.. include:: /global.rst ======================================================= Lab 05: Performing Web Application and Database Attacks ======================================================= Overview ======== This lab focused on exploiting common web application flaws in deliberately vulnerable training applications. I practiced cross-site scripting (XSS), SQL injection, and command injection against Damn Vulnerable Web Application (DVWA) and OWASP Juice Shop, moving from simple proof-of-concept payloads to extracting credential data. Objectives ========== - Demonstrate reflected and stored XSS - Use SQL injection to enumerate a database and extract data - Run operating system commands through a vulnerable web form - Apply the same techniques against a more modern application Tools and Technologies ====================== - DVWA (MySQL back end) - OWASP Juice Shop (SQLite back end) - Firefox on Kali Linux - curl (crafting API requests) Lab Writeup =========== XSS in DVWA ----------- - Confirmed that input was reflected into the page by viewing the page source - Triggered a reflected XSS popup - Used stored XSS to display the session cookie in a popup SQL Injection in DVWA --------------------- - Triggered a SQL syntax error, confirming that input reached the query - Used ``ORDER BY`` to work out the number of columns returned by the query - Used error messages to test column names - Used ``UNION`` queries against ``information_schema`` to list tables - Extracted usernames and password hashes from ``mysql.user`` Command Injection in DVWA ------------------------- - Appended commands to the input of a ping form - Read ``/etc/passwd`` from the server, showing that commands were running on the underlying operating system Stored XSS in Juice Shop ------------------------ - Posted directly to the ``/api/Feedbacks`` endpoint with curl - Found that the first payload was stored as an empty comment by the sanitizer - Bypassed the sanitizer with a nested tag, so the ``iframe`` payload was stored - Triggered the XSS alert by loading the page that displays customer feedback SQL Injection in Juice Shop --------------------------- - Used the ``/rest/products/search`` endpoint to trigger database errors that revealed useful details about the back end - Worked out the required 9-column structure from the ``UNION`` column count error - Read the database schema from ``sqlite_master``, including the ``Users`` table - Extracted user IDs, email addresses, and password hashes - Confirmed access by logging in as the ``admin@juice-sh.op`` account Challenge: Reflected XSS ------------------------ Crafted a string that executes the alert function from the ``/search`` endpoint: .. code-block:: html