Scribd
Upload
3 views6 pages

45-SQL Injection Attack

The document details a SQL Injection attack demonstration using various web applications such as OWASP Mutillidae II, DVWA, and Hack it Yourself Auction. It outlines the steps to exploit SQL vulnerabilities by entering specific SQL queries that bypass authentication and extract user information. The attacker utilizes the 'OR 1=1' technique to gain unauthorized access to admin accounts and retrieve sensitive data.

Uploaded by

prince prathaban
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views6 pages

45-SQL Injection Attack

The document details a SQL Injection attack demonstration using various web applications such as OWASP Mutillidae II, DVWA, and Hack it Yourself Auction. It outlines the steps to exploit SQL vulnerabilities by entering specific SQL queries that bypass authentication and extract user information. The attacker utilizes the 'OR 1=1' technique to gain unauthorized access to admin accounts and retrieve sensitive data.

Uploaded by

prince prathaban
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SQL Injection Attack:

OWAP IP Address
[Link]
PHPAC
[Link]
Metasplotiable IP Address
[Link]
Attacker IP Address
[Link]

Attacker
SQL Injection
OWASP Mutillidae II
DVWA
Hack it yourself Auction PHP

1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717


Open OWAP Server in the browser [Link] Click on “Mutillidae” link. Now, Go to OWASP
2013> A1 Injection(SQL) > SQLi- Extract Data>User Info(SQL).

Here, Now Enter name an apostrophe (‘). Click on View Account Details. This will cause an error
and give you an output. From message we can see that this is a MYSQL database.
However, since we don’t have a username or password, we can make the statement Valid
without them by using comments ( — ) and the SQL operator “OR.” We need query to execute
like SELECT * FROM accounts WHERE username= ‘ OR 1=1 — password=’’.

Therefore, we will enter second query to try is → ‘ OR ‘1’=’1

Click on view Account Details and we can see the results that we got entire table which includes
admin username/password also.

2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717


Open OWAP Server in the browser [Link] Click on “Mutillidae” link. Now, Go to OWASP
2013> A1 Injection(SQL) > SQLi- Bypass Authentication>Login.

Enter the payload both in Username and Password → ‘ OR ‘1’=’1 and click Login

3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717


SQL Injection work we are successfully login as Admin.

Open your browser and enter the required URL [Link]/dvwa/[Link] Log in using the
username “admin” and password as “password”. These are the default DVWA login credentials.
After a successful login, set the DVWA security to LOW then click on SQL Injection on the left-
side menu.

4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717


On the User ID field, enter “1” and click Submit. That is supposed to print the ID, First_name,
and Surname on the screen. Type ‘OR’1’=’1. This statement it is always true so it will cause the
application to return all the results.

Similarly open PHP Auction website [Link] type SQL Injection quarry: ‘or 1=1# both in
Username and Password and click Go!

5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717


SQL Injection quarry work we are successfully Login in Hack it yourself Auction site.

Click on Your Control Panel to see all user details.

6 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , WhatsApp: 00966564303717

You might also like