Hello everybody and welcome to this tutorial.
Today, I'm just going to continue from where I left off
Anyway, go ahead and open up your browser.
Let's just see what the IP address is
So this is my IP address.
Go ahead and copy it
Yours will perhaps be different or something of a kind.
Doesn't really matter
Just go ahead and copy it
CTRL V into the URL
URL field of your browser
Paste it there
Go ahead and open up your folder
and immediately we encounter a problem here we need a
We need a username and a password.
Go ahead and open up your terminal.
These things are stored by default in your installation files.
Actually, they are in the read me files.
So in the instruction set, go ahead and type in "cd /var/www/
"cd DVWA - 1.0.8/ "
There we go. There is a read me file.
So let's just go ahead and open up the read me file
and you have a lot of explanations here.
Feel free go ahead and read through them.
Well, actually there aren't that much of it, but they were out there are some useful things.
So it says "Default username = admin" and "Default password = password"
There is an installation video as well.
I mean, I've already showed it to you
but you can go ahead and feel free to watch this version of it as well
I don't think you'll see anything extremely different
but they use some to actually run the downloadable application.
I use a different type here, but it doesn't really matter.
You can use the one that I am using, the one that comes as a default with Kali Linux operating system.
Anyway, as I said, feel free to check the link out
but we've mainly opened this file to see the username and password
and username is "admin" and password is "password"
Feel free to change that later on
or don't, doesn't really matter
since you're the only person using this virtual machine.
If this is your physical machine, it would be a good idea to actually change it.
So "admin", and down here I'm gonna go ahead and write "password"
but since you are using a bridged adapter in VirtualBox
perhaps it would good idea to change it indeed
but for the time being, let's just go ahead and see what's up for the offer here.
So you have a lot of these types of attacks.
You have Brute Force, Command Execution, CSRF, SQL Injection, File Inclusion, etc.
There are a lot of them.
I will go through some of them
I won't go through all of them, obviously
but I will go through some, as I said
through a significant amount anyway
and down below, you have DVWA security
so go ahead and click on that.
You are able to set your security level of this web application, in general.
It can be low, medium or high.
I would recommend that you go with high
primarily because that's going to reflect the real time circumstances to the greatest degree.
If you go with low, pretty much everything you do, it's gonna fly
which is not the case in the real world.
Anyway, now that this is set on high
click on submit to remember changes
and go ahead and click on "SQL injection (Blind)"
Now this is where usually people type these things in
and you might think "Oh well, that's not the case in the real world"
"We don't have a neat clear field where we can type the things in"
but just keep in mind this is just for your convenience.
This is just for convenience sake.
If I just click on empty submit, you can see up here in the URL section there
it says "id=", and then there's nothing there
So whatever I was typing in here would basically be set to id=
So let's type in 3333 and submit.
There you go
It says "id=3333"
So in the real world, you would be typing these things up here in the id section or something of a kind.
While here, they've just constructed a neat field where you can type these things in
As I said, it doesn't really matter all the things
All the things you type in the user id field
you feel you can also type in here, in the URL and the
and the effect will be exactly the same.
There is literally no difference whatsoever.
Anyway, now that we have our security parameters set up and that the environment is set up
that we've managed to log into it
let's go ahead and start up burp suite
Why do we need burp suite?
Burp suite will create a proxy for us.
We need it in order to capture some information.
Primarily we need to the capture the session cookie
so that we can use it later on with the SQL map
primarily because we have actually logged into a website
and we need to enable our SQL map to actually request the field
and go past the authenticated with the session id cookie.
This is also good method
primarily because most of the sites out there will allow you to create some sort of a basic user
and at the registration site, at the main login site
there are countless countermeasures.
There are intrusion detection systems
If they see something is up, the red flags will be raised
your IP will be banned, and then you will need to change the IP.
A ton load of things will be there.
Almost all the security systems will be focused primarily on that page
and that can be a problem
but if you manage to create even a regular user, any kind of user
if you just type in some credentials there, whatever
log in, then suddenly a lot of sites
and this is a really bad thing for lot of websites out there
A lot of these systems tend to simply disappear.
All the fields past any authentication are pretty much neglected
and there are a lot more fields and there's a far greater possibility that the mistakes have made somewhere
and that
and that you can actually make some sort of an exploit there using an SQL injection method.
However, if you can't create any sort of users or anything of a kind
you will actually need to attack the login page itself.
In that case, I do not believe that you will need a session id
Although you can still get it.
Now keep in mind that this is your browser that we're dealing with
and we can do with it whatever we want
even though this website is somewhere in a remote site
we can do whatever we want with this browser
in order to conveniently capture the information that goes between us and the website
in order to use it SQL map.
For that, we need to use burp suite, as I have said.
So go ahead and open up another terminal.
log in as root, type in "burpsuite, press ENTER
If you're running it the first time around, you might be asked to accept the license agreement
and to provide anonymous feedback.
Whether you provide anonymous feedback or not, the choice is entirely yours
but you do need to agree to the Terms of Use.
As I said you don't actually provide any sort of feedback whatsoever
they've just included that as an option, but you can disable it and it's fine
The program won't actually send anything in regards to you.
Anyway, we have the burp suite running up.
Go ahead, and in the upper left corner, click on proxy
Click on intercept
Actually, you can click on options in the right
and make sure that 127.0.0.1 8080 is selected.
It will be selected by default.
I have created some other things down below, but don't pay any attention to that.
Go back to intercept
Make sure that the intercept is on and not off.
Go ahead and minimize your terminals, go back to your web browser, click on edit
preferences, advanced, network, settings, click on manual proxy configuration
and make sure that you have these things typed in.
So 127.0.0.1 port 8080
Use proxy server for all particles.
There you go
So those are pretty much the only setting that you need to type in.
You need to type in the loopback IP address and you need to write in the port number.
The port number is 8080
Click "Okay", close, reload the site
and of course, the site won't actually be able to reload until you let it through.
So you can immediately see that the burp suite has managed to capture information here
and it is waiting for you to tell us what you want to do with it.
So you can either forward it, you can drop it
and there are actions here to send it through a lot of other functionalities in burp suite
but for the time being, I'm going to copy the URL
So go ahead and click on "action", copy URL
Open up your text editor, whichever one you want
I don't know, the burp suite has some sort of problems copying these things
I have no idea why.
Let's see if it's gonna work like this.
Excellent
So if it doesn't work the first time around, just try to do it again and usually it will work
and if it doesn't work, try it again and again
and a couple of times like that.
So if it doesn't work after a couple of times, there's some sort of a serious problem.
If it does work, fantastic
Anyway, you see that the site is still spinning and nothing has happened.
I can just click on forward and the site will load in the back.
Intercept still on, but we don't actually...Oh yes we do.
Okay, so I do apologize
I actually forgot to take one more thing out of this.
Let's just repeat the process.
So you see if you reload the site
Excellent
So you see where it says cookie
Security high...blah blah blah...Whatever
...some other things down below that not even God can read...
and then you have PHP ESSID
Copy that
That is your cookie session ID and you will need it.
So go ahead and copy it, open up your text editor
and right below the URL, go ahead and type this cookie session ID
Excellent
So now you can feel free to close the burp suite
"Are sure you want to exit?" Yes I am sure.
You can see when I shut the proxy
since my browser is configured to go through a proxy
it's gonna shut down immediately and it's not going to be able to do anything.
You will effectively render your browser unable to surf the web at all
You won't be able to use it to surf the web.
So go ahead back to settings, click on "use system proxy settings, click on "Okay"
close, try again, and there we go.
Then it does work without any sort of problems.
Now that we have taken some information...
Remember, all of this that you're doing
you are doing on your own machine
the only thing that is remote here is this website.
So you can configure your browser any way you like.
We've simply used burp suite to extract certain information.
We wanted a cookie session and we wanted the exact URL
Well you could have gotten the URL from here, to be honest
but it doesn't really matter, I wanted to get the cookie session ID
There are some other ways and other methods, but I decided to use this one in particular with the burp suite
and in the follow-up tutorial, we're gonna use the SQL map in order to try to do something here.
To see if we can find some vulnerabilities.
To see if we can actually perform a scan and eventually extract some information.
Until then, I bid you all farewell
and wish you a ton load of luck with this.