first commit
This commit is contained in:
OPSXCQ
parent
985a5c928c
commit
f40a84879c
551 changed files with 72374 additions and 24 deletions
60
dvwa/vulnerabilities/sqli/help/help.php
Normal file
60
dvwa/vulnerabilities/sqli/help/help.php
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
<div class="body_padded">
|
||||
<h1>Help - SQL Injection</h1>
|
||||
|
||||
<div id="code">
|
||||
<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
|
||||
<tr>
|
||||
<td><div id="code">
|
||||
<h3>About</h3>
|
||||
<p>A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application.
|
||||
A successful SQL injection exploit can read sensitive data from the database, modify database data (insert/update/delete), execute administration operations on the database
|
||||
(such as shutdown the DBMS), recover the content of a given file present on the DBMS file system (load_file) and in some cases issue commands to the operating system.</p>
|
||||
|
||||
<p>SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.</p>
|
||||
|
||||
<p>This attack may also be called "SQLi".</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Objective</h3>
|
||||
<p>There are 5 users in the database, with id's from 1 to 5. Your mission... to steal their passwords via SQLi.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Low Level</h3>
|
||||
<p>The SQL query uses RAW input that is directly controlled by the attacker. All they need to-do is escape the query and then they are able
|
||||
to execute any SQL query they wish.</p>
|
||||
<pre>Spoiler: <span class="spoiler">?id=a' UNION SELECT "text1","text2";-- -&Submit=Submit</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Medium Level</h3>
|
||||
<p>The medium level uses a form of SQL injection protection, with the function of
|
||||
"<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.mysql-real-escape-string.php', 'mysql_real_escape_string()' ); ?>".
|
||||
However due to the SQL query not having quotes around the parameter, this will not fully protect the query from being altered.</p>
|
||||
|
||||
<p>The text box has been replaced with a pre-defined dropdown list and uses POST to submit the form.</p>
|
||||
<pre>Spoiler: <span class="spoiler">?id=a UNION SELECT 1,2;-- -&Submit=Submit</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>High Level</h3>
|
||||
<p>This is very similar to the low level, however this time the attacker is inputting the value in a different manner.
|
||||
The input values are being transferred to the vulnerable query via session variables using another page, rather than a direct GET request.</p>
|
||||
<pre>Spoiler: <span class="spoiler">ID: a' UNION SELECT "text1","text2";-- -&Submit=Submit</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Impossible Level</h3>
|
||||
<p>The queries are now parameterized queries (rather than being dynamic). This means the query has been defined by the developer,
|
||||
and has distinguish which sections are code, and the rest is data.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</div>
|
||||
|
||||
<br />
|
||||
|
||||
<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/SQL_Injection' ); ?></p>
|
||||
</div>
|
||||
99
dvwa/vulnerabilities/sqli/index.php
Normal file
99
dvwa/vulnerabilities/sqli/index.php
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
<?php
|
||||
|
||||
define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
|
||||
|
||||
dvwaPageStartup( array( 'authenticated', 'phpids' ) );
|
||||
|
||||
$page = dvwaPageNewGrab();
|
||||
$page[ 'title' ] = 'Vulnerability: SQL Injection' . $page[ 'title_separator' ].$page[ 'title' ];
|
||||
$page[ 'page_id' ] = 'sqli';
|
||||
$page[ 'help_button' ] = 'sqli';
|
||||
$page[ 'source_button' ] = 'sqli';
|
||||
|
||||
dvwaDatabaseConnect();
|
||||
|
||||
$method = 'GET';
|
||||
$vulnerabilityFile = '';
|
||||
switch( $_COOKIE[ 'security' ] ) {
|
||||
case 'low':
|
||||
$vulnerabilityFile = 'low.php';
|
||||
break;
|
||||
case 'medium':
|
||||
$vulnerabilityFile = 'medium.php';
|
||||
$method = 'POST';
|
||||
break;
|
||||
case 'high':
|
||||
$vulnerabilityFile = 'high.php';
|
||||
break;
|
||||
default:
|
||||
$vulnerabilityFile = 'impossible.php';
|
||||
break;
|
||||
}
|
||||
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/sqli/source/{$vulnerabilityFile}";
|
||||
|
||||
// Is PHP function magic_quotee enabled?
|
||||
$WarningHtml = '';
|
||||
if( ini_get( 'magic_quotes_gpc' ) == true ) {
|
||||
$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Magic Quotes</em>\" is enabled.</div>";
|
||||
}
|
||||
// Is PHP function safe_mode enabled?
|
||||
if( ini_get( 'safe_mode' ) == true ) {
|
||||
$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Safe mode</em>\" is enabled.</div>";
|
||||
}
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<div class=\"body_padded\">
|
||||
<h1>Vulnerability: SQL Injection</h1>
|
||||
|
||||
{$WarningHtml}
|
||||
|
||||
<div class=\"vulnerable_code_area\">";
|
||||
if( $vulnerabilityFile == 'high.php' ) {
|
||||
$page[ 'body' ] .= "Click <a href=\"#\" onClick=\"javascript:popUp('session-input.php');return false;\">here to change your ID</a>.";
|
||||
}
|
||||
else {
|
||||
$page[ 'body' ] .= "
|
||||
<form action=\"#\" method=\"{$method}\">
|
||||
<p>
|
||||
User ID:";
|
||||
if( $vulnerabilityFile == 'medium.php' ) {
|
||||
$page[ 'body' ] .= "\n <select name=\"id\">";
|
||||
$query = "SELECT COUNT(*) FROM users;";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
$num = mysql_result( $result, 0 );
|
||||
$i = 0;
|
||||
while( $i < $num ) { $i++; $page[ 'body' ] .= "<option value=\"{$i}\">{$i}</option>"; }
|
||||
$page[ 'body' ] .= "</select>";
|
||||
}
|
||||
else
|
||||
$page[ 'body' ] .= "\n <input type=\"text\" size=\"15\" name=\"id\">";
|
||||
|
||||
$page[ 'body' ] .= "\n <input type=\"submit\" name=\"Submit\" value=\"Submit\">
|
||||
</p>\n";
|
||||
|
||||
if( $vulnerabilityFile == 'impossible.php' )
|
||||
$page[ 'body' ] .= " " . tokenField();
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
</form>";
|
||||
}
|
||||
$page[ 'body' ] .= "
|
||||
{$html}
|
||||
</div>
|
||||
|
||||
<h2>More Information</h2>
|
||||
<ul>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.securiteam.com/securityreviews/5DP0N1P76E.html' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/SQL_injection' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/SQL_Injection' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://bobby-tables.com/' ) . "</li>
|
||||
</ul>
|
||||
</div>\n";
|
||||
|
||||
dvwaHtmlEcho( $page );
|
||||
|
||||
?>
|
||||
32
dvwa/vulnerabilities/sqli/session-input.php
Normal file
32
dvwa/vulnerabilities/sqli/session-input.php
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
<?php
|
||||
|
||||
define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
|
||||
|
||||
dvwaPageStartup( array( 'authenticated', 'phpids' ) );
|
||||
|
||||
$page = dvwaPageNewGrab();
|
||||
$page[ 'title' ] = 'SQL Injection Session Input' . $page[ 'title_separator' ].$page[ 'title' ];
|
||||
|
||||
if( isset( $_POST[ 'id' ] ) ) {
|
||||
$_SESSION[ 'id' ] = $_POST[ 'id' ];
|
||||
//$page[ 'body' ] .= "Session ID set!<br /><br /><br />";
|
||||
$page[ 'body' ] .= "Session ID: {$_SESSION[ 'id' ]}<br /><br /><br />";
|
||||
$page[ 'body' ] .= "<script>window.opener.location.reload(true);</script>";
|
||||
}
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<form action=\"#\" method=\"POST\">
|
||||
<input type=\"text\" size=\"15\" name=\"id\">
|
||||
<input type=\"submit\" name=\"Submit\" value=\"Submit\">
|
||||
</form>
|
||||
<hr />
|
||||
<br />
|
||||
|
||||
<button onclick=\"self.close();\">Close</button>";
|
||||
|
||||
dvwaSourceHtmlEcho( $page );
|
||||
|
||||
?>
|
||||
|
||||
|
||||
29
dvwa/vulnerabilities/sqli/source/high.php
Normal file
29
dvwa/vulnerabilities/sqli/source/high.php
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_SESSION [ 'id' ] ) ) {
|
||||
// Get input
|
||||
$id = $_SESSION[ 'id' ];
|
||||
|
||||
// Check database
|
||||
$query = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
|
||||
$result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' );
|
||||
|
||||
// Get results
|
||||
$num = mysql_numrows( $result );
|
||||
$i = 0;
|
||||
while( $i < $num ) {
|
||||
// Get values
|
||||
$first = mysql_result( $result, $i, "first_name" );
|
||||
$last = mysql_result( $result, $i, "last_name" );
|
||||
|
||||
// Feedback for end user
|
||||
$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
|
||||
|
||||
// Increase loop count
|
||||
$i++;
|
||||
}
|
||||
|
||||
mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
33
dvwa/vulnerabilities/sqli/source/impossible.php
Normal file
33
dvwa/vulnerabilities/sqli/source/impossible.php
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_GET[ 'Submit' ] ) ) {
|
||||
// Check Anti-CSRF token
|
||||
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
|
||||
|
||||
// Get input
|
||||
$id = $_GET[ 'id' ];
|
||||
|
||||
// Was a number entered?
|
||||
if(is_numeric( $id )) {
|
||||
// Check the database
|
||||
$data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
|
||||
$data->bindParam( ':id', $id, PDO::PARAM_INT );
|
||||
$data->execute();
|
||||
$row = $data->fetch();
|
||||
|
||||
// Make sure only 1 result is returned
|
||||
if( $data->rowCount() == 1 ) {
|
||||
// Get values
|
||||
$first = $row[ 'first_name' ];
|
||||
$last = $row[ 'last_name' ];
|
||||
|
||||
// Feedback for end user
|
||||
$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Generate Anti-CSRF token
|
||||
generateSessionToken();
|
||||
|
||||
?>
|
||||
29
dvwa/vulnerabilities/sqli/source/low.php
Normal file
29
dvwa/vulnerabilities/sqli/source/low.php
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_REQUEST[ 'Submit' ] ) ) {
|
||||
// Get input
|
||||
$id = $_REQUEST[ 'id' ];
|
||||
|
||||
// Check database
|
||||
$query = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
// Get results
|
||||
$num = mysql_numrows( $result );
|
||||
$i = 0;
|
||||
while( $i < $num ) {
|
||||
// Get values
|
||||
$first = mysql_result( $result, $i, "first_name" );
|
||||
$last = mysql_result( $result, $i, "last_name" );
|
||||
|
||||
// Feedback for end user
|
||||
$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
|
||||
|
||||
// Increase loop count
|
||||
$i++;
|
||||
}
|
||||
|
||||
mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
30
dvwa/vulnerabilities/sqli/source/medium.php
Normal file
30
dvwa/vulnerabilities/sqli/source/medium.php
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'Submit' ] ) ) {
|
||||
// Get input
|
||||
$id = $_POST[ 'id' ];
|
||||
$id = mysql_real_escape_string( $id );
|
||||
|
||||
// Check database
|
||||
$query = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
// Get results
|
||||
$num = mysql_numrows( $result );
|
||||
$i = 0;
|
||||
while( $i < $num ) {
|
||||
// Display values
|
||||
$first = mysql_result( $result, $i, "first_name" );
|
||||
$last = mysql_result( $result, $i, "last_name" );
|
||||
|
||||
// Feedback for end user
|
||||
$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
|
||||
|
||||
// Increase loop count
|
||||
$i++;
|
||||
}
|
||||
|
||||
//mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue