Damn Vulnerable Web Application

Sara Sartoli Akbar Siami NaminNSF-SFS workshop

July 14-18, 2014

How to install and run DVWA Exploit a some SQL Injection attacks Upload a malicious file Exploit an XSS attack

OutLine:

DVWA is a PHP/MySQL web application that is damn vulnerable to most common web attacks.

The main goals are:◦ to be an aid for security professionals to test their skills and

tools in a legal environment.◦ to help web developers better understand the processes of

securing web applications.◦ To be an for aid teachers/students to teach/learn web

application security in a class room environment.

Introduction:

1. Install Xampp

2. Download DVWA and extract that3. Copy DVWA folder in web server root4. Go to DVWA Directory>>Config>> Open config.inc.php and

change $_DVWA[ 'db_password' ] = 'p@ssw0rd' to $_DVWA[ 'db_password' ] = 'p@ssw0rd' to $_DVWA[ 'db_password' ] =''

How to Install and Run:

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application.

In SQL injection, SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

Input data must be validated to ensure that the web application is operated on clean, correct and useful data .

SQL Injection:

The query, executed back in the database looks like:SELECT first_name, Last_Name from users where ID=‘1’;

A solution that would extract all the first name and passwords from the table is to use following injection string:

SELECT first_name, Last_Name from users where ID=‘1’ or ‘0’=‘0’;

Use SQL Injection to determine application users:

The basic idea is to make the database to respond with error message containing database type and version.

Entering a quote make the DB to consider any characters after quote as a simple string and non sql code and cause syntax error.

Now we know that the database is MySQL so we can use appropriate queries to find out the version.

In MySQL the queries that return the version are:SELECT version()

SELECT @@version Enter the following srings:1. ‘ union select @@version#2. ' union select null, @@version # The query that would extract DB version is: SELECT first_name, Last_Name from users where ID=‘ ’union select null, @@version #’;

Use SQL Injection to find DB Type and Version:

In MySQL the queries that retrieve the host_name anddatabase name are:

SELECT database()SELECT @@ hostname()

So, What would be the injection string????

Use SQL Injection to find host name and database name:

Information schema is a database that contains information about all of databases that the installed MySQL contains.

Enter the following string:a' UNION select table_schema,table_name FROM

information_Schema.tables;# Try to find damn vulnerable web app database and its tables. Now , set DVWA to high security and attack again.

Use SQL Injection to display all of available DBs and all of their tables:

The first step in many attacks is to get some code to the system to be attacked. Then the attacker only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step.

Unrestricted uploaded File:

1. Copy a JPG file and a PNG file to the root.2. Choose a PHP file in the root Path and try to upload that.3. Try to upload JPG and PNG file as well.4. Give it a try with medium and high security.

Note: Check the PHP code to figure out What the differences are?

Upload a malicious PHP file:

Cross-Site Scripting attacks are a type of injection problem, in which client-side script is injected into web pages viewed by other users.

Cross Site Scripting:

1. Select “XSS Stored” from the left navigation menu.2. Name: Test 13. Message: <script>alert(“my xss attack”)</script>4. Sign guestBook

Note: This XSS exploit will be displayed for all of users.

XSS basic exploit test:

1. Reset the DataBase2. Select “XSS Stored” from the left navigation menu.3. Input Name: Test 24. Input Message: <iframe src=“http://www.cnn.com”></iframe>5. Sign Guest Book

Notes: We need to reset the database otherwise the each XSS exploit will

appear for each example. This is a powerful exploit because a user could use SET to create

Malicious cloned website and place in here.

XSS Stored IFRAME Exploit Test:

1. Reset the DataBase2. Select “XSS Stored” from the left navigation menu.3. Input Name: Test 34. Input Message: <script>alert(document.cookie)</script>5. Sign Guest Book

Notes: It is possible to modify this XSS script to send the cookie to a

remote location instead of displaying it.(man in the middle attack) Check the PHP code to figure out What the differences are?

XSS Stored COOKIE Exploit Test:

Thank you