this
Pardon for the expression, but that's the actual name of the web app.
You need to go ahead and visit this website -- www.dvwa.co.uk
Go ahead and click on "Download"
I think I've downloaded it like five times by now
because surprisingly somehow I've been managing to mess up my recordings.
Save file, press okay
Go ahead and navigate over to your downloads folder
or you can just go ahead and directly open it from here.
So one more time
Click on the arrow in the upper right corner, click on the zip file.
You will see there is something here.
Just click extract, and once you click extract here
files will be extracted to your default folder.
Click "Quit"
Your default folder for downloads is actually "Downloads"
So go ahead and navigate over to your home folder.
There we go
and go ahead and click on "Downloads"
There we go
So it says DVWA
That's the file which we have extracted.
I'm pretty sure I have extracted here
Yep, there we go
Anyway, so it's DVWA 1.0.8
I have extracted it several times and not sure where the files are going anymore
but it's gonna be in the downloads folder.
If you don't want to open it from here, from the browser
just go ahead then navigate over to your downloads folder
and there you go
I have a zipped file
I have three of them
Three exactly the same files
Double click on it
Click "extract" again
and click "extract" here, and that's it.
No problems there.
My existing one just got overwritten and that's why I was a bit confused.
I didn't have two of them.
It says here "Overwrite existing files", "Recreate folders"
but anyway, that's why I was confused.
I thought I would have two of them, but apparently I have one
because it was overwritten.
Anyway, enough of that.
So we have our folder here, it's downloaded
and now we need to copy it to our default web servers folder.
Go ahead and open up your terminal.
Type in the following command -- "cp -Rv"
Capital R is for recursive mode, so it cp's all the subfolders as well
and v for verbosity, so the cp command would tell you what exactly is it copying.
Go ahead and type in " /home/ "
No, not home. Sorry
/root/
Ugh, come on. Why are you doing this to me?
I am amazing. I am truly amazing.
Let's see where this is
Oh, it's in /home/test/Downloads. Okay, sorry.
I am logged in as my regular user at the moment.
I didn't realize that.
So just type in cp -Rv /home/ Your Username
My username is "test"
Yours is probably something that you typed in, but mine is test
and then type in " /Downloads/DVWA 1.0.8"
There we go
So this folder is the one that you need to copy
and this folder you're going to copy into "/var/www/", press ENTER
and there we go.
I have completed the copy.
You can see the machine has actually told me every single file that it has copied.
Now if you have been following through my other tutorials
you might have some other files in this folder.
Before I actually began this tutorial, I cleaned this folder
"pwd" -- Print Working Directory
So if you have anything within this folder, you should really delete it prior to copying this
or you can actually copy this and then delete everything else
but it's gonna be easier before the copying itself happens.
Just make sure that there is nothing that will interfere, in any way or manner, with your web application.
However, you know what you're doing.
You can have other things lying around here, no problems.
Anyway, that would be it for this introductory video.
I will continue immediately, in the next tutorial, from exactly where we left off now.
However, until then, I bid you all farewell
and before I finish this tutorial
I would like to mention that I have been reviewing user requests
and there have been some people who have been asking for some additional tutorials
on some very specific subjects.
I will take them into consideration.
I'll see if I can do them.
If I can, time wise, I will.
However, please feel free to keep on posting your requests, demands, or whatever you wish.
If you have a specific wish
"Okay, I want to have a tutorial on how to do this particular thing within the realm of ethical hacking"
feel free to post it.
I mean, I can't promise that I'll do it
but I'll definitely read it
and there is a chance that I will, if I manage to get the time
or if I get enough requests, or something of a kind
but I will read it and I will consider it for sure, that much I guarantee it to you.
Anyway, I bid you farewell and I hope to see you in the next tutorial.