WEBVTT

00:00:00.340 --> 00:00:03.250
Now that we have a valid SQL injection, what's our next step?

00:00:03.840 --> 00:00:04.200
Well,

00:00:04.210 --> 00:00:06.290
we can check to see what the name of the database is

00:00:06.290 --> 00:00:07.650
that the application is using.

00:00:08.440 --> 00:00:11.560
We can also find out what user the application is connecting as.

00:00:12.140 --> 00:00:15.470
We can do this with the current‑db and current‑user command line arguments.

00:00:16.440 --> 00:00:17.820
Going back to our previous command,

00:00:17.820 --> 00:00:22.450
we'll add the current‑db parameter and we'll add the current‑user parameter.

00:00:25.940 --> 00:00:29.060
Now you see that the current user is dvwa@localhost

00:00:29.070 --> 00:00:30.270
and the current database is dvwa.

00:00:30.270 --> 00:00:34.060
Being able to retrieve the current database is great.

00:00:35.040 --> 00:00:37.820
Now that we know what it is, let's see what tables it contains.

00:00:38.840 --> 00:00:44.860
Let's go back to our previous command, let's remove these two parameters.

00:00:44.940 --> 00:00:47.560
We'll use ‑D to specify the database,

00:00:49.040 --> 00:00:52.180
and then we'll use the tables parameter so that sqlmap will

00:00:52.180 --> 00:00:55.250
enumerate the tables in that specific database.

00:00:57.840 --> 00:01:02.670
Sqlmap has identified two tables in the dvwa database, guestbook and users.

00:01:03.040 --> 00:01:05.830
I don't think I'll have to tell you which one we're going to take a look at.

00:01:05.840 --> 00:01:10.270
Now to dump the contents of the users table, we can use the dump argument.

00:01:10.740 --> 00:01:12.270
So we'll remove our tables argument,

00:01:12.840 --> 00:01:16.710
we'll specify the table using ‑T, and now we'll tell sqlmap that

00:01:16.710 --> 00:01:18.480
we want to dump the contents of the table.

00:01:19.440 --> 00:01:23.040
Now, here's an interesting feature. Sqlmap detected that one of the

00:01:23.040 --> 00:01:26.200
columns retrieved contains potential password hashes.

00:01:26.640 --> 00:01:29.170
It's now giving us the option to send the hashes to a file so we

00:01:29.170 --> 00:01:31.350
can pass it right into a password cracking tool.

00:01:32.040 --> 00:01:33.020
If we say no here,

00:01:33.030 --> 00:01:36.660
sqlmap gives us the option to perform a dictionary attack on the hashes.

00:01:37.140 --> 00:01:39.710
This happens offline, so there's no harm in giving it a shot.

00:01:39.720 --> 00:01:43.170
Let's go ahead and let it run the built‑in sqlmap word list.

00:01:43.740 --> 00:01:45.940
For the sake of brevity in the example, we'll skip the

00:01:45.940 --> 00:01:47.850
usage of common password suffixes.

00:01:49.240 --> 00:01:51.070
And just like that, we have passwords.

00:01:52.040 --> 00:01:54.360
While it's unlikely that you'll find that this works in the wild,

00:01:54.370 --> 00:01:56.660
the capability is there and you never know when you might need it.

00:01:57.140 --> 00:01:59.630
I've seen applications doing all kinds of unusual things,

00:01:59.640 --> 00:02:02.570
including storing passwords using very unsafe methods.