A3:2021 | SQL Injection Mitigation (12) | Cycubix Docs
In this assignment try to perform an SQL injection through the ORDER BY field. Try to find the ip address of the webgoat-prd
server, guessing the complete ip address might take too long so we give you the last part: xxx.130.219.202
Note: The submit field of this assignment is NOT vulnerable to an SQL injection.
Solution
Try sorting and look at the request
Intercept the request and try to specify a different order by
Use for example "(case when (true) then hostname else id end)" in the order by and see what happens
There are many ways of solving this lab.
Script
Click on column sort performs a request to http://localhost:8080/WebGoat/SqlInjection/servers?column=ip. This can be exploited by intercepting the request with Browser Tools and providing prepared string as column value.
To get the idea about webgoat-prd IP address we first have to find out the table name and ip column name. The obvious guess is servers and ip:
column=(CASE WHEN (SELECT ip FROM servers WHERE hostname='webgoat-acc') = '192.168.3.3' THEN id ELSE hostname END)
If that is the correct table and column name, the table will get sorted by ids.
So after intercepting and changing the request we get the table sorted by ids, the guess was correct.
Just to check our logic, lets send request with:
column=(CASE WHEN (SELECT ip FROM whatever WHERE hostname='webgoat-acc') = '192.168.3.3' THEN id ELSE hostname END)
It get's an error page, we have everything to script the attack now.
Burp
If you are already in the lesson page turn on the interceptor on. Remember by the Hints given, we need to intercept the request and try to specify a different order by.
Click on edit and then click once on the up and down arrow in the column of IP.
Find the request and send it to the Repeater. See the lists of servers.
Add a single quote in the column=ip parameter. When you click send it will show you message "Internal Server Error". "java.sql.SQLSyntaxErrorException: malformed string: '
Click on "raw" tab. In statement [select id, hostname, ip, mac, status, description from SERVERS where status <> 'out of order' order by ip' remove ip' and copy the following code to test true case SQL Injection. Also, remember by the hints that we should use for example "(case when (true) then hostname else id end)" in the order by and see what happens.
Insert the following ORDER BY clause replacing ip'.
You can compare with the previous image and see that now that there is a server hostname equal to ‘webgoat-prd’ and the list is ordered by ID. Else, it would be ordered by "status".
We can also try a false statement with the following statement, expecting a false result and ordering by status.
(CASE+WHEN+(SELECT+substring(ip,1,1)+FROM+servers+WHERE+hostname='webgoat-lzp')+=+'1'+THEN+id+ELSE+status+END)
Given that the order is not by ID we can try to guess the IP address for 'webgoat=prd' server by checking one number at the time.
Examples:
substring(IP address, 1,2)='5'
(CASE+WHEN+(SELECT+substring(ip,1,2)+FROM+servers+WHERE+hostname='webgoat-prd')+=+'5.'+THEN+id+ELSE+status+END)
The correct number, after trying to guess possible numbers is 104.
Last updated