Welcome to part six of this module in this century we're going to be taking a look at a sequel map and
how we can use it to perform sequel injections for testing against a web application.
The purpose of this demonstration will be to show how a hacker might use these techniques to obtain
user names passwords credit card numbers your grandmother's laundry list as well as any other information
that is meant to be kept secret on a Web site database.
We must understand the attacks so that we can know what to guard against and this tool will allow you
to pen test the web applications that you build so as to keep your users data safe from the unscrupulous.
This is one of the most powerful tools in Cali and it does the sort of thing people normally think of
when they hear the word hacker.
For that reason I have to remind you that performing these techniques against a Web site that you do
not personally own or have written permission from the owner to pen test is going to be highly illegal
in almost every jurisdiction sequel map comes prepackaged with Kelly 2.0.
It is open source software that is used to detect and exploit database vulnerabilities and provides
options for injecting malicious code into them.
The tool automates the process of detecting and exploiting sequel injection flaws providing its user
interface in the terminal window.
The program can be launched by going to applications web applications and clicking on sequel map but
we'll be launching it in the terminal window to do this.
We just type sequel map and we're going to include TAC each for help.
The command alone without a target or a switch won't do anything.
The software itself is available to download for different operating systems.
It works on pretty much all Linux distributions.
Mac OS and yeah even even windows.
In addition to mapping and detecting vulnerabilities the software enables access to the databases editing
and deleting data and viewing data in tables such as users passwords backups phone numbers email addresses
credit card numbers your grandmother's super secret CIA alternate identity and so on.
You get the idea sequel map has full support for multiple DB M.S. including my sequel Oracle post grass
Microsoft Eskew l server Microsoft Access IBM DB to Eskew lite Firebird and SAP Max DV and offers full
support for all injection techniques including boolean error stack time and union.
This tutorial will cover all of the basic usage although given the power and the sheer range of options
available for this tool to cover every possible use and iteration of it would be an entire class unto
itself.
Our target in this demonstration is going to be the bricks vulnerable web app which is part of the O
WASP broken web app.
-- vulnerable web app for me to split able to would work just fine but I wanted to mix things up a
little and since most of you are probably following along with met hospitable to to conduct your own
tests.
This will make it an excellent exercise for you to crack into -- vulnerable web app on Metis political
to yourselves.
Here we see a basic log in page this is what we are going to be testing against.
The goal is going to be to find all of the usernames and passwords by testing whether or not these fields
are vulnerable to ESC fuel injection.
And if so can we use that to gain access to the back end database.
Now that everything is set up
will begin.
So without further ado let's get started with sequel map.
So to launch the program we're going to do s q l map tech u for you are L and this is where we would
give it a target such as I don't know whatever Web site you've been given permission to test against.
And of course after the URL you would put in the various options that you wish to use with it as outlined
in the help file but I'll be entering the IP address of my broken web app which is running on my own
network here in the office
as we work through this.
We will be introducing different switches at the command line.
Little by little each time we were on the program we'll build on the last thing that we did since we're
going to be using that log in page from the Brooks application
to go ahead and
copy this and let's just go ahead and take a look at this real quick.
We can see that we only have to form fields if we view the page source
we can see that the forum is posting back to itself.
We have input boxes for the user name and password and that is the information we need to give to sequel
map in order to test against these fields.
And what I'm talking about is writing here
there are a few other ways you can do this.
One of them is by using the Tac tac forms options.
So let me just correct our target
to include the Web you are El and we know that the back end database being used here is my sequel.
So to save time with the numerator one we'll just specify with that with Tak tak D.B. M.S. equals my
sequel and then we're going to do Tack Tack forms and we'll have it retrieve the banner information
for the database with Tag tacking banner so if we go back and look at what we have here the tack you
option is where we specify the U.R.L. of our target Tak tak DNS is where we specify the back end database
if you don't know the back end database there is another option that you can use which is Tak tak D.B.
s which will cause sequel map to try to enumerate the database and figure out if it is my sequel or
a Microsoft back end or post press or something like that it'll try to figure it out for you but be
aware that this will turn an already lengthy process into an extremely lengthy one as for tak tak forms
what this is going to do is have sequel map look at the source code for the Web site and look for forms
of input so with the BRICS application it's going to see that username and password form fields and
that is what it is going to test against.
And finally the tac tac banner is going to tell it to try to retrieve the version of my secret database
that is running on the back end so we could enter
and almost right away it's going to start asking us to verify certain options for most of these we're
going to say yes and we're going to leave this field blank just by hitting enter because we don't know
what this is yet and yes
OK so it's identified two places that are vulnerable to sequel injection which are the two forms I spoke
of user name and password we'll just select the zero for user name and this is asking if we want to
exploit this sequel injection which is a bit like asking a kid in a candy store if you would like some
candy.
So of course we're going to say yes
so here we see the version being run which is my sequel and we can see that the version the banner version
is five point one point for one a bunch too.
OK now we'll see if we can get sequel mapped print out a list for all of the database users on the server
so we're going to bring back our command.
And we're going to replace banner with Tac tac users we'll leave everything else the same and we'll
hit enter
and it's going to ask us the same questions again.
So we're gonna give the exact same answers
and there we go.
Now I should mention I've run this already.
So the first time you do this it's probably going to take a while so it has retrieved you scroll up
here 38 total users.
These are database users for every application on the server which is good information to have.
We could also take this a step further and try to get the password hashes for these users so we're going
to bring back our command and we're going to add in Tac tac passwords is literally as easy as just adding
in TAC tech passwords at the end of our command string and we'll press enter again.
We have to answer the same questions again.
And I know that can be a bit tedious.
Yes yes.
And zero.
And now it's asking if we would like to store the hashes for eventual processing with another tool.
Normally you would do this.
I'm not going to but it is something that you can do if you don't want to have sequel map attempt to
break the hashes itself or you can have the sequel map try and if it fails you'll have the file that
you can then run through something else.
So I'm just going to say no here but you'll probably say yes when you're using this you're on your own
and do we want to perform dictionary based attacks.
The answer is yes.
This may take a while.
Now it's going to attempt to crack all of these password hashes that we have for these user names and
it's going to use a word list to do this.
Now you can use the default dictionary file that comes prepackaged with sequel map and that's what I'm
going to do.
Or you can use your own custom dictionary file or you could use a file with a list of dictionary files
although that's getting into some really lengthy processes.
So I'm going to select one here and I recommend against using common password suffixes.
It will take a very long time.
You can do it if you wish.
All right.
And now sequel map is essentially brute forcing each and every password that it finds.
And fair warning this may be a rather lengthy process so I may be making a small cut to the recording
here in a moment.
But essentially what this is doing is sequel map is is testing each password hash using the dictionary
file in this case the default dictionary file that came prepackaged with sequel map.
It's testing every possible letter and word combination against that password hash.
Now it is going to succeed in a relatively timely manner because this is a vulnerable web application.
So all of the passwords that it's going to be cracking are relatively simple very complex passwords
will not be quick to crack.
And if you do decide to use the common suffixes it will improve your chances of cracking the password.
But it will also greatly lengthen the cracking process so I'm going to make a small pause to the video
here this should take about five to 10 minutes give or take.
Already we have successfully cracked these hashes it took about seven or eight minutes which isn't too
bad.
Of course your mileage may vary depending on the strength of the passwords and the power of your system
and your wordless complexity.
But as you can see it's taken these hashes and it has converted them into plain text passwords which
we can use with the user names associated with them to log in.
So now of course these weren't very complex passwords.
It goes without saying that people who are wise will use very strong passwords and those will be highly
resistant to this sort of method.
Of course if it's a major web server and it's vulnerable to sequel injection then it's pretty much 100
percent certain that an attacker is going to walk away with a pretty large number of passwords one way
or another because most people just don't use strong passwords.
So now that we have the usernames and passwords let's move on to listing the actual databases that are
available to use on the server.
We're going to use the same basic commands before but this time we're going to introduce another option
called Tac tac DB Yes this is going to enumerate the server and list out any databases that our session
user has access to so we'll clear out users and passwords because we have them.
And yes we hit enter and we're going to have to answer the questions again.
Now you can run sequel map in such a way that you don't need to answer these questions every time but
that that is a bad habit to get into for complex tests.
So I don't advocate doing that
already.
It looks like it was able to retrieve all of the databases which are on this particular VM.
Of course this doesn't normally go that smoothly.
If a web app is setup correctly the user that the database is running at should not have access to all
of the other databases on the server.
In this tutorial we'll just be going over the BRICS application.
But if we wanted to spend the time we could enumerate every single database that is on the server some
of these databases could in a real world situation contain credit card information Social Security numbers
the nuclear launch codes or anything else you might not want to get out.
So this is where patience and persistence becomes important against a target with real safeguards passwords
and credit cards are obviously going to be a lot harder to get thankfully.
However if we look at large scale data breaches the past such as for example the Ashley Madison hack
of 2015 these same methods were used to pull an immense amount of personal information on users including
real names home addresses search history and although credit card numbers were not pulled or were encrypted
in such a way that they could not be broken through brute force credit card transaction history was
not to mention the plethora of passwords that may be applicable to other accounts associated with that
user over 25 gigabytes of this personal information was then leaked resulting in many users being publicly
shamed and the eventual the eventual collapse of the service.
Now the example I'm citing a slightly more complex than what you're seeing here for example I believe
that hash cat was used to crack the password hashes rather than cracking them right there in sequel
map.
But that sort of thing aside it's clear to see that the sort of real world consequences this type of
attack can have can be pretty dire even when the obvious things like credit card numbers are being properly
protected.
The lesson here for security minded people is that when you are setting up a database in a web app on
a live production system be sure to watch out for the user that you are letting that database run as
and the permissions that user has for right now we'll just concentrate our efforts on the brink status
since this is the page that we're looking at.
The next thing we need to do then is enumerate the tables and columns that database contains
so we're going to replace PBS with TAC D bricks lowercase.
Forgive me
and that's going to specify the database that we're going after and we're going to tack tack tables
so we typed bricks to signify our target and then by adding Tac tac tables that tell sequel map that
we want to find out all of the tables that are contained within the BRICS database we hit enter
and we're going to have to answer the questions again yes enter yes zero.
We could use one.
And yes
all right.
It looks like there was only one table in that database which is the user table.
Well that's fine because that is what we would be looking for anyway.
The next thing we want to do is enumerate the columns that are contained within this user table.
So we go back to our command and we're going to change.
We're gonna get rid of tables.
We're gonna do TAC t users tac tac columns.
You can see that we've once again extended our command.
I mentioned at the start of this tutorial that each subsequent command would build on itself and that
is a good example.
Sorry.
Now it's come back and it shows us all the different columns contained in that user table email host's
passwords et cetera et cetera.
From here we could choose to dump all of the information that is presented.
But right now we only want the ones that contain the juiciest types of data we'll tell it to grab the
names passwords and I think we'll have a get the email addresses as well.
So we're going to pull up our command again and we're going to remove code breaks
see you taxi and we're going to do names comma password comma email tap tech dump the syntax is just
going to be the name of the column that you want a comma and then the next column.
But make sure you don't put any spaces in between them and of course we have to answer our questions
again
and we can see the process running it's retrieving the info for us
and this is about how long it usually takes.
I'm not going to store the hashes at this time but I am going to try to crack them all right.
So it looks like we got the passwords and email but I'm sorry.
I see what happened.
All right.
I said names when I really meant to say name because that was the name of the table.
I think that's why we're seeing blank right here.
That is a mistake that can happen.
Yeah.
Name OK.
Well I think I'm going to leave that mistake in because it's an example of what can happen if you make
a syntax here but I will very quickly rerun this command and I won't make you sit through the enumeration
process again.
I'll make a small cut right here.
Alrighty so it came back already.
We now have the main password an email for all of the users that are contained within the user's table
within the BRICS database.
Now if we go back to the Web sites
we know that we can type admin for the user name and admin for the password and we click submit
and we're in it doesn't actually do anything of course.
This is just a simulation but it tells us that we have successfully logged in using the admin account.
Now we can also log in with lesser credentials for example Ron and Ron were Tom and Tom.
If you log in with any of these you would then have access to anything that user has rights to.
In cases where some databases are hidden depending on user permissions it may be possible to use previously
captured credentials to escalate your attacks to find those additional databases.
They're limited to those specific users.
And so by that way expand and continue to drill down and enumerate and get more and more permissions
and and so on and so forth and increase your credentials.
It all depends on how sloppy the creator of the web app is in terms of the way in which database permissions
are set up and where such data is stored.
Of course if you find an admin user you've basically struck gold from there the sky is pretty much the
limit in terms of what you can do and what you just saw applies to all of the databases on this web
server.
Again it's just a question of persistence and patience.
We could theoretically get every scrap of information off every database here.
If you remember from just a little bit ago we were actually able to get a list of all the databases
on the server.
So what if we wanted to look up one of those other databases to scroll up here.
There we go.
So we'll do DV W.A. -- vulnerable web app since those of you following along are probably using metal
spoil to as your test target and you'll still have motility to experience all on your own.
Of course we'll have to change this.
Just want to show you how since our user has access to all of these databases we can pull data from
other databases as well.
We're going to add the W A and tack tack tables
and this will be the same steps as before.
Same questions as before it might not go quite as quickly because I don't think I already did this on
a test run.
So it may have to enumerate.
No.
There it goes all right.
You can see that -- vulnerable web app has two tables in it.
Guest Book and user.
We can continue to drill down by working through that.
So we're going to place tables with t users and we're going to do Tac tac columns
once again the scan will run.
Same questions as before
as you can see it's giving us back the columns contained in that user table along with the data types
for each one so let's remove columns
and see user karma password for the columns user and password.
Make sure I spelled those right.
I did.
OK.
And remember not to put a space it needs to be user comma password all one string.
No spaces Tak tak dump all that run
yes enter.
Yes 0 and yes I'm not going to store the file at this time.
And yes all right.
So we're getting user names and password hashes in the first phase then sequel map will ask us if we
want to store and or crack these as you've seen I let it do so and now we've got the user names and
in parentheses are the clear text passwords located right after the hashes that have been cracked and
it actually went pretty fast so as you can see it got all of these if the default word list failed you
could save the hashes and use something else to try to crack them or just a more powerful word list.
As I said it's not possible to demonstrate every conceivable use of this tool but if you practice with
it things like this will become self to you from a simple sequel injection floor it is possible to steal
significant data from any web based database.
Starting out we didn't have to be logged into a web app to try to get this information.
We simply exploited an issue with the user name field in our target the BRICS web app which allowed
us to bypass any authentication required for this web app and gain back end access to the database.
From there we were able to extract all of this information and because the database user is running
with root privileges we have access to every database on this web server.
Imagine if you had 30 different web applications running on one server.
One of these web apps has a flaw in it that one flaw could be leveraged by an attacker to gain access
to all of the information that server contains depending on how the user permissions are configured.
This is something to always keep in mind when setting up your own applications.
Now that pretty much covers the basic barebones usage but there are a few more things I'd like to mention.
So to show you this I'm going to delete most of this command.
We're done with this.
So there is an option called Tac tac level it goes from one to five with five being the most exhaustive.
What this basically does is it causes sequel map to use a larger number of payloads.
One testing injection sites.
The default is 1 if you set it 2 or higher.
Sequel map is going to try injection attacks in more than just the get and post branches of the page.
It's going to look at the user agent and any cookie values that are passed as there may be injection
points in those items as well.
You would want to use maybe a higher level if you were working on a web app that might have vulnerable
injection points but they are a little harder to leverage and exploit.
In case this sounds a bit cryptic.
What I mean is in the real world if you're going up against a real world target you have to assume a
basic level of competence.
And it will probably resist the default level of one since most web app creators are getting better
about obvious flaws.
So if your target of your authorized penetration test is something like a financial institution you
would absolutely want to use a higher level attack to get the best possible test coverage.
Another option is tack tack risk.
This goes from 1 to 3 with 3 being the highest.
This causes sequel map to use more risky injection techniques a word of caution with this one.
If you do set it to a higher level you could introduce issues into the databases that you maybe didn't
intend.
If you have a query that is using an update statement for example it is possible that you could accidentally
end up updating all of the different tables in that database where you didn't actually mean to.
Just as one example so be careful when using risk
we can see all of the different payloads that sequel map uses by looking under the user share sequel
map XM l payloads folder we can see that these are all Excel files and named for the types of payloads
that they contain.
It is possible therefore to build on these and add your own or edit existing packages if you have some
custom attack that you want sequel map to try.
Finally I'd like to speak briefly about the TAC TAC technique switch.
This option will allow you to specify which injection type that you want to use by default sequel map
uses all injection types.
And when I say injection types I mean things like boolean based error based stack queries bond injections
inline injections and so on and so forth by default sequel map tries all of these unless you expressly
specify otherwise.
If you've done some manual testing on a web app and find that it is vulnerable to I don't know let's
say an error based sequel injection you could specify with this switch that you only want sequel map
to use that type of injection payload against the target error based attacks that will save you some
time during your testing process.
All right that is going to pretty much do it for this video we have just barely scratched the surface
of all the capabilities sequel map has.
As I said this would be an entire class unto itself but with this understanding of the foundational
principles it should be easy to build your skill with sequel map through time and practice like and
map and certain other programs in this class.
The use of sequel map is part science and part art the science of it can be taught but the art has to
be developed.
This is one of the most powerful applications in the Cali Linux tool box and with time and effort you
can make it do things that go far beyond what you've seen here.
Just remember to always be legal and ethical and how you use it.
Thank you.