Attacking Internet-Facing Web Applications – SQL Injection and Cross-Site Scripting (XSS) on WordPress

“In battle, there are not more than two methods of attack - the direct and the indirect; yet these two in combination give rise to an endless series of maneuvers.”

Sunzi and Giles [1]

Welcome to the fourth chapter, where we analyze SQL injections focusing on WordPress, the king of internet-facing web applications, starting from static analysis.

In the previous scenario, we looked for issues related to protocol implementations, thus studying the protocol and looking for weak implementations. This chapter will focus on source code analysis and how to use it to discover vulnerabilities.

We will rely on WordPress – which we already met in Chapter 1 – the well-known Content Management System (CMS), which has about a 43% market share of all websites at the time of writing.

The important aspect of WordPress is that it and its plugins and...

Technical requirements

You can use the Ubuntu LTS machine that we configured in Chapter 2. In addition, we will use Microsoft Visual Studio Code to read the sources and write the exploit, but feel free to use any other text editor of your choice.

Scenario files

To reproduce the scenario in this chapter, you can use the files in the Chapter04 directory in the book's repository.

The scenario comprises three Docker machines: one WordPress, one database, and another WordPress CLI we will use to configure the environment.

WordPress scenario introduction

In this scenario, we have a typical internet-facing web application based on a well-known CMS: WordPress. To make a real-world scenario, we looked at some WordPress plugins and found some interesting vulnerabilities.

We chose a niche plugin called wp-shoutbox-live-chat [2], version 1.4.2, which generates a shoutbox on the site. It reminded us of the early years of the web when it was a rarity to write while being able to interact synchronously with other site users (and all before the advent of WebSocket).

It’s an interesting case study on SQL injection, how to find it through source code analysis, and how to approach this vulnerability in applications that use a specific framework.

As we delved deeper into the plugin, we encountered another vulnerability – XSS. While not the primary focus of this chapter, we’ve decided to include it as a spoiler ahead ofthe more in-depth explanation in Chapter 6.

At the time of writing...

How does SQL injection work?

SQL injection (or SQLi) is a vulnerability that allows arbitrary SQL code to be inserted to read, modify, or delete data and interact with the application’s underlying database.

SQL injection works by exploiting the way user input is used in functions that connect to a SQL database by directly concatenating or chaining user input to the SQL statement or using the input as part of a parameter in a prepared statement. If we manage to alter the query semantics to make the database do something unintended such as read, modify, or delete different data or execute commands, we have SQL injection.

SQL injection types

As defined in the OWASP Web Security Testing Guide in Testing for SQL Injection [9], we can consider three classes of SQL injection according to the type of channel used to get some output:

• In-band: We receive our output directly into the web application
• Out-of-band: We receive our output on a different channel (e.g., email...

How to discover and exploit SQL injection vulnerabilities

In this section, we will begin our understanding of what is installed on the website, analyze WordPress by studying its source code and documentation, and then use dynamic analysis to confirm and exploit the vulnerability.

We will then identify an XSS vulnerability and provide a broad overview of the other potential vulnerabilities we can discover.

Information gathering and threat modeling

When we encounter a new application or website, we need to gather information and understand what kinds of attacks we can make.

The simplest but a particularly effective way is to examine the HTML code and review the HTTP headers to understand its nature.

We already looked at the structure of WordPress in Chapter 1. Let’s take a look at the meta tag generator using curl:

$ curl -kis  http://localhost | grep generator
<meta name="generator" content="WordPress 6.1.1" />

It’...

Summary

This chapter taught us the importance of analyzing source code in finding SQL injection vulnerabilities. We saw how SQL injection works and explored the common types and techniques of SQL injection. We then learned how to exploit SQL injection and XSS with Burp and Python.

The next chapter is focused on the Internet of Things (IoT).

Further reading

This chapter covered many topics. If you like to go deeper, we’re happy to share with you some valuable resources:

• [1] Sunzi and Giles, L. (2017). The art of war. New York, New York: Race Point Publishing.
• [2] WordPress.org. (n.d.). Steveas WP Live Chat Shoutbox. [online] Available at: https://wordpress.org/plugins/wp-shoutbox-live-chat/.
• [3] attack.mitre.org. (2018). Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®. [online] Available at https://attack.mitre.org/tactics/TA0001/.
• [4] Freeman, M. (2013). Department of Labor Watering Hole Attack Confirmed to be 0-Day with Possible Advanced Reconnaissance Capabilities. [online] Cisco Blogs. Available at https://blogs.cisco.com/security/department-of-labor-watering-hole-attack-confirmed-to-be-0-day-with-possible-advanced-reconnaissance-capabilities.
• [5] attack.mitre.org. (n.d.). Exfiltration, Tactic TA0010 - Enterprise | MITRE ATT&CK®. [online] Available at https...