Lab3 SQL Injection

CSCI 5234 Web Security
Lab3
SQL Injection Attack
Lab Environment:
1. Follow the instructions given on the Lab Setup page and the Web_SQL_Injection page to download,
install, and configure the virtual machines (VMs).
2. The SQL injection Attack will have to use one VM.
3. In the VM, modify the /etc/hosts file to map the domain name of www.xsslabelgg.com to the attacker
machine’s IP address. Modify 127.0.0.1 to the attacker machine’s IP address as shown in Figure 1.
192.168.0.165 www.seedlabsqlinjection.com
Figure 1: /etc/hosts
4. Apache configuration: Restart apache
Lab Tasks:
In this lab, we need to construct HTTP requests. To ﬁgure out what an acceptable HTTP request in Elgg looks like,
we need to be able to capture and analyze HTTP requests. We can use a Firefox add-on called "HTTP Header
Live" for this purpose. Before you start working on this lab, you should get familiar with this tool. Instructions on
how to use this tool is given in Lab 1.
1
Task 1: Get Familiar with SQL Statements
In this task, we have to login the SQL database and show tables and Alice’s credential table. Figure 1 shows how
to login to the database, Figure 2 shows how to load database, Figure 3 shows tables, and Figure 4 shows Alice’s
credential table.
Figure 1: Login to the database
Figure 2: Load database
2
Figure 3: Show tables
Figure 4: Alice’s credential table
3
Task 2: SQL Injection Attack on SELECT Statement
Task 2.1: SQL Injection Attack from webpage
In this task, we need to login into the admin page without knowing any employee’s credential. Figure 5 shows
login to the SQL injection webpage.
Figure 5: Login to the SQL injection webpage
After having logged into the SQL Injection webpage, we can see the details as shown in Figure 6.
Figure 6: After logging into admin account
4
Task 2.2: SQL Injection Attack from
1command line
In this task, we need to login into the admin
in terminal without knowing any employee’s
credential. Figure 7 shows login to the SQL
without password.
Figure 7: Logging into SQL database
5
Task 2.3: Append a new SQL statement
In this task, you are required to update the database by using SQL injection attack. You are required to use
multiple SQL statements separated by “;”. You can try the following SQL injection string in the webpage. Figure
8 shows the SQL injection in the webpage. Please perform this attack and describe your observation in your
report.
alice'; UPDATE credential SET Nickname='Alice' WHERE name='alice' ;#
Figure 8: Update Alice’s data
Task 3: SQL Injection Attack on UPDATE statement

Task 3.1: Modify your own salary
In this task, you are asked to update the database by using SQL injection attack. Please update salary for Alice.
Perform this task in the webpage and describe your observation in your report. Figure 9 shows SQL update in
Alice’s profile.
Figure 9: Modify Alice’s salary
6
We can see before you update Alice’s data, Alice’s data in the database should have $20000.00 salary. Figure
10 shows Alice’s profile before update.
Figure 10: Alice’s profile
After you have updated Alice’s profile, you should see Alice’s salary increase to $80000.00 salary. Figure 11
shows Alice’s profile after update.
Figure 11: Alice’s profile
7
Task 3.2: Modify other people’s salary
After you have learned how to update the database by using SQL injection attack from the last task, you can
update Boby’s data. Please update salary for Boby. Perform this task in the webpage and describe your
observation in your report. Figure 10 shows SQL update in Boby’s profile.
Figure 12: Modify Boby’s salary

Task 3.3: Modify other people’s password
In this task, you are asked to change Boby’s password by SQL Injection code in Boby’s profile. Because the
database stores the hash value of password, you need to convert the password to the hash code and then inject
the hash code into the database in Boby’s profile. First, we create a PHP file to save the password as shown in
Figure 13. Second, we convert the password file to the hash code as shown in figure 14. Third, we update Boby’s
password by injecting the hash code in Alice’s profile.
Figure 13: Password in PHP file
8
Figure 14: Hash value for the password
Figure 15: Update Boby’s profile
After you successfully updated Boby’s password, you will see log out information as shown in Figure 16. You
can login again to check whether the password is correct.
Figure 16: Log-out information after having updated the password
9
Task 4: Countermeasure—Prepared Statement
In the previous tasks, we learned how to attack database by the SQL injection code. In this task, you are asked
to defend against the previous SQL injection attack you performed. For testing, please login into the database
as task 2.1. to see whether you can login in without password. Figure 17 shows modifying the code. Figure 18
shows the result after you have executed the counter measurement.
Figure 17: File unsafe_home.php and unsafe_edit_backend.php
Figure 18: The error banner
10

Lab3 SQL Injection

Uploaded by

Copyright:

Available Formats

Lab3 SQL Injection

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab3 SQL Injection

Uploaded by

Copyright:

Available Formats

CSCI 5234 Web Security

4. Apache configuration: Restart apache

Figure 1: Login to the database

Figure 2: Load database

Figure 4: Alice’s credential table

Figure 5: Login to the SQL injection webpage

Figure 6: After logging into admin account

Figure 7: Logging into SQL database

alice'; UPDATE credential SET Nickname='Alice' WHERE name='alice' ;#

Figure 8: Update Alice’s data

Task 3: SQL Injection Attack on UPDATE statement

Figure 9: Modify Alice’s salary

Figure 10: Alice’s profile

Figure 11: Alice’s profile

Figure 12: Modify Boby’s salary

Figure 13: Password in PHP file

Figure 15: Update Boby’s profile

Figure 16: Log-out information after having updated the password

Figure 17: File unsafe_home.php and unsafe_edit_backend.php

Figure 18: The error banner

You might also like