I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks).
I want to use ModSecurity WAF to protect this web application from SQL Injection attacks. I am using Apache web server to host my web application. The operating system of this ‘victim’ virtual machine is Windows XP SP3.
I know ModSecurity provides very little protection on its own. So I decided to use OWASP ModSecurity Core Rule Set Project to include additional SQL Injection rules.
I copied ‘SQL Injection Attacks rules’ provided in the ‘base_rules’ folder of the OWASP Core Rule Set to the appropriate config file, and made sure these rules were loaded together with ModSecurity itself.
I performed manual SQL Injection attacks on the DVWA from my other virtual machine that had Kali Linux installed. For example:
%’ or 1=0 union select null, concat (first_name, 0x0a, last_name, 0x0a, user, 0x0a, password) from users #
When SQL Injection Core Rule Set was disabled, the following information would be displayed:
However, when these rules were enabled, the server would always return ‘Error 403 – Access forbidden’ meaning that these SQL Injection rules were working correctly.
I then decided to use sqlmap to perform more advanced SQL Injection attacks. I had to hijack the session by using burp suite in order to obtain cookie information. I copied all that information to a .txt file on Kali Linux Virtual machine:
I hid the IP and cookie information.
This is the command that I entered in my Kali Linux virtual machine terminal:
Sqlmap managed to bypass the OWASP ModSecurity SQL Injection rules and displayed the following information:
I really don’t understand why it managed to bypass these rules. Any ideas?
I used the following tutorial to configure ModSecurity on my virtual machine:
Maybe I should have included some additional OWASP Rule sets to prevent sqlmap attack?