For this lab you’ll need

• A Kali VM with a LAMP stack installed.

apt install apache2 -y
apt install php mariadb-server libapache2-mod-php php-mysql  -y
systemctl restart apache2
systemctl enable apache2

In this lab, we will:

• Create a simple PHP server that allows an end user to:
  • Log in using a username/password stored in a MySQL database.
• We’ll exploit the application manually.
• We’ll automate the process with SQLMap
• We’ll implement input sanitization to protect against the attack.

If you pay attention to IPPSEC’s methodology when he approaches web applications on HackTheBox, you’ll find that one of the earliest checks he performs on user-controlled webpage forms is whether SQL error messages can be generated.

• If user input submitted to a back-end database throws an error, he’ll try to exploit that condition to pull information from the database that would otherwise be protected.
  • Often, this results in username/password disclosure.

If you are comfortable with the processes demonstrated in this lab, you should be able to eyeball any pertinent questions on the Security+ exam related to SQL injection or the sqlmap program.

If you already have content in /var/www/html, let’s clear it out.

cd /var/www/html
mkdir old
mv * old/ 

Let’s start with a simple login form. Create a webpage in /var/www/html called login.html and paste the following:

pico login.html

<form method="post" action="action.php">
Your Username:
<br>
<input type="text" name="username">
<br>
Your Password:
<br>
<input type="text" name="password">
<br>
<input type="submit" value="Submit">
<br>

Here, we have a form that allows the user to type a username/password (both visible in plaintext), and it submits the information via a POST request to action.php.

We’ll access this page on localhost

• (http://localhost/login.html)