Zum Inhalt springen
L

Das Video kommt von YouTube: erst beim Abspielen verbindet sich die Seite mit YouTube (Google).

SQL Injection For Beginners

Loi Liang Yang13:28 1,6 Mio. Aufrufe veröffentlicht Auf YouTube

Das Wichtigste aus dem Video

Tipp auf eine Zeit – das Video springt genau dorthin.

Transkriptautomatisch erstellt · 96 Zeilen
Herunterladen
  1. and today I'll be teaching you structured query language injection sqli [Music]
  2. so right in front of us we have open web application security project bricks so this is a vulnerable web application platform for us to load our SQL
  3. injection and payloads into the website so that we can gain access into different components of the database system and the database systems houses
  4. all the sensitive data records like usernames email addresses passwords whether the passwords are protected using hashes or not either way we'll
  5. learn about how to break into those passwords too and that is really scary because the first part is learning about how can we manually run our injection
  6. payloads into the site the second part is we can identify vulnerable parameters very very quickly and be able to pull out lots of information easily from a
  7. highly automated SQL injection tool and this is frightening because it speeds up the whole process of penetration testing into any website any web application
  8. platform so right in front of us we have open web application security project bricks and if you see right here this is a website and this could be an
  9. informational site it could be a login site it could be a site that provides e-commerce Services whichever the case is so if we go to the top right corner
  10. we have this particular section called login pages so let's go ahead and click on it so once you're in this is a wonderful way for you to learn about
  11. penetration testing onto any web application sites so right here all I got to do is Click under say the first part which is basic login so let's go
  12. ahead and click on it and here it stays the following you are not logged in and the first thing that you want to do whenever you reach into any site is to
  13. go through what I call a happy Journey map meaning that this is what is to be expected from the outcome of the logic that is being built into the web
  14. application system so if I go ahead and enter say for example a username called Loyal okay and I enter some random password and click submit and of course
  15. right here it says the following wrong username and password and you see one more particular notification at the bottom one message here which is the
  16. feedback and this is useful for you to picture what is going on behind the website site as the application server tries to connect to the database and
  17. pull out query from the database system and a database houses all these records like usernames passwords email addresses and so on and so forth so it has a lot
  18. of personal and sensitive data so right here what we can see is that we have the following I'm going to copy this I'm going to go ahead and open up say a text
  19. editor and I will call it say I will use mouse pad okay and we can go ahead and open it up and I can do a right click and I can paste it right here and we can
  20. see over here and this is how the application servers talk to the database literally so here we have select star which is all from users where name equal
  21. all right followed by a password and this is the query that is being sent over from the application server into the database and right here what we can
  22. notice is that we are trying to find ways of bypassing the security mechanism and say we know what is the name perhaps that there is a username that we could
  23. find on LinkedIn as part of information in gathering we could find on Facebook about the employees of the company all right or even in the website itself they
  24. could have a particular page that shows the employees who are working in the company as a directory and so on so many different ways to do your reconnaissance
  25. to do information gathering so here all you got to do is say enter someone you know so it could be Tom right so in this case and we have to
  26. pass a few so what we can do so in a SQL query what we need to do is to ultimately get a true statement so all I got to do now is to enter the following
  27. say we have no idea what's the password we can enter or okay one equal one okay and let us try and insert this into the login page and look at what happens so
  28. here I can go back into the website I can enter Tom and what I'll do next is to go ahead and copy and paste the payload that we have just created right
  29. here so I can go ahead and copy this and I'll paste it into the password view so once I paste it I'll click submit and let's see what happens
  30. that's it we have successfully logged into the site successfully log in and as you see at the bottom select all from users with name equal Tom and password
  31. okay is as such or one equal one and what does or one equal one means right so if you remember back in school one equal one is true and it always is true
  32. or one equal one means that it will always be true this statement is always true and as such as a result of that the web application server will issue you
  33. say a cookie a session cookie whichever the case is and you will gain access into the site a lot of sites are pretty secure now and they would have different
  34. layers of security so one of those particular word lists that you want to look out for is actually the word list that could help us find out whether okay
  35. we have different kind of payloads that we can utilize as part of the SQL injection and we have over here we have General injections other stress
  36. vulnerabilities web services so let's go ahead and CD and change directory into injections enter LS and I can do say for example hey sql.txt so these are all the
  37. different kind of payloads that you can inject into the site literally and this is how we can identify whether this particular input field is vulnerable to
  38. it so I can enter cat sql.txt hit enter on this and we can see all these different SQL payloads that you can inject into the page say for example
  39. your single quote your double quote didn't work then what can we do what we can do now is to use other forms of payloads here that you can see to run
  40. the attack against that specific parameter and see whether we're able to ultimately get an error page all right all to get some kind of response from
  41. the server that is different from what is normal and that's the whole idea behind SQL injection in next up what I want to introduce to you is a way for us
  42. to do a highly automated matter in terms of finding out whether the input fields are vulnerable so what I can do now is go
  43. ahead and go to the top right corner I can use foxy proxy and we'll click under burp Suite so this would enable the proxy to intercept our posts into the
  44. site so all I got to do now is just go ahead and enter burp Suite so I can launch burp suit directly from here so that we can see
  45. what kind of post is being sent over into the site okay so here I can delete a flowing temporary file I will not update now click next use burp
  46. defaults and right here we have the burp Street Community Edition and we click on the proxy Tab and ensure The Intercept is on
  47. so here we can see that intercept is on so that's great so what we can do next is to go ahead and enter some normal value and go ahead and click submit and
  48. that will get intercepted immediately by burp Suite as you can see right here so what I can do now is to copy the entire post right the entire post request and
  49. copy it and what I will do now is to save it into a file alright so I'll save it into a file and I can go ahead and save this file all right so let's go
  50. ahead and say create a file and let's name it as owops break SQL injection okay so let's go ahead and do a touch oh whoops breaks injection okay hit enter
  51. on this and what I can do next is use mouse pad open up this particular file all right so open it up and we can see right here and I can paste it and I can
  52. save it so let's go ahead and save the information so this is owsp brics injection okay so what I can do next is to go ahead and use SQL map to help us
  53. Target the parameter automatically to find out whether it is injectable whether it is vulnerable to structure query language injection so all I got to
  54. do now is enter SQL map okay followed by Dash R to specify the file that we've just created which is the post request so we have oaux breaks
  55. injection all right and next what we can do is to specify the target parameter so in this case we can enter the following all right so we can enter Dash followed
  56. by P right so this is the parameter that we're going for so enter username so hit enter on this and you can see right here
  57. all right it looks like the back end dbms is my SQL do you want to skip task Payless specific for other database Management Systems so very very quickly
  58. we are able to identify vulnerable parameters so as you can see here username might be injectable so that's one mySQL database and two might be also
  59. vulnerable to cross-site scripting which we will do up on a separate tutorial fully about cross-site scripting attacks so do we want to skip yes so they could
  60. save us a lot of time and you want to include all right old tasks for MySQL extending provider level all right so let's go ahead and enter
  61. yes with this and right here it is running all those injections into this particular parameter to see whether we're able to
  62. prop the database whether we are able to bypass the web application checks the sanitization and very quickly right here we can see
  63. that the following time based blind is injectable meaning that we have found a way for us to bypass the security checks and gain full control on the database
  64. just like that very very quickly we are able to identify the vulnerable parameter and what we can do next is the following do you want to retry to find
  65. proper Union column types with fuzzy test so enter a no for this okay injection not exploitable with null values do you want to try the random
  66. integer value for option Union corrector right so enter yes on this and again they're highlighting recommended steps that you can take next in SQL map so
  67. this is a fantastic tool highly automated to test your web application system to look at vulnerabilities whether they are injectable and at the
  68. same time if you're opening up a web application firewall and you're Keen to see whether you're able to detect all these different kind of payloads coming
  69. in again this will be a wonderful way for you to add in those checks and sanitization at the same time detection capability so that you can block anyone
  70. who is using these tools to hijack into your website next up all right do you want to try the random value or enter yes on this
  71. and it stays the following okay post parameter username is vulnerable do you want to keep testing the artist if any all right so there's no need for that so
  72. let's go ahead and right here we got the following details SQL May identify the following injection points with a total of four two three HTTP requests so
  73. another way in terms of defense is to also look at the threshold that you have as the web request coming in from a particular IP address so if an IP
  74. address was probing your website much more than what is considered as normal so your normal user go to your website they do a login they search for some
  75. products and then the checkout and that could be possibly say 20 30 requests on average per minute it's almost come in with over 400 requests over a minute so
  76. there could be something malicious that the user is trying to do into your website and you want to actually block that specific IP address or all those
  77. different kind of payloads from coming into your website which could then ultimately give them further access into different parts of the site so going
  78. back to tutorial here so we managed identified that the backend database management system is MySQL so very quickly we found out that we have the
  79. parameter all right and Boolean based blind and time based blind so this particular parameter is vulnerable to this two different payloads all right
  80. these two different type of attacks under SQL injection so what we can do next is to go ahead and enter Double Dash Dom hit enter on this and
  81. you're trying to dump up all the values all the columns all the rows all the cells inside the database system so right here we can find out the following
  82. all right before you even scroll down further we can look right here we have the columns for table users and then we have the ID users name email password
  83. host all right and we scroll down further we can get all the retrieve information so we literally got the username the email address right here
  84. admin Tom getmantra.com I have a screw down further we have Harry we have Ron okay do you want to store hashes do a temporary file so if
  85. you're doing any kind of passive cracking you can store this to a temporary file for our case we are not going to do that so I have to know for
  86. this and you want to crank that via dictionary base attack why not all right so let's see what is the password being stored for certain users inside the
  87. database system so enter yes for this and this is our dictionary file so there is a wood list inside USR share SQL map so hit enter on this do you want to use
  88. common passwords to fixes so enter no so again right here we are doing dictionary based cracking immediately and over here we can see the whole list of all the
  89. users all right the email addresses and over here we have the following password view we managed to correct it in seconds so very quickly we are able to see all
  90. the data that is housed behind the web application server inside the database so you saw how quickly we're able to get all this sensitive data personal
  91. information of the entire website using SQL injections we learn about manual SQL testing we also learn about using automated tools like SQL map to help us
  92. gain unauthorized access into the entire site and it's very very scary so you got to protect your website against all these possible threats as quickly as you
  93. can using layer 7 using layer 4 looking at the threshold requests coming in looking at all the different kind of payloads there's heating into your web
  94. application firewall detect those as quickly as you can and block those users from further access into a website else they would be able to do all sorts of
  95. funny things on your site so once again I hope you have learned something valuable in today's tutorial and like share and subscribe the channel so that
  96. you can become abreast of the latest cyber security tutorial thank you so much once again for watching

Zum Nachlesen

SQL-InjectionSQL-Injection (dt. SQL-Einschleusung) ist das Ausnutzen einer Sicherheitslücke in Zusammenhang mit SQL-Datenbanken. Die Sicherheitslücke entsteht durch … Code-InjektionCode-Injektion ist das Einschleusen und Ausführen von unerwünschtem Programmcode, durch die Ausnutzung eines Computerfehlers. Dabei werden externe Daten von … Sicherheit von WebanwendungenGenerelle schützende Maßnahmen · Data Validation · Minimalitätsprinzip · URL-Weiterleitungen kontrollieren und einschränken. ExploitSQL-Injection-Exploits. Bearbeiten · SQL-Injection-Exploits sind eine spezielle Art von Exploits und finden hauptsächlich Einsatz bei Webanwendungen, die eine …