0

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have been trying everything, but I have not been able to gain access to information. He told me that I should be able to obtain certain information such as the debt from someone, or their credit card number, etc. Keep in mind, all the values being outputted in this website are fake and not real. The code for this website is as follows in the web login:

<html> <head><title>Online Access</title></head><body>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tbody>
    <tr>
      <td valign="CENTER" bgcolor="#cbbbff">
            <center>
              <h2>Bank</h2>
                </center>
                  </td>
                      </tr>
                    </tbody>
                    </table>
                    <form action="login.pl" method="post"> 
                    <p> Login denied for user <b></b>! Try again.
                    <br>
                    Please enter your access ID and your password to access your credit
                    card debt information.</p>
                    <br><b> Access ID: </b>
                     <input type="text" name="access" size="18"> <br>
                       <b> Your Bank Password: </b> <input type="password" name="password"
                        size="10"> <br>
 <b> ID number: </b> <input type="text" name="softvulnsec"
 size="3" maxlength="3"> <br>
 <b> Registration code: </b> <input type="text" name="matnr"
 size="7" maxlength="7"> <br>
                      <br>
                        <input type="submit" name="login" value="Login"> 
</form>
</body></html>

Once I am logged in I have access to this bit of code of which I have noticed that there are hidden field parameters.

<html> <head><title>Bank Online Access</title></head><body>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tbody>
<tr>
  <td valign="CENTER" bgcolor="#cbbbff">
  <center>
          <h2>Bank</h2>
  </center>
  </td>
</tr>
</tbody>
</table>
 <p> Welcome to the Bank access! <br>
You have successfully logged in <i><b></b></i>.<br> Your access id is: <b>123456</b></p> <br>
<p> You can use the following services: <br>

<table border="1">
<form action="login.pl" method="post">
<tr><td>
<b>Credit card account:</b> <a href="javascript:submitForm()">Request 
information</a>
</td></tr>
<input type="hidden" value="164532873134525967223123872321" name="param">
<input type="hidden" value="100" name="softvulnsec">
<input type="hidden" value="123456" name="access">
<input type="hidden" value="qwef945372quwiefjd315469875312" name="token">
</form>

<script>
function submitForm()
{
    document.forms[0].submit();
}
</script>
</table>
</body></html>

Based on what I have read, since the method is "post" I can modify some of the values in order to gain access to the information, but every time I try to modify the access code in the login page, I get sent back to the login page and the access code and password revert back to the previous correct login information. I have tried to change the hidden parameter to text and then change the value within the access code to different values or to the correct value: 123456 plus an sql injection such as: 123456 AND SELECT *. None of this has given me any insight as to how to access information from the web application. Are there any hints I can get in order to access this information? Do I modify the hidden parameters with sql injection?

Improve this question
1
  • Why wouldn't you try hidden POST values for SQL injection? Also non SQL injection attacks might give you information about other clients. Tampering with the access parameter value or the softvulnsec parameter value is something I'd definitely try.
    – Jeroen
    Oct 14, 2020 at 22:11

2 Answers 2

Reset to default
1

You send data to login.pl. Try downloading login.pl and reading the content code.

If the code is really vulnerable, the Perl file will have a query line to the vulnerable database. Put the code content in Perl to make a code review.

Improve this answer
1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jun 18, 2022 at 7:44
0

You are right with your assumption to modify the posted variables, which the server then embeds in its SQL-Statements.

As you probably know, the general idea of SQL-Injection is to embed a malicious crafted string, that will eventually be embedded in a SQL-statement, such that you are able to control the statement by yourself. By this, you could e.g. be able to retrieve data from other accounts.

On the internet there are good resources to learn the basics of SQL-injections.

Some examples:

A good starting point for testing login-based SQL-injections are strings like

" or "a" = "a

' or 'a' = 'a

Note: ' or " depends on the underlying database managment system or the used characters in the original statement.

You can embed the examples in the password field and registration code of the the login fields of your first example and chose another customer id (e.g. 123456) Hence, it might be evaluated to something like

select * from data where softvulnsec = '456789' and password = '' or 'a' = 'a' and matnr = '' or 'a' = 'a'

Hence, the application will retrieve the data for the ID 456789, as the SQL-statement evaluates to true, due to the inserted statements.

If that (and related approaches) does not work, you can try to attack the second page, you have posted.

Play around with the post paramter values. E.g. "access" looks interesting, as it is the customer id. You can submit the form, but expand 123456 with something like from my previous posted payloads, in hope that the application returns also data sets from different users.

I strongly recommend to get familiar with the basics of SQL-injections. Performing SQL-injections always requires an idea of how the original statements look like. So you should get familiar with the concepts and the application.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .