Scribd
Upload
12 views5 pages

SQL Injection Lab: Accessing Admin Credentials

The document outlines a lab exercise focused on performing a SQL injection attack on a vulnerable web application to extract the administrator's username and password. It provides step-by-step tasks including accessing the lab, discovering database tables, enumerating columns, finding column names, extracting user credentials, and accessing the admin account. The conclusion confirms the successful completion of the SQL injection attack and gaining access to the admin panel.

Uploaded by

kazumofficial
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
12 views5 pages

SQL Injection Lab: Accessing Admin Credentials

The document outlines a lab exercise focused on performing a SQL injection attack on a vulnerable web application to extract the administrator's username and password. It provides step-by-step tasks including accessing the lab, discovering database tables, enumerating columns, finding column names, extracting user credentials, and accessing the admin account. The conclusion confirms the successful completion of the SQL injection attack and gaining access to the admin panel.

Uploaded by

kazumofficial
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SQL injection attack, listing the database contents

on non-Oracle databases
Objectives

The objective of the this lab is:

• To perform a SQL injection attack on the vulnerable web application and extract the
administrator's username and password.
Lab Environment

For this lab, you would require:

• Computer with an internet connection


• Web browser

Lab Tasks

Task 1 – Access the Lab

Step 1: Access the PortSwigger Web Security Academy: SQL injection attack, listing the
database contents on non-Oracle databases

Step 2: Open Burp Suite and make sure the Intercept is on.
.
Task 2 - Discovering the Database Tables

Step 1: Start by navigating to the vulnerable web application. Observe the layout with the

navigation menu at the top and a list of products below.

Step 2: In Burp Suite, turn on the Intercept feature.

Step 3: Click on various navigation URLs to capture the requests.


Task 3 - Enumerating Columns

Step 1: With the requests captured in Burp Suite, determine the number of columns in the

database and which columns contain text data. You should see two columns containing

text.

Step 2: Now, construct a SQL query to retrieve the names of all tables in the database using the

'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--' injection

technique.

Step 3: Note down the names of the tables, especially the 'users_odzpcz' table.

Task 4 - Finding Column Names

Step 1: Since we have identified the 'users_odzpcz' table, it's time to find out what columns

it contains.

Step 2: Craft a SQL query

'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_
name='users_odzpcz'--'

Step 3: Retrieve and document the column names for further use.
Task 5 - Extracting User Credentials

Step 1: Armed with the column names, create a SQL injection query to extract the contents of the
'password_nawvpk' and 'username_bzubfy' columns from the 'users_odzpcz' table using the
'+UNION+SELECT+password_nawvpk,+username_bzubfy+FROM+users_odzpcz--' technique.

Step 2: Execute the query and retrieve the administrator's username and password.

Task 6- Accessing the Admin Account

Step 1: Log in to the web application using the obtained administrator credentials.

Step 2: Explore the admin panel and verify your access.


Conclusion:

You have successfully performed a SQL injection attack on the web application, extracted the
administrator's username and password, and gained access to the admin account.

Common questions

Powered by AI

Learning to perform SQL injection attacks enhances a security professional's ability to secure applications by providing a deep understanding of how vulnerabilities are exploited. This knowledge enables accurate threat modeling, enhances the design of more robust security measures, and informs the development of input validation and query parameterization strategies to mitigate injection risks .

Successfully accessing the admin account after retrieving credentials via SQL injection is significant because it demonstrates full exploitation of the application, allowing attackers administrative-level control over the system. This can lead to data manipulation, integrity breaches, and full application compromise .

To determine the number of text columns in the database during the SQL injection lab, requests captured in Burp Suite are analyzed to identify those containing SQL query responses. Observing the results helps identify which columns return text data, allowing attackers to focus on those when constructing UNION-based SQL injection queries .

The ethical considerations and potential legal implications of conducting SQL injection attacks include ensuring attacks are performed in a controlled environment with explicit permission from application owners. Unauthorized SQL injections are illegal and can lead to severe consequences, including legal action and reputational damage. Security testing should always align with the principles of ethical hacking, focusing on improving security rather than exploiting vulnerabilities maliciously .

Burp Suite's Intercept feature aids in discovering database tables during a SQL injection attack by capturing and allowing modification of web requests and responses. This lets attackers analyze the structure and logic of HTTP requests and helps in crafting malicious SQL queries to enumerate database tables .

Enumerating column names is essential before extracting sensitive data during a SQL injection attack because it allows the attacker to understand the database schema and target specific columns containing useful information like usernames and passwords. This facilitates precision in crafting queries that can exfiltrate sensitive data without triggering security defenses .

The 'users_odzpcz' table is identified using a SQL injection querying the `information_schema.tables` to list all tables. Once identified, it is utilized by further querying `information_schema.columns` to discover its column names. This information is then used to construct SQL injection queries to extract sensitive data like usernames and passwords .

To construct a SQL query for retrieving usernames and passwords during the lab, first identify the target table (`users_odzpcz`) and its columns using the `information_schema`. Then construct a SQL injection query like `+UNION+SELECT+password_nawvpk,+username_bzubfy+FROM+users_odzpcz--` to concatenate the text from these columns, effectively capturing credentials for exploitation .

The main objective of performing a SQL injection attack on a vulnerable web application, as outlined in the lab exercise, is to extract sensitive data from the database, specifically the administrator's username and password. This is achieved by exploiting vulnerabilities in the web application's input validation, allowing unauthorized users to execute malicious SQL queries .

The `information_schema` plays a critical role in SQL injection attacks by providing a detailed overview of the database metadata. It includes tables like `information_schema.tables` and `information_schema.columns`, which attackers exploit to enumerate database tables and columns. By crafting UNION SELECT queries aimed at these tables, attackers can systematically map the database structure, crucial for advanced SQL injection attacks .

You might also like