TIMING ATTACK SQL Injection: Python Web Hacking | Natas: OverTheWire (Level 17)

Key Takeaways

What's up everybody? Welcome back to another YouTube video. My name is John Hammond and this video we're looking at level 17 of the Natis war game from Over the Wire. So on the tales of level 16, we just got the password for level 17. So let's run the script to check out what this web page is and what we're actually working with here. Um here we have the form that we've seen before just for logging in. It looks like we're given a username input field. Um and the button will check existence. So, kind of the same SQL injection attack we've seen before, but maybe there's something different. So, let's actually take a look at the source code and let's see what they're doing here. Just copy that link to the index source. And again, we'll have to deantitize this and we can remove all those break tags because we don't need those. All right. So, we have the same schema as we've seen before, just a users table with username and password. Have the same test if we're actually posted to the page in the PHP code. and we run the same query. Looks like we have the same SQL injection attack vector because they're just concatenating in the username. Um, but it's commented out the output as to whether or not it got a result. So, no longer can we determine, okay, a yes or no binary dichotomy thing. Does this user exist? Does this user not exist? So, we can't use that for our typical blind SQL attack. um we won't be able to determine via that yes or no, one or zero, do we have the correct character and what we're trying to leak out. So, we have to go for a different attack. And this will be pretty neat. This is one of I think one of the coolest things that you can do with with SQL. Um but let's go ahead and start to post to this web page and see what we can do. We want to change our method to post. Same URL. um data will be username that's the variable that we've got to work with in HTTP and we'll say subscribe blah blah blah post run this no output just like um it told us but we know we have our SQL injection so if I were to change these to single quotes and the original quote the double quote that they're using in that SQL statement we can or one equals 1 and throw a comment in there. Run this. And looks like we're getting no real output. But we can do some other interesting things. We can actually because we have that SQL injection, we can run SQL commands and SQL functions and do SQL things. Let's actually try and sleep for a certain amount of time. So this function will do exactly as it says. It will wait or sleep a certain amount of seconds that we pass in here as a number. And it will actually operate because we're using that and function. So if something returns and we get this sleep function which will return one if it succeeds or it'll it'll return successful. But the and will mean it will execute if the user that we're checking for according to the application code exists. So let's try this. If I hit controlB to run it, it returns immediately because obviously the user subscribe does not exist. But if I change this to natus 718, natus 18 is the next password that we want. If I hit the go button here, the build output, there's no response for at least 5 seconds because we've ended that sleep function. So this gives us the building blocks for a timing attack for timebased SQL injection because we can actually leak out the password, right? We can say where um password Uh I want to we actually don't want to use the wear clause because it's already being used for that wear username. So we can just say and password is like and use the same methodology that we've been using before. Um, so add in what we've seen of a scene password join of scene password because we'll keep track of that in a list and a character that we iterate through. Don't forget our percent sign here so we get the wild card and we'll let's change the sleep to two. So let's get that uh character pool that we want to work with. So let's say characters can equal let's get everything from the string module. So we can use lowercase, uppercase and digits as we've seen before. Sorry for this duplicate code here guys. But now we'll do a while loop or actually we'll do a scene password again to determine the length length of scene password is less than 32 because we know that was the length for it. We'll say for character in characters try and get this response here and let's actually just print trying and let's get what we're looking for. Cool. We don't need the plus there. We don't have to print that out. But I'm going to do this in the command line. Let's change that preference so it looks Let's run that Python nata 17 script. And I forgot my colon. My bad. Okay. So now we're going to start to iterate trying all these characters. But X, we hang a little bit. And we got to test if we actually got a hit. If it slept for 2 seconds or if there is a real difference in the time between one execution and the next then we know we've got the correct character because that and password like successfully executed and then sleep will successfully execute. So let's change this and let's start to get a time to determine how long this code takes to run. Let's import time. Let's actually do from time import all. So, we can just use the time function real easy. So, for every character we're looking at, we're going to try and send it. And then we'll determine what the time currently is. Start time. We can just do that for debugging purposes. And then we can say end time can be the new time after we've already made that request. And let's say the difference can equal end time minus start time. So we can get an idea of how long that took. difference. Now, we can print these things out. And while we're watching it, difference is maybe 2010 of a second. But I'll scroll up here. Once we got to X, we could tell the difference took more than a second because we slept for that second there. Um, you might have different values on this depending on how your internet connection is because we're literally timing how long this request takes and that sleep function, whatever integer amount of seconds you pass into the sleep function in SQL, obviously that will vary. So, if I were to run this with two, you'll see a different difference because now you're sleeping for two seconds. But since you're going to automate this and weaponize it to actually leak out the password, you want to do something that will give you relatively quick speed, but still let you be able to determine what is the threshold for this actually being a successful hit. So we can say if the difference is greater than one, then we know we actually have a successful hit. That's the correct character that we've seen in that position of the password. So, let's add that to our scene password and break out of this for loop so we can keep moving. Scene password.append character we're looking at in the loop and then let's break. Cool. We don't need this uh start time notice anymore. Now, let's start to loop. What did I do wrong? Uh, I think that was happening because nothing was buffering this output here. Now, let's try this. If we actually have that print statement, it'll tell us the trying and it will determine that X is the correct password. Okay, cool. So, now we have an attack. Looks like we're leaking out the password, but we forgot the binary uh notion in the password here. So, we may be missing capital letters. Let's make sure we include and binary password like so we get case sensitivity when we leak out that field in the database. Now, we can let this script run and by the end of it, we'll have the password for Natis 18. All right, I'll let this run and I'll see you in a little bit. So, it looks like the script did finish and we have a potential password. Uh, let's head back to the original script and save it as a new one. Natis 18. Um, paste the password in here, change the username, and let's see if we can just get that page. See if we got the correct password, and we're ready to move on. Let's controlB run this. And here we are. Natis level 18. Sweet. So we did it. That was the successful loop and pretty much a good Python attack for actually implementing a timingbased SQL injection uh exploit if you want to call it that. Um and I think that's super cool. SQL Map does some stuff with that. If you haven't seen that tool, totally check it out. Um but I like to consider that methodology pretty good for a timing attack. And you'll see those in a lot of capture the flag competitions. And when you don't have explicit SQL injection and you can't get a result easily to determine your blind SQL injection, you can still leak out pieces of the database just by taking a little bit of time using a loop like this. Um, and you can just run with a while true if you don't have this criteria about what you're leaking out about its length or whatever. You can just run forever and once your loop starts to act weird and gives you like random bites, you know. Okay, I pretty much reached the end. So that's it. That's how we can do a timing attack and timebased SQL injection in Python and some web hacking. Thank you guys so much for watching. Uh if you do like the video, please click that like button. Uh please let me know what else you're thinking, what else you'd like to see, what else I could do better with in a comment if you're willing to subscribe. And if Thank you so much. I'll see you another video.