Ethical Hacking - SQL Injection

SQL injection is a set of SQL commands that are placed in a URL string or in data structures in order to retrieve a response that we want from the databases that are connected with the web applications. This type of attacks generally takes place on webpages developed using PHP or ASP.NET.

An SQL injection attack can be done with the following intentions −

• To dump the whole database of a system,
• To modify the content of the databases, or
• To perform different queries that are not allowed by the application.

This type of attack works when the applications don’t validate the inputs properly, before passing them to an SQL statement. Injections are normally placed put in address bars, search fields, or data fields.

The easiest way to detect if a web application is vulnerable to an SQL injection attack is to use the " ‘ " character in a string and see if you get any error.

Example 1

Let’s try to understand this concept using a few examples. As shown in the following screenshot, we have used a " ‘ " character in the Name field.

Now, click the Login button. It should produce the following response −

It means that the “Name” field is vulnerable to SQL injection.

Example 2

We have this URL − http://10.10.10.101/mutillidae/index.php?page=site-footer-xssdiscussion.php

And we want to test the variable “page” but observe how we have injected a " ‘ " character in the string URL.

When we press Enter, it will produce the following result which is with errors.

SQLMAP

SQLMAP is one of the best tools available to detect SQL injections. It can be downloaded from http://sqlmap.org/

It comes pre-compiled in the Kali distribution. You can locate it at − Applications → Database Assessment → Sqlmap.

After opening SQLMAP, we go to the page that we have the SQL injection and then get the header request. From the header, we run the following command in SQL −

./sqlmap.py --headers="User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:25.0) 
Gecko/20100101 Firefox/25.0" --cookie="security=low;
PHPSESSID=oikbs8qcic2omf5gnd09kihsm7" -u '
http://localhost/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit#' -
level=5 risk=3 -p id --suffix="-BR" -v3

The SQLMAP will test all the variables and the result will show that the parameter “id” is vulnerable, as shown in the following screenshot.

SQLNinja

SQLNinja is another SQL injection tool that is available in Kali distribution.

JSQL Injection

JSQL Injection is in Java and it makes automated SQL injections.

Quick Tips

To prevent your web application from SQL injection attacks, you should keep the following points in mind −

• Unchecked user-input to database should not be allowed to pass through the application GUI.
• Every variable that passes into the application should be sanitized and validated.
• The user input which is passed into the database should be quoted.

Ethical Hacking - Cross-Site Scripting

Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser.

The attacker does not directly target his victim. Instead, he exploits a vulnerability in a website that the victim visits, in order to get the website to deliver the malicious JavaScript for him. To the victim's browser, the malicious JavaScript appears to be a legitimate part of the website, and the website has thus acted as an unintentional accomplice to the attacker. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash, but the most used XSS is malicious JavaScript.

These attacks also can gather data from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising and create DoS attacks.

Example

Let’s take an example to understand how it works. We have a vulnerable webpage that we got by the metasploitable machine. Now we will test the field that is highlighted in red arrow for XSS.

First of all, we make a simple alert script

<script>  
   alert(‘I am Vulnerable’)  
</script>

It will produce the following output −

Types of XSS Attacks

XSS attacks are often divided into three types −

• Persistent XSS, where the malicious string originates from the website's database.
• Reflected XSS, where the malicious string originates from the victim's request.
• DOM-based XSS, where the vulnerability is in the client-side code rather than the server-side code.

Generally, cross-site scripting is found by vulnerability scanners so that you don’t have to do all the manual job by putting a JavaScript on it like

<script>  
   alert('XSS') 
</script>

Burp Suite and acunetix are considered as the best vulnerability scanners.

Quick Tip

To prevent XSS attacks, keep the following points in mind −

• Check and validate all the form fields like hidden forms, headers, cookies, query strings.
• Implement a stringent security policy. Set character limitation in the input fields.

How to Hack Password Protected Hidden WiFi In Kali Linux

This tutorial is divided into two parts, the first section is how we can manually reveal the hidden Wi-Fi access around us, and the second is how to hack or to get access to that hidden Wi-Fi which is protected using a password.

HOW TO FIND HIDDEN WIRELESS SSID NETWORK

An SSID or access point name can be hidden, it will not be broadcasting its existence until a client tries to connect to it. Follow along the steps below:

STEP 1: SET MONITOR MODE

First set your wireless card into monitor mode. You can find your wireless card name by typing:

~# ifconfig                                                                        


Generally, a wireless card in Kali Linux is wlan[x], wlan0 is basically your internal wireless card. Here, i am using an external wireless card which is wlan1. Bring down the wireless card, and change it to be in monitor mode. Type:

~# ifconfig wlan1 down
~# iwconfig wlan1 mode monitor

STEP 2: SCAN THE AIR

Now, our wireless card is in promiscuous mode, scan the wireless network using airodump-ng.

~# airodump-ng wlan1

As you can see above, there is a hidden Wi-Fi ESSID which has 6 characters for the access point name. Take a note that BSSID (mac address) : 62:18:88:B3:1B:62.

STEP 3: REVEAL THE HIDDEN ESSID WITH AIREPLAY-NG

Hidden Wi-Fi is shy, we need to knock on the door to make it open its broadcast. To do that, we could do de-auth on all the clients connected to that hidden Wi-Fi, while our airodump-ng is listening to them to re-authenticate to the hidden Wi-Fi. This process is also called capturing handshake.

~# aireplay-ng -0 10 -a [BSSID] wlan1

Lets break down the commands:
-0 x = De-authentication attack mode followed by the number of deauth packets(x).
-a = The target BSSID (mac address)

Wait… Something is wrong?

PROBLEM

While airodump-ng is running, it is hopping between channels randomly, (see on the left-corner side of each below image “CH x”)

On the other side, Aireplay-ng needs to use a fixed channel (the same channel as the target BSSID channel) to launch the deauth attack. We need them to run together. So, how we can run Airodump-ng and Aireplay-ng together without any errors?

SOLUTIONS

The are two solutions i found, The first solution is after we change the channel to a fixed number, run Aireplay-ng first and then run Airodump-ng in the second terminal.

1. 1. [Terminal Window 1] Set to fixed channel as target access point channel.

~# iwconfig wlan1 channel 2

2. 2. [Terminal Window 1] Launch deauth attack

~# aireplay-ng -0 30 -a 62:18:88:B3:1B:62 wlan1

3. 3. [Terminal Window 2] Monitor the network using Airodump-ng

~# airodump-ng wlan1

The second solutions is more simple, it is by narrowing the scan target. Because the main reason for the problem is Airodump-ng does channel hopping when it performs scanning, so just set a particular channel to scan one targeted channel and this will fix the problem for aireplay-ng.

1. 1. [Terminal window 1] Monitor the network using Airodump-ng on target AP channel

~# airodump-ng wlan1 -c 2

2. 2. [Terminal window 2] Launch deauth attack

~# aireplay-ng -0 30 -a 62:18:88:B3:1B:62 wlan1

Ultimately, by using the second solution, we not only discover the hidden ESSID but also captured the handshake. Let take a note:
BSSID   : 62:18:88:B3:1B:62
ESSID   : HACKME
CHANNEL  : 2
ENCRYPTION TYPE      : WPA2

HOW TO HACK WPA/WPA2 PROTECTED WIFI SECURITY

 Alright, now we got the Wifi name (ESSID). The target wifi is protected, so we need the password to connect to this Wi-Fi. To do that we need additional tools, called FLUXION.

STEP 4 : INSTALLING FLUXION

Run the following commands to install fluxion in your Kali Linux:

~# git clone https://github.com/wi-fi-analyzer/fluxion.git
~# cd fluxion/

Update your Kali Linux system and install Fluxion dependencies packages by running install.sh script inside fluxion/install folder.

~# cd install
~# ./install.sh

Once the installation succeed, it should appear like this. Fluxion now is ready to use.

STEP 5 : LAUNCH FLUXION

The main program of fluxion is fluxion.sh located under the main directory fluxion folder. To run fluxion, type:

~# ./fluxion.sh

STEP 6 : SETUP & CONFIGURATION

First, Fluxion will ask you to select language you preferred.

Then, select the wireless card you want to use, external wireless card is recommended.

Next, is select the channel, based on our target information above, the target is in channel 2. We choose Specific channel(s) then input the channel number.
Only choose All channels if you are not sure what the target channel is.

The xterm window will appear with airodump-ng program scanning the wireless network. Terminate by pressing CTRL+C whenever the target appears.

Fluxion will list all available targets. Choose the correct target based on the number in the list.

Next, select the FakeAP Attack Mode. Choose the recommended option FakeAP – Hostapd.

Then Fluxion will ask if we already have the handshake file. Just skip this process, let fluxion handle this for you, keep the file in place. Press ENTER.

Select the handshake verifier. Choose the recommended option  pyrit.

Select deauth option, choose the safeway using Aireplay-ng option [1] deauth all.

Then, another 2 xterm windows appear, first window is airodump-ng monitor which will try to capture handshake, while the second window is a deauth attack using aireplay-ng.

Notice, in the right-top corner of first window, when the handshake is captured (which says: WPA HANDSHAKE xx:xx:xx:xx:yy:yy:yy) just let these windows run in background. Back to the Fluxion window, choose option Check handshake to verify the handshake.

If the handshake is valid, or correspondeds to the target, then Fluxion will move to next process, create SSL certificate for fake login.

Choose Web Interface. There are no other options, the only method is using a fake web login.

Next, choose The fake login template. To make your page look compromised set the proper template as the target firmware or region.

Alright, the setup is done. Now fluxion is ready to fish. Fluxion will make Fake AP, which has the same Wi-Fi information as the target, it is also called EvilTwin AP attack, but without any encryption or Open Connection.Lets read the log file and reveal the password.
More xterm windows will appear, DHCP server, DNS server, Deauth program, and the Wi-Fi information. Here, the deauth is to make sure the target clients are unable to connect to the original access point.

On the target client’s side, they will notice there are two of the same “HACKME” Wi-Fi network, one is password protected (original), the other one is Open (Fake AP). If the target connects into the Fake AP, especially if the user is using a mobile phone, it will redirect-automatically opening the Web Fake login like this.

If the client submits the password, Fluxion will process and verify. If the password is correct Fluxion will terminate itself, stopping all attack, and displays the password.

On the client side, after submitted the password, the page will says something like this.

Based on the result above, fluxion saves the log under /root/[ESSID]-password.txt.
Lets read the log file and reveal the password.

Awesome, you learned a lot, we have succeeded to reveal the hidden ESSID (access point name) and also the password using Fluxion in Kali Linux. Use fluxion wisely or you will be bad. Because it is addictive