XSS and SQL Injection Lab Report
Uploaded by
areebali2024csXSS and SQL Injection Lab Report
Uploaded by
areebali2024csCommon questions
Powered by AIReflected XSS vulnerabilities occur when an injected script is reflected off a web server, such as through a URL or form input, and executed immediately by the browser. In contrast, stored XSS vulnerabilities involve injecting a script that is saved on the server, such as in a database, and executed whenever an affected page is loaded by any user .
The lab report utilized SQLMap, an open-source tool, to automate the SQL injection discovery process. Commands were run to enumerate databases, test for SQL injection vulnerabilities, and dump user tables, resulting in successful extraction of databases like dvwa and credential information from user tables .
A SQL Injection vulnerability on a login page is critical because it can enable attackers to bypass authentication mechanisms through payloads like ' OR 1=1--, which evaluates to true due to logical flaws, allowing unauthorized admin-level access. This risks exposing sensitive data, compromising user accounts, and allowing malicious actors to manipulate the database .
Manual exploitation provides a deep, tailored understanding of application behavior, enabling testers to design precise and context-specific attacks, but is time-consuming and requires expertise. Automated tools like SQLMap expedite the process by quickly identifying common vulnerabilities across different vectors, though they may overlook complex attack paths or require manual validation of findings to avoid false positives .
Exploiting a DOM-based XSS vulnerability involves modifying the DOM environment within the client-side JavaScript code by manipulating the URL or other client-side parameters. It is considered high severity because the execution of the malicious script occurs within the client's browser, potentially allowing the script to execute under the user's context and access sensitive information .
Error-based SQL injection directly leverages error messages displayed by the database to extract information, identified by observing SQL error messages following injection attempts. Blind SQL injection does not return error messages; instead, inferences are made based on behavioral responses or time delays in processing queries, identified by conditional logic tests such as '1' AND '1'='1-- versus '1' AND '1'='2-- .
Payload manipulation through GET parameters contributes by sending crafted inputs directly via URLs to test how web applications process and sanitize these inputs, revealing potential SQL Injection vulnerabilities. However, its limitations include reliance on the visibility of GET parameters and potential server-side protections like input validation or parameterized queries which prevent exploitation .
Confirming the number of columns is crucial to structure the UNION query correctly for successful SQL injection exploitation. The lab report achieved this by using ORDER BY clauses with incremental numbers, identifying the number of columns when an error was produced, indicating no more columns exist beyond that point .
Burp Suite and SQLMap function collaboratively in the web security testing process where Burp Suite is primarily used for intercepting, modifying, and analyzing HTTP requests to identify potential security vulnerabilities, while SQLMap automates the injection of malicious SQL queries to detect and exploit SQL injection vulnerabilities, as demonstrated in extracting database structures and user credentials .
The SQL Injection payload '1' UNION SELECT database(), user() -- -' enables an attacker to execute a union query that reveals the current database name and user by combining results from different queries. This exposure provides attackers with crucial information about the system configuration, such as database structure and user context, potentially allowing further targeted attacks like privilege escalation or unauthorized data access .