SQL Injection (SQLi) Assessment

Introduction

SQL Injection is a web application vulnerability that occurs when user input is inserted directly into SQL queries without proper sanitization or validation. Attackers exploit this weakness by injecting malicious SQL commands into input fields. Successful exploitation can allow attackers to bypass authentication, retrieve confidential information, modify databases, or completely compromise the application.

Objective

The objective of this assessment was to identify whether DVWA was vulnerable to SQL Injection attacks and determine the potential impact of exploitation.

Target Information

• Target Application: DVWA
• Target URL: [http://192.168.56.105/dvwa](http://192.168.56.105/dvwa)
• Vulnerability Module: SQL Injection
• Security Level: Low

Tools Used

• Web Browser
• Parrot OS
• DVWA Application

Payload Used

Screenshot

Methodology

1. Accessed the SQL Injection module in DVWA.
2. Located the vulnerable input field.
3. Inserted the SQL Injection payload into the parameter.
4. Submitted the request to the application.
5. Observed the response generated by the server.

Observation

The application returned multiple user records after the payload was submitted. Authentication restrictions were bypassed successfully.

Evidence

• User information became visible in the browser.
• Multiple usernames and surnames were displayed.
• Authentication bypass was achieved.

Explanation

The application directly inserted user input into SQL queries without sanitization. The payload manipulated the SQL logic and forced the database query to always evaluate as true.

Impact

• Unauthorized access
• Database information disclosure
• Authentication bypass
• Full database compromise
• Possible privilege escalation

Recommendations

• Use prepared statements
• Implement parameterized queries
• Sanitize and validate user input
• Apply least privilege to database accounts
• Disable verbose database error messages

Conclusion

The DVWA application was vulnerable to SQL Injection attacks. The vulnerability could allow attackers to access sensitive information and fully compromise the database system.