1

Hello and good evening,

i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the basics of Burp Suite (more precisely i am trying to learn more about the OWASP Top ten).

But i get stuck at SQL Injections in the DVWA SQLi section. Whenever i run a command like:

1' or '0'='0

I get redirected to a page saying:

Hacking attempt detected and logged.

I've tried some evasion techniques, but none of them are working. Am i doing something wrong? Someone has an advice? I also tried the steps from: https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson6/index.html , but i get the same result running those commands...

(And please bear with me, i am into pentesting for 3-4 months now and first time using Burp/making SQLi attempts :) )

P.S. i found it is possible to make it work via disabling the PHPIDS, but i am interested on how to evade and bypass it too.

0

Are you sure your security setting is set to "low" as outlined in the linked instructions? It's been a while since I touched DVWA but it looks like the message you are receiving are caused by a basic WAF.

What's likely happening is that something in your SQLi input is being flagged by some code running in the web application. The query 1' or '0'='0 is very very basic and will only work in the simplest of such challenges.

There are many ways of writing queries that will give you the same exploitation potential while also evading the WAF. You should do some more reading into SQL syntax to find another way to express your payload.

0

Most likely your security setting is set to "high" - This can be changed on the site or through the cookie "security". Higher settings allow you to try more advanced techniques...

Once you change your cookie, try typing the following into the flied.

' or true;#

That seemed to work fine for me on low security.

#

Evading and bypassing would require using things like timing methods or blind SQLi. Best of luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.