Lab 05: Performing Web Application and Database Attacks

Overview

This lab focused on exploiting common web application flaws in deliberately vulnerable training applications. I practiced cross-site scripting (XSS), SQL injection, and command injection against Damn Vulnerable Web Application (DVWA) and OWASP Juice Shop, moving from simple proof-of-concept payloads to extracting credential data.

Objectives

  • Demonstrate reflected and stored XSS

  • Use SQL injection to enumerate a database and extract data

  • Run operating system commands through a vulnerable web form

  • Apply the same techniques against a more modern application

Tools and Technologies

  • DVWA (MySQL back end)

  • OWASP Juice Shop (SQLite back end)

  • Firefox on Kali Linux

  • curl (crafting API requests)

Lab Writeup

XSS in DVWA

  • Confirmed that input was reflected into the page by viewing the page source

  • Triggered a reflected XSS popup

  • Used stored XSS to display the session cookie in a popup

SQL Injection in DVWA

  • Triggered a SQL syntax error, confirming that input reached the query

  • Used ORDER BY to work out the number of columns returned by the query

  • Used error messages to test column names

  • Used UNION queries against information_schema to list tables

  • Extracted usernames and password hashes from mysql.user

Command Injection in DVWA

  • Appended commands to the input of a ping form

  • Read /etc/passwd from the server, showing that commands were running on the underlying operating system

Stored XSS in Juice Shop

  • Posted directly to the /api/Feedbacks endpoint with curl

  • Found that the first payload was stored as an empty comment by the sanitizer

  • Bypassed the sanitizer with a nested tag, so the iframe payload was stored

  • Triggered the XSS alert by loading the page that displays customer feedback

SQL Injection in Juice Shop

  • Used the /rest/products/search endpoint to trigger database errors that revealed useful details about the back end

  • Worked out the required 9-column structure from the UNION column count error

  • Read the database schema from sqlite_master, including the Users table

  • Extracted user IDs, email addresses, and password hashes

  • Confirmed access by logging in as the admin@juice-sh.op account

Challenge: Reflected XSS

Crafted a string that executes the alert function from the /search endpoint:

<iframe src="javascript:alert(`xss`)">

Key Findings

  • Any input that reaches a query, a page, or a shell without proper handling can become an attack path

  • Verbose error messages give attackers details that speed up an attack

  • Client-side controls can be skipped by sending requests directly to an API

  • Input filters that strip specific patterns can be bypassed with crafted input

  • SQL injection can expose an entire database, not just the table an application was meant to query

Key Skills Learned

  • Identifying and testing injection points

  • Crafting reflected and stored XSS payloads

  • Enumerating databases and extracting data with UNION-based SQL injection

  • Exploiting command injection

  • Using curl to test API endpoints directly

  • Adapting techniques across MySQL and SQLite

Topics Covered

  • Web application security and the OWASP Top 10

  • Cross-site scripting (reflected and stored)

  • SQL injection and database enumeration

  • OS command injection

  • Input validation and sanitization

Conclusion

This lab showed how a small input handling mistake can escalate into exposed credentials or command execution on the server. Working through both applications also showed that the same core techniques carry over between technologies, with the details adapted to each target.

Lab File