Rose & Marinaldo: 20 de abr. de 2020

segunda-feira, 20 de abril de 2020

Learning Web Pentesting With DVWA Part 2: SQL Injection

In the last article Learning Web Pentesting With DVWA Part 1: Installation, you were given a glimpse of SQL injection when we installed the DVWA app. In this article we will explain what we did at the end of that article and much more.

Lets start by defining what SQL injection is, OWASP defines it as: "A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands."

Which basically means that we can use a simple (vulnerable) input field in our web application to get information from the database of the server which hosts the web application. We can command and control (at certain times) the database of the web application or even the server.

In this article we are going to perform SQL injection attack on DVWA, so let's jump in. On the DVWA welcome page click on SQL Injection navigation link. We are presented with a page with an input field for User ID.

Now lets try to input a value like 1 in the input field. We can see a response from server telling us the firstname and surname of the user associated with User ID 1.

If we try to enter a user id which doesn't exist, we get no data back from the server. To determine whether an input field is vulnerable to SQL injection, we first start by sending a single quote (') as input. Which returns an SQL error.

We saw this in the previous article and we also talked about injection point in it. Before diving deeper into how this vulnerability can be exploited lets try to understand how this error might have occurred. Lets try to build the SQL query that the server might be trying to execute. Say the query looks something like this:

SELECT first_name, sur_name FROM users WHERE user_id = '1';

The 1 in this query is the value supplied by the user in the User ID input field. When we input a single quote in the User ID input field, the query looks like this:

SELECT first_name, sur_name FROM users WHERE user_id = ''';

The quotes around the input provided in the User ID input field are from the server side application code. The error is due to the extra single quote present in the query. Now if we specify a comment after the single quote like this:
'-- -
or
'#
we should get no error. Now our crafted query looks like this:

SELECT first_name, sur_name FROM users WHERE user_id = ''-- -';

SELECT first_name, sur_name FROM users WHERE user_id = ''#';

since everything after the # or -- - are commented out, the query will ignore the extra single quote added by the server side app and whatever comes after it and will not generate any error. However the query returns nothing because we specified nothing ('') as the user_id.

After knowing how things might be working on the server side, we will start to attack the application.
First of all we will try to determine the number of columns that the query outputs because if we try a query which will output the number of columns greater or smaller than what the original query outputs then our query is going to get an error. So we will first figure out the exact number of columns that the query outputs and we will do that with the help of order by sql statement like this:

' order by 1-- -

This MySQL server might execute the query as:

SELECT first_name, sur_name FROM users WHERE user_id = '' order by 1-- -';

you get the idea now.
if we don't get any error message, we will increase the number to 2 like this:

' order by 2-- -

still no error message, lets add another:

' order by 3-- -

and there we go we have an error message. Which tells us the number of columns that the server query selects is 2 because it erred out at 3.

Now lets use the union select SQL statement to get information about the database itself.

' union select null, version()-- -

You should first understand what a union select statement does and only then can you understand what we are doing here. You can read about it here.
We have used null as one column since we need to match the number of columns from the server query which is two. null will act as a dummy column here which will give no output and the second column which in our case here is the version() command will output the database version. Notice the output from the application, nothing is shown for First name since we specified null for it and the maria db version will be displayed in Surname.
Now lets check who the database user is using the user() function of mariadb:

' union select null, user()-- -

After clicking the submit button you should be able to see the user of the database in surname.

Now lets get some information about the databases in the database.
Lets determine the names of databases from INFORMATION_SCHEMA.SCHEMATA by entering following input in the User ID field:

' union select null, SCHEMA_NAME from INFORMATION_SCHEMA.SCHEMATA-- -

This lists two databases dvwa and information_schema. information_schema is the built in database. Lets look at the dvwa database.
Get table names for dvwa database from INFORMATION_SCHEMA.TABLES

' union select null, TABLE_NAME from INFORMATION_SCHEMA.TABLES-- -

It gives a huge number of tables that are present in dvwa database. But what we are really interested in is the users table as it is most likely to contain user passwords. But first we need to determine columns of that table and we will do that by querying INFORMATION_SCHEMA.COLUMNS like this:

' union select null, COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'users'-- -

We can see the password column in the output now lets get those passwords:

' union select user, password from users-- -

Of-course those are the hashes and not plain text passwords. You need to crack them.
Hope you learned something about SQL injection in this article. See you next time.

References:

1. SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
2. MySQL UNION: https://www.mysqltutorial.org/sql-union-mysql.aspx
3. Chapter 25 INFORMATION_SCHEMA Tables: https://dev.mysql.com/doc/refman/8.0/en/information-schema.html

Continue reading

How To Start | How To Become An Ethical Hacker

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!

This Post is for the people that:

Have No Experience With Cybersecurity (Ethical Hacking)
Have Limited Experience.
Those That Just Can't Get A Break

OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.

I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.

Let's get this party started.

What is hacking?

Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.

Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.

Skills required to become ethical hacker.

Curosity anf exploration
Operating System
Fundamentals of Networking

*Note this sites

Facebook Plans To Launch Its Own Cryptocurrency

The social network giant, Facebook is going through a bad phase with lots of ups and down. The recent scandal with Cambridge Analytica has caused the world's largest social network giant Facebook to change its stance on user privacy and to be more transparent about its use of the data it collects.

Since then, some social networks based in Blockchain have been popularized, namely Sphere, Steemit, and Howdoo. However, recently, something unusual announcement is announced by the social network giant Facebook itself, in which Facebook stated that it is investing in a Blockchain-based solution development team, but, the purpose of the project is not yet known.

It was with a post on the Facebook page that David Marcus confirmed his departure from the Messenger team and the creation of a small group dedicated to finding solutions based on the potential of Blockchain technology for Facebook.

David Marcus has not given much detail on the work he will do with his new group, saying only that they will study Blockchain from scratch so that they can use this revolutionary technology for Facebook.

"I'm setting up a small group to explore how to leverage Blockchain across Facebook, starting from scratch," stated David Marcus.

Despite being connected to Facebook's Messenger since 2014, David Marcus is no novice in these financial issues related to money transfers. In addition to having introduced the possibility of P2P payments in Messenger itself, David Marcus was President of PayPal and CEO of Zong, a company dedicated to payments on mobile devices.

However, his experience in this segment does not allow us to conclude that Facebook will create or support a crypto coin, but, it also doesn't mean that it will launch or support any crypto coin of its own. Blockchain technology has become famous thanks to crypto-coins, especially Bitcoin, but its potential expands dramatically to other areas.

The potential of Blockchain goes from the crypto-coins to the creation of real ecosystems online, supported by the users of the network. Sharing and storing data is a legacy that Blockchain allows you to explore and maybe the fact that Facebook will use it in your favor.

The lead post in Messenger was then handed over to Stan Chudnovsky, who now heads one of the most widely used communication services around the world, alongside WhatsApp.

Rumors also point out that James Everingham and Kevin Weil, both from Instagram, will also join David Marcus in this new onslaught of Facebook to one of today's most acclaimed technologies.

Read more

A Quick Guide To Selection Sorting

In this Article I'll tell you about Selection Sort
Selection sort is that type of sorting in which smallest element of a list is searched and then this number is swapped with the first element of the list and then second smallest element is searched in the list and is swapped with the second element of the list and so on i,e this "thingy" thing continues on till n-1 times (where 'n' is the number of terms).
COMPLEXITY:-
Complexity of Selection sort is O(n^2) in best case as well as in worst case.
Well selection sort is not a good sorting algorithm which you can see even from the complexity of selection sort because selection sort performs same number of comparisons even in the best case as in the worst case. Which makes it very slow.
Pseudo-code:-
sort(Arr)
for i = 0 to n-1
smallest = location of smallest number from Arr[i] to Arr[n-1]
swap Arr[i] with Arr[smallest]

/*C Program: Implementation of Selection Sort*/
#include<stdio.h>
void swap(int a[], int i, int j){
    int tmp = a[i];
    a[i] = a[j];
    a[j] = tmp;
}
void selectionSort(int a[], int l, int h){
   for(int i=l; i<h; i++){
     int small = i;
     for(int j=i+1; j<=h; j++){
       if(a[j] < a[i]) small = j;
     }
     swap(a,i,small);
   }
}
int main(void) {
   int arr[10], n;
   printf("Enter Size of Array: ");
   scanf("%d", &n);
   printf("Enter %d elements:\n", n);
   for(int i=0; i<n; i++) scanf("%d", &arr[i]);
   selectionSort(arr, 0, n-1);
   printf("Sorted Array is as:\n");
   for(int i=0; i<n; i++) printf("%d ", arr[i]);
   printf("\n");
   return 0;
}

Nubico: Una Startup En España Para Leer Muchos Comics, Libros Y Revistas

Desde que comenzó este periodo de confinamiento, todos los días hablo con mi mamá. Hablo con ella para contarle mi día, mis aventuras y desventuras, y contarle cómo estoy. Después, hablamos de cómo se encuentra, de qué ha hecho, de si ha hecho ejercicio o no en casa - que si no vamos a salir todos del confinamiento rodando - y de entretenimiento. En esta parte, en la que tiene que ver con ocio hablamos de muchas cosas, pero principalmente, películas, series y libros.

Figura 1: Nubico: Una startup en España para leer muchos comics, libros y revistas

Como tiene Movistar+ - como ya os habréis imaginado y supuesto - comentamos las películas y las series que a ella le pueden gustar. Le encantó Arde Madrid porque le recuerda a una época que ella vivió, en una ciudad que ella pisoteó y la serie de Hierro con esa trama en la isla de Canarias. Le gustó mucho "Mientras dure la guerra" de Alejandro Amenabar y "Quién a hierro mata" que protagoniza Luis Tosar.

Ver al reparto completo de "The Big Bang Theory" de niños en el último capítulo de la temporada 2 de "El joven Sheldon" me ha sacado una lagrimillla }:_) La tienes en @MovistarPlus ¿Los reconoces? pic.twitter.com/kPQPri5h5c
— Chema Alonso (@chemaalonso) April 8, 2020

Además, hablamos de que pronto llegará "El Crack Cero" de mi querido José Luis Garci que como yo fui al estreno, le cuento que es muy buena y ya está esperando que la pongamos en catálogo. Durante el tiempo que le duró la serie de "La voz más alta" me la contaba diariamente, pero nos divertimos mucho comentando las aventuras de "El Joven Sheldon", que nos gusta mucho a los dos.

Figura 3: Libros de Eduardo Mendoza en el catálogo de Nubico Premium

Después hablamos de libros, ya que cuando comenzó todo este periodo vacié mis estanterías con algunos libros y le llevé una caja con libros de Carlos Ruíz Zafón, Arturo Pérez Reverte, Matilde Asensi, Juan Gómez Jurado, Julia Navarro o Eduardo Mendoza. Y me los comenta, me recomienda, me pregunta por mis libros de Star Wars, etcétera.

View this post on Instagram

Llamando a la mamita por FaceTime con mi Animoji maligno para hacerla reír un rato que le gusta cuando tuerzo el morrillo como ella y saco los colmillitos. ¿Has llamado a la tuya ya? Pues andando, llama a tus mayores ahora mismo. #llamaalamama
A post shared by Chema Alonso (@chemaalonso) on Apr 12, 2020 at 9:48am PDT

Son conversaciones para llenar media hora en la que hablamos de cosas para distraernos un poco de esa situación tan excepcional que estamos viviendo. Y que nos sirve para mantener una relación más cercana a pesar de no poder abrazarnos y recibir los achuchones de mi mami que tanto me gustan.

Figura 5: Libros de Carlos Ruiz Zafón en Nubico

Como mi madre, (la mía mamma!!) tiene mucho tiempo libre ahora, pues lee a mucha velocidad, y estaba repasando en mi estantería qué libros le podía llevar, o si podía comprarle alguno cuando me he acordado de una Startup con la que recordaba que habíamos hecho algo entre Telefónica y el Grupo Planeta: Nubico.

Figura 6: Con una suscripción tienes 60.000 libros en el catálogo gratis

Y cuál ha sido mi sorpresa al ver que tienen una suscripción a un catálogo ya de 60.000 libros. Nada más y nada menos. Yo los conocí tiempo atrás, cuando yo estaba comenzando con Talentum en Telefónica allá por el año 2012, y la verdad es que su catálogo entonces era mucho más reducido.

Figura 7: Libros de Juan Gómez Jurado en suscripción

Entre los libros que hay en la suscripción Premium a Nubico hay un catálogo más que inmenso para mantener a mi madre entretenida leyendo durante mucho tiempo, con libros para que mi madre pueda tener en su mano un catalogo mayor que el de la mayoría de las bibliotecas públicas.

Figura 8: Revistas del mes en Nubico

Además, también tiene más de 80 revistas que salen semanalmente - como El Jueves - o mensualmente como Muy Interesante, Computer Hoy, Motociclismo, Mi Casa, etcétera. Yo no soy muy de revistas, la verdad, pero a mí mamá si que le gusta repasarlas. Y vale, yo no desperdicio la ocasión de echarle un ojo a un Jueves (tengo más de mil guardados).

Figura 9: Nubico con 1 mes gratis para Movistar

Lo mejor es que para ella, el coste de la suscripción Premium a todo ese catálogo de Nubico es de 6,88 € al mes por que por ser cliente de Movistar tiene un mes extra gratis. Pero si no, son 7,45 € al mes. Así que nada, problema resuelto con los libros. A partir de hora mi mamá se pasa al tablet para leer. Se lo voy a preparar todo, que con la instalación de las apps y la configuración de las cuentas siempre se me lía un poco.

Figura 10: Cómics de Batman en la suscripción. No veo a mi madre con Batman.

A mí, personalmente, leer en digital me gusta, pero reconozco que tengo un puntito de coleccionista. Ya sabéis, de los que disfruta viendo sus "presas" en la estantería, sobre todo los que son colecciones como mis libros de Star Wars, o mis cómics ordenados por números. Pero no es para todo el mundo esto de acumular, y no todos los libros son igual de importantes para cada uno.

View this post on Instagram

Pues ahora que en Movistar Plus vamos a tener a partir del 24 de Marzo Disney+ con The Mandalorian, había pensado en releer alguno pasajes de la historia de Star Wars durante la cuarentena. Esta solo es la mitad, más o menos, de los libros, cómics, tiras de prensa, etc... que tengo de StarWats. Creo que es momento de ir a vivir unas aventurillas en una galaxia muy, muy lejana.... hace mucho, mucho tiempo. @movistarplus #starwars Nota: hay algo de Str Trek, sí, ¡que yo le pego a todo! Y en Netflix están los miembros del Enterprise! @netflixes
A post shared by Chema Alonso (@chemaalonso) on Mar 12, 2020 at 10:06pm PDT

Pero para la lectura de libros de actualidad, para las revistas que acaban muchas veces en la basura, perdidas o arrugaditas, o poder equivocarte al elegir un libro para leer, sin pensar para nada en la parte coleccionista, las bibliotecas digitales son un servicio que permite acceder a una cantidad ingente de cultura a un precio muy asequible.

Figura 12: Gratis 15 días - ideal para estas próximas dos semanas -

En la web de Nubico, si no eres cliente de Movistar, también tenéis un periodo de prueba gratis de 15 días, por lo que en este periodo de confinamiento es una oportunidad genial para que lo pruebes, y veas algunas de las revistas o libros que tiene en el catálogo. Que merece la pena. Tienes hasta Cómics de Batman, que para estos días puede ser una buena ocasión.

Saludos Malignos!

Autor: Chema Alonso (Contactar con Chema Alonso)