---
# System prepended metadata

title: BWAPP

---

BWAPP

 <h2>
    **1. SQLi (User login form)**
</h2>
![](https://hackmd.io/_uploads/B11KxXX-a.png)

a. The first step we take to try and check for sql injection vulnerabilities will be to use special characters when we submit the form to check for sql errors or how the application will react. In this case we test with " ' ".

![](https://hackmd.io/_uploads/Hkx9ZmQZT.png)


b. After this simple test, we notice a sql error, this means we can write sql statements and it will be excecuted on the server. We can use this to our advantage to try and extract the whole database. This can be accomplished either writing out the sql statements or by using a tool that will try tons of differenet statements; in this case sqlmap is the tool of choice.

c. To utilize sqlmap for this attack we must first get some information to pass as parameters for the tool. We are looking for the cookie and how the data is used in POST. For this we use burpe suite to intercept web traffic when we try to login (Burpsuite proxy).

![](https://hackmd.io/_uploads/ByV6gGm-a.png)

d. Now that we know some information about how the login completes its POST and we have the session cookie, we can proceed to use sqlmap. We create our payload using the information extracted from burp suite.
"sudo sqlmap -u "https://localhost:8885/sqli_16.php" --cookie="PHPSESSID=q3th2qftlcacdn3tq97g1639o6; security_level=0" --data="login=test&password=test&form=submit" -dump"

f. Once we run the tool we can use the parameter -dump to extract all the tables and the parameter -output to store them in a specified route.
Users table:
![](https://hackmd.io/_uploads/H1pfTzQWp.png)

<h2>
 Html Injection - Reflected (GET)   
</h2>
a. First we test the get form to learn a bit of its behaviour. We notice the parameters for first and last name are included in the link when we submit the form. the First and last name is retrieved from the link and included in a welcome message. This can mean improper use of parameters and how it is handled from the URL.

Before search:
![](https://hackmd.io/_uploads/BynLFQQZT.png)
![](https://hackmd.io/_uploads/SkCDF77-6.png)


After search:
![](https://hackmd.io/_uploads/BkSFYXQWT.png)
![](https://hackmd.io/_uploads/r14qtXXW6.png)

b. Once we identify that the parameters are being read, echoed and possibly has no process to clean the input (making it vulnerable) we can try and add html code to test. In this case we are using a "`<h2>`" tag as a value for the first name. This can be inserted in either the form or directly to the URL.

![](https://hackmd.io/_uploads/Sku99m7Z6.png)

![](https://hackmd.io/_uploads/Byc25m7Z6.png)

c. We notice our tag was read and the code excecuted in the page (generating the html element that reads "Soy vulnerable"). This can be further exploited to excecute any code in the page. An example of a more elaborate attack would be to change or add a login button that will send the user to either a fake page or even possibly steal the credentials that were input. Other possible attack include adding a malicious script in the url that when open can steal sensitive information.