Penetration Testing on MYSQL (Port 3306)

In this article, we will learn to make MySQL port vulnerable and then secure it for the penetration testing on the port 3306. In order to completely learn and understand how to secure service on a port, you have to understand how to make it vulnerable and then perform penetration testing. Because if you don’t understand what can be exploited and how then you will always fail to secure it.

Table of Content

  • Introduction to MySQL-Server
  • Installation of MySQL-Server
  • Pen testing MySQL-Server

Introduction to MySQL-Server

The base of MySQL will be MySQL server, which handles the majority of the database guidelines (or directions). MySQL server is accessible as a different program for use in a customer server organized condition and as a library that can be implanted (or connected) into separate applications. MySQL works alongside a few utility projects which bolster the organization of MySQL databases. Directions are sent to MySQL-Server by means of the MySQL customer, which is introduced on a PC. It runs port 3306 by default.

Installation of MySQL-server

The first thing to do is to install MySQL server and to do so use the following command :

Further, use the following command to check whether the server is up and running or not.

Pentesting MySQL-Server

Scanning Mysql & Connecting to Mysql

Now, as you can see the MySQL server is properly working. But if you will scan the port, it will show you that it’s closed.

This port is closed because as it is running on the local address when scanned with any other IP then it will show you that the port is closed when this is not the case. This happens because of the default setting in the configuration’s files of MySQL, the bind address is 127.0.0.1 i.e. the port will be shown open only if you scan from this IP just like shown in the image below. And to make this change open the configuration file using the following command:

To change this setting, just add ‘#’ in front of the ‘bind-address’ as shown in the image below :

Now if you scan it, it will show you that the port is open.

But further if you try to login through this port, it will give you an error. This happens because the MySQL server does not grant privileges to other IP’s to do their bidding.

This error can be removed when you login into the MySQL server and run the following commands which will grant all permission to the root user at when login from different IP :

Now, when you try and login, you will be successful as shown in the image below:

Let’s scan the port again to grab as many details as we can such as its banner. Mac address, etc.

Mysql Brute-Force Attack

One can also brute force the port by using Metasploit. This module simply queries the MySQL instance for a specific user/pass for this, go to the terminal in kali and type ‘msfconsole’ and then use the following commands to commence the brute force login:

Running SQL queries without Login into Mysql

This module allows for simple SQL statements to be executed against a MySQL instance given the appropriate credentials. For this, type :

Extract Mysql-Schemadump Information

Our next module extracts the schema information from a MySQL DB server. For this exploit, type :

Extracting Login from Mysql-server

And to extracts the usernames and encrypted password hashes from a MySQL server and stores them for later cracking; use the following exploit :

Once the above module is completed, you see it result in the file it creates as shown in the image below:

Checking Writable Directories

Another attack that can be executed on Mysql port is to check the directories that are writable. But by default, this attack cannot be performed. So, admin, the has done following the configuration then an attacker can check for directories that are writable.

Then add at the end of the file.

Now if you run the following exploit through Metasploit, it will allow you to Enumerate writeable directories using the MySQL SELECT INTO DUMPFILE feature.

Enumerating File

For further pentesting MySQL port, you can use the following exploit for Enumerate files and directories using the MySQL load_file feature.

Port Transferring

Next comes port forwarding. This method is used in order to secure the port from the attacks. For port forwarding, just open the configuration by using the following command:

And then change the port number to whichever you desire. For instance, we have given here in 4033.

After changing the port, when you scan it, it will show you the SQL service is running on the new port instead of the default one.

So, this way to learn how to exploit and secure MySQL-Server.

AuthorYashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast. contact here

Beginner Guide to SQL Injection Boolean Based (Part 2)

Their so many ways to hack the database using SQL injection as we had seen in our previous tutorial Error based attack, login formed based attack and much more different type of attack in order to retrieve information from the inside database. In the same way today we will learn a new type of SQL injection attack known as Blind Boolean based attack.

An attacker always checks SQL injection vulnerability using a comma () inside URL  to break the statement in order to receive a SQL error message. It is a fight between the developer and attacker, the developer increases the security level and the attacker tries to break it. This time developer had blocked error message as the output on the website. Hence if the database is vulnerable to SQL injection then the attacker does not obtain any error message on the website. The attacker will try to confirm if the database is vulnerable to Blind SQL Injection by evaluating the results of various queries which return either TRUE or FALSE.

Let’s start!!

Using Dhakkan we will demonstrate blind SQL injection.

Lesson 8

Lesson 8 is regarding blind boolean based injection therefore first we need to explore http://localhost:81/sqli/Less-8/?id=1 on the browser, this will send the query into the database.

As output, it will display “you are in” the yellow colour text on the web page as shown in the given image.

When an attacker tries to break this query using a comma () http://localhost:81/sqli/Less-8/?id=1’

 Or other different technique he will not able to found an error message. Moreover, the yellow colour text will disappear if the attacker tries to inject invalid query which also shown in the given image.

Then attacker will go for blind SQL injection to make sure, that inject query must return an answer either true or false.

Now database test for given condition whether 1 is equal to 1 if the query is valid it returns TRUE, from the screenshot you can see we have got yellow colour text again “you are in”, which means our query is valid.

In the next query which checks for URL

Now it will test the given condition whether 1 is equal to 0 as we know 1 is not equal to 0 hence database answer as ‘FALSE’ query. From the screenshot, it confirms when yellow color text gets disappear again.

Hence it confirms that the web application is infected to blind SQL injection. Using true and false condition we are going to retrieve database information.

Length of database string

The following query will ask the length of the database string. For example, the name of the database is IGNITE which contains 6 alphabets so the length of string for database IGNITE is equal to 6.

Similarly, we will inject given below query which will ask whether the length of database string is equal to 1, in the response of that query it will answer by returning TRUE or FALSE through text “you are in”.

From given screenshot you can see again the text gets disappear which means it has return FALSE to reply NO the length of database string is not equal to 1

Again it will test the length of the database string is equal to 2; it has return FALSE to reply NO the length of database string is not equal to 2. Repeat the same step till we do not receive TRUE for string length 3/4/5/ and so on.

when I test for the string is equal to 8; it answers as true and as result yellow colour text “you are in” appears again.

As we know the computer does not understand the human language it can read the only binary language, therefore, we will use ASCII code. The ASCII code associates an integer value for all symbols in the character set, such as letters, digits, punctuation marks, special characters, and control characters.

For example look at following string ascii code:

1 = I = 73

2 = G = 71

3 = N = 78

4 = I = 73

5 = T = 84

6 = E = 69

Image Source:lookuptable.com

Further, we will enumerate the database name using ascii character for all 8 strings.

Next query will ask from database test the condition whether the first string of database name is greater than 100 using acsii substring.

It reflects TRUE condition hence if you match the ascii character you will observe that from 100 small alphabets string has been running till 172.

Similarly, it will test again whether the first letter is greater than 120. But this time it returns FALSE which means the first letter is greater than 100 and less than 120.

Now next it will equate first string from 101, again we got FALSE.

We had performed this test from 101 till 114 but receive FALSE every time.

Finally receive a TRUE reply at 115 which means the first string is equal to 115, where 115 =‘s’

Similarly, test for the second string, repeat above step by replacing the first string from second.

I received a TRUE reply at 101 which means the second string is equal to 101 and 101 = ‘e’.

Similarly, I had performed this for all eight strings and got the following result:

Given query will test the condition whether the length of string for the first table is equal to 6 or not.

In reply we receive TRUE and text “you are in” appears again on the web site.

Similarly I test for second and third table using same technique by replacing only table number in same query.

1 = s = 115

2 = e = 101

3 = c =99

4 = u =117

5 = r =114

6 = i = 105

7 = t = 116

8 = y = 121

Table string length

We have to use the same technique for enumerating information of the table from inside the database. Given query will test the condition whether the length of string for the first table is greater than 5 or not.

In reply we receive TRUE and text “you are in” appears again on the web site.

Given query will test the condition whether the length of string for the first table is greater than 6 or not.

In reply we receive FALSE and text “you are in” disappears again from the web site.

Given query will test the condition whether the length of string for the first table is equal to 6 or not.

In reply we receive TRUE and text “you are in” appears again on the web site.

Similarly, I test for the second and third table using the same technique by replacing only table number in the same query.

Similarly enumerating fourth table information using the following query to test the condition whether the length of string for the fourth table is equal to 5 or not.

In reply we receive TRUE and text “you are in” appears again on the web site.

As we had performed in database enumeration using ascii code similarly we are going to use the same technique to retrieve the table name.

Further, we will enumerate the 4th table name using ascii character for all 5 strings.

Next query will ask from the database to test the condition whether the first string of table name is greater than 115 using acsii substring.

It reflects TRUE condition text “you are in” appears again on the web site hence if you match the ascii character.

Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring.

But this time it returns FALSE which means the first letter is greater than 115 and less than 120.

Proceeding towards equating the string from ascii code between number 115 to 120. Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring.

It returns FALSE, text get disappear.

It returns TRUE, text gets to appear.

Similarly we had test remaining strings and received following result

1 = u = 117

2 = s = 115

3 = e = 101

4 = r = 114

5 = s = 115

User Name Enumeration

Using the same method we are going to enumerate length of string username from inside the table users

Given below query will test for string length is equal to 4 or not.

 It replies TRUE with help of yellow color text

 Using the same method we are going to enumerate username from inside the table users

Given below query will test for a first string using ascii code.

 We received FALSE which means the first string must be less than 100.

 We received TRUE which means the first string must be more than 50.

Similarly,

 We received TRUE which means the first string must be more than 60.

Similarly,

 We received FALSE which means the first string is less than 70.

Hence first string must lie between 60 and 70 of ascii code.

Proceeding towards comparing string from different ascii code using the following query.

This time successfully receive TRUE with appearing text “you are in”.

Similarly, I had tested for all four string in order to retrieve username:

1 = D = 68

2 = u = 117

3 = m = 109

4 = b = 98

Hence today we had learned how attacker hacked database using blind SQL injection.

!!Try yourself to retrieve the password for user dumb!!

Author: Aarti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

Database Penetration Testing using Sqlmap (Part 1)

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Features

  • Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix database management systems.
  • Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.
  • Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port, and database name.
  • Support to enumerate users, password hashes, privileges, roles, databases, tables, and columns.
  • Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
  • Support to dump database tables entirely, a range of entries or specific columns as per user’s choice. The user can also choose to dump only a range of characters from each column’s entry.
  • Support to search for specific database names, specific tables across all databases or specific columns across all databases’ tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns’ names contain a string like a name and pass.
  • Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
  • Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
  • Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user’s choice.
  • Support for database process’ user privilege escalation via Metasploit’sMeterpreter getsystem command.

These options can be used to enumerate the back-end database management system information, structure, and data contained in the tables.

Sometimes you visit such websites that let you select product item through their picture gallery if you observer its URL you will notice that product item is called through its product-ID numbers.

Let’s take an example

So when attacker visits such kind of website he always checks for SQL vulnerability inside web server for lunching SQL attack.

Let’s check how attacker verifies SQL vulnerability.

The attacker will try to break the query in order to order to get the error message, if he successfully received an error message then it confirms that web server is SQL injection affected.

 From the screenshot you can see we have received error message successfully now we have made SQL attack on a web server so that we can fetch database information.

Databases

 For database penetration testing we always choose SQLMAP, this tool is very helpful for beginners who are unable to retrieve database information manually or unaware of SQL injection techniques.

Open the terminal in your Kali Linux and type following command which start SQL injection attack on the targeted website.  

 -u:  target URL

–dbs: fetch database name

–batch: This will leave sqlmap to go with default behavior whenever user’s input would be required

Here from the given screenshot, you can see we have successfully retrieve database name “acuart

Tables

As we know a database is a set of record which consist of multiple tables inside it therefore now use another command in order to fetch entire table names from inside the database system.

 -D: DBMS database to enumerate (fetched database name)

–tables: enumerate DBMS database table

As a result, given in screenshot, we have enumerated entire table name of the database system. There are 8 tables inside the database “acuart” as following:

T1: artists

T2: carts

T3: categ

T4: featured

T5: guestbook

T6: pictures

T7: products

T8: users

Columns

Now further we will try to enumerate the column name of the desired table. Since we know there is a users table inside the database acuart and we want to know all column names of users table, therefore, we will generate another command for column captions enumeration.

-T: DBMS table to enumerate (fetched table name)

–columns: enumerate DBMS database columns

Get data from a table

Slowly and gradually we have penetrated many details of the database but last and most important step is to retrieve information from inside the columns of a table. Hence, at last, we will generate a command which will dump information of users table.

–dump: dump all information of DBMS database

Here from the given screenshot, you can see it has to dump entire information of table users, mainly users table contains login credential of other users. You can use these credential for login into the server on behalf of other users.

Dump All

The last command is the most powerful command in sqlmap which will save your time in database penetration testing; this command will perform all the above functions at once and dump entire database information including table names, column and etc.

This will give you all information at once which contains database name as well as table’s records.

Try it yourself!!!

Author: Aarti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here