Instructor: In this lecture, and the next few lectures, 2 2
we're going to be talking about a popular type 3 3
of vulnerabilities, called SQL Injections. 4 4
Before we start talking about how this occurs 5 5
and how to exploit it, let's first learn what SQL is. 6 6
Now, if you're giving a pen test on a certain website, 7 7
chances are this website is a little bit bigger 8 8
than smaller websites, so it's probably using a database. 9 9
Most websites, other than very simple websites, 10 10
use databases, the databases are used to store data, 11 11
so they're store user names, passwords, news articles, 12 12
blog posts, pictures. 13 13
Anything that happens on the website, literally, 14 14
is stored on a database and the web application queries 15 15
the database and then displays the data to you 16 16
or to the users, on screen. 17 17
When the users do something, it will either update, delete, 18 18
or modify the data that exists in the database. 19 19
This interaction, between the web application 20 20
and the database, happens using a language called SQL. 21 21
So, let me show you what I mean by database, 22 22
this is just an example, 23 23
I'm not hacking anything, 24 24
I'm literally just going to log in to the database 25 25
that is installed on our Metasploitable machine, 26 26
and then we're just gonna see what's been installed on it. 27 27
So, I'm not doing any hacking, there's nothing here, 28 28
there nothing fancy, just logging into my SQL. 29 29
And then I'm putting the user name is root 30 30
and the Metasploitable doesn't use a password for the root, 31 31
which is really bad, but obviously it's a vulnerable system. 32 32
So, I'm just gonna log in and I'm not hacking anything, 33 33
I'm not doing any SQL injections, 34 34
this is just the terminal for MySQL, 35 35
which the web application would use to interact 36 36
with the database. 37 37
So, I'm just trying to show you what I mean by databases 38 38
and what's saved in there. 39 39
So, the first thing I'm going to do is, 40 40
I'm just going to type in show databases. 41 41
And that'll show us the databases that exist 42 42
on our target server and you can see that we have 43 43
the information schema, this is a default database 44 44
that holds default information, 45 45
information about all the other databases. 46 46
So this one gets installed by default, 47 47
when you install MySQL. 48 48
The rest have been installed for each web application. 49 49
So, we can see, we have one for tikiwiki, 50 50
we have one for owas10, and that's for this one Mutilllidae. 51 51
We also have one called mysql, 52 52
we have one called metasploit, 53 53
and one for dvwa, which is the one that we've been using, 54 54
the web application. 55 55
So, you can see, for each web application 56 56
we actually have a database 57 57
and this database holds the information that is used 58 58
by that web application. 59 59
Let me show you what's in there, 60 60
so I'm gonna use the owas10 database. 61 61
So this is the one that is, again, this is the one 62 62
for Mutilldae, for this web application. 63 63
And we can see the table, so each database has a table, 64 64
tables, and in the tables there is information. 65 65
So, I'm gonna say, "show tables" to see the tables 66 66
that we have. 67 67
And you can see, we have a table for accounts, 68 68
so you can assume that this table has information about 69 69
the usernames, passwords, and information about the users. 70 70
We have a table for blogs, so probably has the blog inputs, 71 71
the posts, and the comments in there. 72 72
You can see captured data, credit cards, 73 73
so there's a table that contains credit cards. 74 74
Now, this is huge for shopping websites, 75 75
they actually would have credit cards table 76 76
and the information for the credit cards 77 77
would be stored there. 78 78
Basically, the database will store everything, 79 79
all the data that is used on the website. 80 80
'Cause they don't get stored on files, it's not efficient. 81 81
So, let's have a look on the accounts and if I just say, 82 82
"select" so this is exactly how the web application 83 83
would be retrieving information from the database, 84 84
it will selecting stuff, updating, or deleting. 85 85
So, I'm doing a select statement here, again, 86 86
this is not hacking, I'm not doing anything, 87 87
just selecting stuff. 88 88
And I'm gonna select star, which means everything, 89 89
from accounts. 90 90
Apostrophe, and as we can see, we have the account id, 91 91
the username, the password, 92 92
and then the signature for the person, 93 93
and if that person is an admin. 94 94
Now these columns depend on the table, 95 95
so it's actually the person who designs the database, 96 96
designs the tables, the columns, as well, and then the data 97 97
gets inserted by the web application. 98 98
So, you can see that we have a user called admin 99 99
and their password is adminpass. 100 100
We can see we have a user called adrian 101 101
and their password is somepassword. 102 102
So, this is just to show you what databases look like, 103 103
and just to get a feel on it, because, in the future videos, 104 104
we're gonna try to exploit these databases 105 105
and have access similar to this. 106 106
So this, I just logged in with a username 107 107
and a password now, 108 108
usually you wouldn't have access like this, 109 109
only the web admin would have that access. 110 110
In the future videos, we're gonna try to run some attacks 111 111
in order to gain access similar to this, 112 112
so that we'll have full control over the database, 113 113
so that we can read stuff and see if we can write 114 114
or modify things.