[MUSIC]
Hello everyone.
Today we're going to have a look at WebGoat's SQL injection vulnerability.
Now as you can see here, I am using Firefox
to access the WebGoat login page.
And for myself, I'm using the defaults for WebGoat.
It defaults to local host port 8080 as how
you would access WebGoat when you start up the WebGoat server.
So I'm going to go ahead and log in to WebGoat.
Now, we are going to go into Injection Flaws > Numeric SQL Injection.
Now in this lab, The scenario
is that you can select your local weather station through these controls and
I've got here, it's set up for myself as Columbia.
And when you click on this Go button,
it shows you the results that you were expecting.
And you can choose a different city and have the information for
that particular city setup, shown for you.
Now when you look at the request traffic that Burp Suite intercepts,
we can see something very interesting.
So if you go into Burp Suite and go into the proxy tab and
click on the Intercept sub tab you'll see that the intercept is off.
So let's click that on, and now what will
happen is every time the client side,
which is the browser, makes a request to the server,
Burp will be able to see it first before
it ends up getting sent to the server.
So to show you how that works,
I'll click on Go to make a request to the server.
Now as you can see here,
intercept is on and it sees that
this information is captured.
So I'll click on Forward and this forward button
allows the request to get sent to the server, okay?
So as you can see, our web client made
a post request to the path WebGoat/attack.
And you can see here the post
parameter station is set to 101.
And that corresponds to the local
weather station in numerical form.
So what we're going to do is forward that request again.
Forward that request again,
keep going until you have no more ability
to forward any requests to the server.
So the station is 101 and it corresponds to Colombia.
Now let's turn off intercept, so intercept is off.
So Burp won't be able to,
Intercept client request before it gets sent out to the server.
So that's fine.
What I am going to show you now is to show you the source for
this functionality of choosing the local web station.
So if you look at the source and you scroll all the way,
you'll find that the query is generated in this manner,
and they've concatenated the station value here.
So that can kind of give you a hint of what to do or
how to start playing around with it.
The goal here is to, from one request,
try to show all of the results of all the local weather stations.
So we want this select statement to be true for all cases.
So in order for that to happen,
what we could try is this.
We'll send a request or rather first we have to turn on
intercept in Burp Suite, and then send the request over.
And here we have the ability to modify the request
data from the client before it gets sent to the server.
So what we will do is we will say,
one to one is fine, but we will say or
one equals one is something that we can say.
So it will end up making these select queries
such that it will select station 101
as a station, and then it will append or
one equals one which is always true.
So what we're going to do now is we're going to
forward this modified request over to the server.
So we're going to forward, all right, so here we see we have,
Performed a very simple SQL injection vulnerability.