Database Security
This is my experience with cryptography at Georgia Tech. To save you time, there are only some notes and hints and no answers. This is purely to remind myself and maybe and maybe help someone out.
“Good News, Everyone!” A penetration testing firm has hired you, and as your first assignment, you’ve been given a small portfolio of websites to test. You immediately notice that the pages of different clients look very similar, with similar structure and conventions. With more digging, you determine that the same software company created them. Having this information, you know that any vulnerability you find on one site will likely be seen on every client’s site. You also recognize the style of the pages and vulnerabilities and feel you have worked with this company in the past, remembering that they often use the same logic on the client and server side.
Your goal is to bring visibility to these vulnerabilities by finding sensitive data not intended for viewing and testing the client’s security on sites where user input is required. As a pen tester, you will have to wear many hats. Good luck, and we hope you enjoy learning about a couple of database attacks.
— — Previous semester resources shared by students, including their quotes — -
https://www.invicti.com/blog/web-security/sql-injection-cheat-sheet/ — this was insanely helpful for me to understand simple examples that I could then build on. Many ways to skin the cat at the simple level of 3 but encourage blending all the hints to find the perfect way.
https://security.stackexchange.com/questions/51410/true-false-statements-in-mssql-without-and
A helpful way to run pieces of code in the Chrome Developer Console: https://developer.chrome.com/docs/devtools/javascript/snippets/
A useful way to deal with the stongly-typed nature of SQL columns: https://learn.microsoft.com/en-us/sql/t-sql/functions/conversion-functions-transact-sql?view=sql-server-ver16
MVP for sqli, thank me later.
https://www.exploit-db.com/papers/12975
It’s been a while since I used SQL/T-SQL and this reminded me what options I had available to me while putting the code together for the SQLi:
For more about operators check out:
Here are the few resources that helped me with this project, esp for flags 3,4,5 and 6:
https://www.w3schools.com/tags/ref_urlencode.ASP
https://portswigger.net/support/sql-injection-bypassing-common-filters
I worked through several of the SQL injection labs on https://portswigger.net/web-security/sql-injection (sign up is free) and recommend it to learn and practice. Going through this a few months ago was a huge help for this Database project.
Computerphile has some of the best computer science videos on youtube. This one is about SQL injections: https://youtu.be/ciNHn38EyRc?si=nshezaQ878M_5cfg
For prep and a refresher on SQL, I’ve worked through the W3 Schools site for SQL: https://www.w3schools.com/sql/default.asp
And I have this T-SQL documentation link (with other links on the side for T-SQL pages) I’m using as a reference source from Microsoft: https://learn.microsoft.com/en-us/sql/t-sql/language-reference?view=sql-server-ver16
https://www.w3schools.com/sql/trysql.asp?filename=trysql_select_union
This is a nice little “get your feet wet” resource from Network Chuck I thought nicely explains SQL Injections and how they work. The cherry on top for me, and why I am sharing, was that there is a site actually hosted with this vulnerability that you can use to practice if you want.
https://www.youtube.com/watch?v=2OPVViV-GQk&ab_channel=NetworkChuck
Task 1
TASK 1: INFERENCE ATTACK- #1 (flag1–20 pts)
NOTE — Task 1 is an array flag
Your first two attacks will involve what is called an inference attack.
Note: this isn’t that hard if you are ok with excel.
TASK 2: INFERENCE ATTACK- #2 (flag2–25 pts)
**NOTE — Task 2 is an array flag
Now that you have seen how an inference attack can compromise data in a single company, we consider how inference attacks can compromise data by combining unrelated data sets.
Get cloudneuf’s stories in your inbox
Join Medium for free to get updates from this writer.
Hints:
- As with the prior task, feel free to make liberal use of copying data from the VM into a spreadsheet or other similar program on your host, and feel free to do whatever analysis you need to do to figure out the record you seek. As in Task 1, this is not required to complete this task.
- Unlike Task 1, where the data can be more easily narrowed to one record, you will need to narrow it to multiple records and then use logic to narrow it to one. Unlike Task 1, where the order matters to narrow the data, it does not matter here as it is logic-based instead!
- Once you isolate a voter, continue to see if you can isolate another voter. Rinse and repeat until you can no longer isolate a voter.
- Sometimes, there is no perfect join of data, and logic needs to be incorporated,
- If you use an external application to troubleshoot the data and try to sort, make sure the entire dataset is sorted
- There is no partial credit for the correct hash or for the correct procedure (to receive credit, the hash_procedure has to be correct in its entirety)
NOTE: What helped me on this quest is combining the table columns as suggested. One of the combinations will look pretty convincing and you see it when you do so.
TASK 3: SQL INJECTION — #1 (flag3–7.5 pts / flag4–5 pts / flag5–7.5 pts)
Flag3: Your task is to use social engineering to obtain the login account (user) and SQL Injection to bypass the password (no sanitization *discussed in flag4 and flag5). Upon a successful login bypass attack, you will be prompted for a four-digit PIN, which you will again need to use some social engineering to figure out. When you finally log in, use the extended roster data to find the students who have received an F in the class and enter them into the flag3 array (order does not matter).
NOTE: Ed discussion helped but some words TA gave can be misleading. Social engineering doesn’t mean to call up people or travel to class. Keep searching will be my hint and PIN isn’t far away.
For flag4 and flag5, you have a website where your user ID is your GTID, as you entered on Task 0. The site wants to upgrade its old Legacy Login page. The legacy page’s main security is checked to see if there is a direct match to a user by the username (your GTID). You do not know and will not receive the password to enter the system. Knowing that a SQL Injection attack is possible, the developers want to attempt to mitigate the risk of such an attack; however, they are wondering if they should be using just client-side data sanitization or both client and server-side data sanitization, with the server-side and client-side data sanitization being the same. For flag4, you will attempt to bypass the security using client-side data sanitization. For flag5, you will attempt to bypass the security using client and server-side data sanitization. The client provided a snippet of the code they used on the legacy login page. You can use this code to determine how to perform the SQL injection. When you succeed, you will log into the website using your GT ID and no password. The injection will bypass the password requirements and log you in immediately. Once logged in, the hash for flags4–5 keyed to your GT ID will be displayed.
- For flag4 (New Login — Option 1) — this is a client-side data sanitization SQL Injection on the password field.
- For flag5 (New Login — Option 2) — this is both a client and server-side data sanitization (2x) SQL Injection of the password field.
Note: The use of breakpoint in the Javascript writeup is the only way to solve flag4 and flag5. This bypass assignment can be done with encoding but easier without.
Basically though you need to understand how to “beat” the sanitation without encoding. If you are trying to bypass it, you will never complete flag5
TASK 4: SQL INJECTION — #2 (flag6–7.5 pts / flag7–7.5 pts)
*NOTE — Task 4 has 2 flags (flag6, flag7)
You will be completing two flags for this task with flag7 reliant on the completion of flag6. We strongly recommend you wait until you complete task 5 before trying flag7, as some knowledge from task 5 will be needed to complete the flag.
Both flags will use the same banking website. This is a standard type of banking site where you log in and see the history of a particular account tied to the login. Your client maintains another site and wants you to verify the protection they have set up. Your job is to show them that the protection is not adequate.
*Part one (flag6): logging into a website as a user without a username
You must complete this first part to get full credit for the project (i.e., 100/100). Your task for this portion is to log into the website without knowing any actual accounts. However, you must log in as a valid user. You, therefore, must craft an injection that is smart enough to find a valid user from the database without having any actual access to the database (see the hints section below for assistance in knowing what the database structure looks like). You must use the skills you gained in Task 3 with more sophisticated SQL knowledge. There are multiple injections for the username field that will work; your goal is just to ensure that the username is populated from an actual row within the database using your injection. You will need two different injections for the two fields (username and password) to log in. Once you have logged in successfully, you will see a valid username where the username text box was and a hash just below the username. This hash is your answer for flag6.
- Task 6:
Flag6 and I was stuck for almost 3 days but not actively working on it. Solve it having lunch at a cafe and almost scream.
From the write up that I found most useful:
1. “craft an injection that is smart enough to find a valid user from the database without having any actual access to the database” Hint this is tell you there will be some logic statement for your injection
2. “You must use the skills you gained in Task 3 with more sophisticated SQL knowledge.” great hint for the password part
3. “There are multiple injections for the username field that will work” Good thing you just need 1
4. “You will need two different injections for the two fields (username and password) to log in. “ this hint told me there are two injections and one for username and another for password
5. Using the task 3 schema helped me understand what I am dealing with and I suggest you play with it in the sqlfiddle. However, I don’t think it help regarding getting answer.
6. “This is sample code and not the exact code that is used. Do not try to bypass the code “ This hint is way too important as we got pampered in previous task with bypassing. Understand the difference between logic and bypassing
7. Overall the keyword really helped me is “logic” which help me think about something logical in coding.
*Part two (flag7): altering transaction history
The developers want to verify the strength of their protection for the account’s transaction history. Once you complete flag6 and log in, you will see a list of 10 transactions over time. You will notice that one of the 10 transactions has an overdraft charge of $35. You’ll also notice a balance to the account when you bring it up to $1746.52. You need to do two things to test the transaction history and get your flag. You must get the balance to $2000 with 10 transactions and no overdraft fee. To do this, you need to do a transfer of money into the account, and you will need to delete one of the transactions (for this test, the developers want to see if you can remove an unwanted overdraft amount, so you’ll need to remove that specific transaction while adding enough money to make the balance $2000).
Unlike prior injections, attacking the text boxes cannot do this task. Instead, You must alter the form output within the web browser. This will require you to use the Chrome Developer Tools within the browser. This will probably require you to research how to use these tools to make breakpoints and alter the contents of data as found in a form. When you click the Transfer button, you must know how to pause submitting the form to complete the attack. The routing number and account number fields do not matter; feel free to enter any values. You will not be able to alter the account number. You should enter the amount you need to get to $2000 as if the overdraft fee was not there (if you do the injection correctly, that transaction will completely disappear and, therefore, not be used to calculate the balance). If you have the breakpoint set correctly, you can stop form execution and use the Developer Tools to alter the data within the form to include your SQL injection.
When you have done this correctly, the proper hash will appear below the balance as the value associated with “Validation.” Unlike all other tasks, be warned — there will always be a hash there, and its value will change. You, therefore, can receive an incorrect hash. The hash will ONLY be correct if the balance is $2000 and the number of transactions is 10, with NO overdraft fees. Do not try to submit this to Gradescope unless you have no overdraft fee, 10 transactions, and a $2000 balance — whatever hash you may have outside of those conditions will not be correct.
