In this lesson, we're going to go through
and do a little bit of analysis
on the impact of web application vulnerabilities.
Now, as we do this, we're going to take a look
at a sample e-commerce website;
that's going to involve a web front end
and a database backend.
So we're first going to assess the database functionality.
Then we're going to look at the website functionality.
After that, we're going to test some
injection vulnerabilities
and then test some authentication vulnerabilities.
First, I need to test my database and my web server.
So to do this, I need to make sure they're running.
So I'm going to type in 'service mysql start' and hit Enter.
Then I'm going to type in 'service apache2 start'
and hit Enter.
This is going to start both the database server
and the web server on my staging environment.
Now from here, I'm going to open up
the database administration using Firefox.
To do this, I'll type in:
'firefox http://localhost/phpmyadmin' and then Enter.
At this point, Firefox will load up,
and I'll be brought to the login screen for phpMyAdmin.
This is a web front end
to interact with the backend database.
From here we'll be able to look at the tables
inside the database, and even run SQL queries.
So all I'm going to do here is log in.
Now that I'm in the backend,
I can click on devtech_store,
which is the database that I want to look at.
In here, you can see there is new, categories,
products, and users;
and under categories, products, and users,
those are my different tables.
If I click on categories, I can see here the different rows
that I'm going to have inside that table.
Essentially, inside this table
is a list of different product categories.
Inside the ID column, that's going to be our primary key.
And then the name column is going to list the name
of each of the different product categories.
There are a total of nine different categories here.
Notice, you can see the SQL statement at the top.
It says: SELECT * FROM categories.
That is what we're doing here.
We're selecting everything from the categories table.
Next, let's select the products table and review that data.
Again, this is another table,
and it lists all the different products.
Instead of looking at the categories,
we're looking at the individual products here though.
Each product has its own product code, description, price,
and whether or not it's going to be in stock
and what category it belongs to.
If we go and look at the users table,
we can look at that data.
Inside of here we have a list of all the users
who can sign into our website.
Each user has a username, a password,
a first name, a last name, and a level of permission.
Now, notice one major vulnerability here:
we are storing our usernames and passwords in plain text.
So if you look in the password column,
you can see each person's password.
This is a very dangerous practice.
Instead, those passwords should have been hashed,
and then the hash should have been stored
inside the database.
Now, look at the URL that's used to access this data.
Notice it calls sql.php,
and that's a script that we're going to use:
it's a PHP script.
Now, when it does this,
it actually gives you parameters from the database.
This is going to be something like the database, the table,
and the position within the table.
So if we look under the SQL statement again here,
we can click the Edit link.
And from here we can change this SQL statement
to say whatever we want.
For example, if I want to see who has admin permissions,
I can type in:
SELECT * FROM 'users' WHERE permissions = admin.
And this will actually return just one record for us.
This website is going to go into that database
using scripting languages like PHP
to pass those SQL statements in a secure way
so the user can't inject additional parameters.
Now, as we see this phpMyAdmin, this is an admin tool.
This is not where our users are going to be inputting data.
Instead, they're going to do it from the website.
So let's go ahead and take a look at the website itself.
First, we're going to open the browser
and go to http://devtech,
which is a sample e-commerce website
here inside my lab environment.
Now, this is the website for the store,
and it's running on my local Apache web server
that I started up at the beginning of this video.
If you select the Catalog tab,
you're going to be able to see all the products
inside the Monitors category.
They're all listed here from a table.
Note that the URL here that's used to serve this webpage,
it doesn't have that SQL query anymore.
Instead, it says catalog.php:category=1,
which is selecting the first category which was monitors.
Now, there are better ways of doing this,
and this isn't necessarily the most secure way
or the least secure way;
it's just one way of doing things.
Now, here we're actually passing in a parameter directly
by saying category=1.
That means if this was something
that was behind a secure paywall, for instance,
we wouldn't want to do this
because somebody could easily change that one to a two,
and that would select a different category directly.
Next, I want to go ahead
and try testing injection vulnerabilities.
To do this, I'm going to put the website
on the right side of my screen
and the phpMyAdmin on the left side of my screen.
Now from here what we're going to do
is we're going to verify the URL that's passing
the parameters; in this case, category=n.
In this case, it was category=1,
to make sure that we're viewing the right category.
So what I'm going to do is I'm actually going to go
to the insertion point at the end of the URL,
and I'm going to add a space.
And then I'm going to type: or1=1,
which as you remember from our lessons,
1=1 is a very common way of doing an SQL injection.
Now, once we do this, we're going to see what happens.
Notice here that the listing page
still says we're in the Monitors category,
but we're not seeing just monitors.
We're seeing every single product that this company has.
That's because we just injected this or1=1,
making every statement true,
and not just to display category 1.
This is a basic SQL injection.
Now, notice in the SQL query section,
we can verify the query that we executed
based on the URL we inserted from the webpage.
Notice that the query is selecting four columns
from the products table.
Anytime it finds the product category is n,
in our case, 1, or where 1=1.
And because 1=1 every single time, guess what?
It's going to dump every single category
all at once to the screen.
Now that we've tested injection vulnerabilities,
let's go ahead and test an authentication vulnerability.
We're going to go into the Sign-In tab
and we're going to attempt to sign in as Kevin.
Now, when we try to sign in, if we don't know his password,
we're going to get an error and it's not going to let us
sign in.
Now, we don't have the ability
to crack his password at this point.
So instead, let's try an SQL injection.
Now, here we're going to put Kevin as the username
and try to put something in the password field
to cause a malicious SQL statement to be formed.
This is an SQL injection.
So if I do something like x and then a quote, space,
or space, quote, X quote equals quote x,
that will be able to do an SQL injection for us,
because the quote is going to break apart from that password
and then test the second half of the statement,
or something equals something.
And so let's see how this looks.
Now, to see what I actually typed in,
we're going to go and right-click on the field
and do Inspect Element.
This will allow us to see
what was there inside of the field.
In HTML, when it's a password field,
it's going to show up with stars or dots
instead of the text.
So, I'm going to change that password field to text,
and that will allow us to see what I actually put in.
So now we'll go ahead and click on the Sign-In button,
and you'll see that it sends that to the MySQL database,
and we get back an error inside the database,
giving us a warning,
saying that there was a perimeter of 1 to be expected,
but instead we got the results
of /var/www/devtech_store/html/sign_in.php on line 37.
Essentially, we caused an error in the program
by doing this injection,
but we were still able to successfully sign in.
Now notice we are logged in,
but we're not logged in as Kevin.
It says: Welcome, comma, space, period.
It doesn't say: Welcome, Kevin. Why is that?
Well, because our malicious query
took advantage of the default apostrophe formatting,
and because there was no sanitized input
because they didn't do input validation,
I was able to do an SQL injection.
By doing that, it's going to go and look
for the first authentication in the table.
In our case, that first person
is actually going to be Laura Anderson,
and that's the person who has administrative privileges.
So we are now logged in as Laura Anderson,
the database administrator.
So you can see how powerful SQL injections can be,
and how easy they are to conduct
when somebody doesn't do the right protections
on their website, either on the front end
using input validation through the website,
or on the backend
when they don't have things configured quite right.
It's not your job to figure out how to fix all these things,
but it is your job to figure out
if they're vulnerable to these types of attacks.
And so you need to understand what SQL injection is.
And usually when you see something like 1=1 or x=x,
that's a dead giveaway.
Now, on the exam,
if you're asked how to fix something like this,
the best answer is going to be input validation.
If they had done input validation on the website
and took away my ability to insert that apostrophe,
it would've prevented this SQL injection
from occurring in the first place.