Develop and test a vulnerable login system

Question

I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate with real-life professional work. Coming from a software development background, I am logically solid on information security systems and how they work but I struggle with the practical side.

The assignment is to prepare and to pentest a login form by SQL injection. I also have a background in website development but never understood the backend of things. What would be the best way to develop a login form with a backend database that's susceptible to a sql injection (I'm a rookie so the easiest and most vulnerable login form would do)?.

• Would I need a CMS? (This would all be in a sandbox environment)
• Would I need a server for SQL?

Answer 1

In my opinion the easiest way to prepare and test login page vulnerable to SQL injection is without CMS, as follows:

1. Prepare a HTML web page containing a POST form with fields "username" and "password"
2. Prepare a DB with table "users" and columns "username" and "password". Populate it manually with a couple of plausible entries.
3. Prepare a PHP page that receives the POST and opens a DB connection searching for matching DB records where both values match.
4. Depending on whether a match is found you should return a different message and open a session or not.
5. Test the page automatically with the software SQLmap or OWASP ZAP and/or test it manually using a local proxy (e.g. Fiddler)

The pivotal point is that the vulnerable PHP page forms the SQL query by concatenating strings (this allows the attacker to forge the ending part of the query, bypassing login or extracting information from the DB). The non-vulnerable page should build the query using prepared statements. If you use a CMS then you should use its own login or anti-SQL injection security features.

A proper login page would also incorporate other security controls like account lockout, password hashing etc. but I think they are outside the scope of your exercise.

Answer 2

Would I need a CMS? (This would all be in a sandbox environment)

No, not really.

Would I need a server for SQL?

for doing sql injection, you surely need sql server to process sql queries and omit back the data.

The assignment is to prepare and to pentest a login form by SQL injection

Take guidance for code from opensource vulnerable applications available for practice in the community. For example, you may study changes in php code,after you set up 'DVWA' application with different difficulty level. This is almost cheating if you copy code from there as it is but my motive to direct you to that resource is to help you understand the different stages of improvement in code there and what exactly went wrong. There are other opensource vulnerable applications too, feel free to try them all to understand how programmers may commit blunder in different programming languages.