The document discusses SQL injection and how to use the Damn Vulnerable Web Application (DVWA) project to practice security skills. It defines SQL injection as executing SQL statements through user inputs to extract information from or attack databases. The document demonstrates how an attacker can use SQL injection to retrieve all user passwords by passing a malicious SQL statement through the username field. It then introduces the DVWA project as a legal environment for security professionals and developers to test their skills and understanding of securing web applications by introducing vulnerabilities. The document concludes by summarizing what was learned about SQL injection and how to use DVWA for skills development.

1. The Hashemite University
Prince Al-Hussein Bin Abdullah II Faculty for
Information Technology
Sql Injection with Yusuf Ali
Network Security
By
Dr. Ashraf Aljammal

2. What we will learn ?
4)Howtousedvwatodevelopourskills?
3)Whatisdvwaproject.
2)HowtoattackusingSQLinjection?
1)WhatisSQLInjection.

3. Sql Injection

4. How to hack a website using Sql injection ?

5. The Vulnerable is execution of inputs without scan it.
Inputs like username maybe a sql statement!
Which executed at Database of server by Hackers.
1) Normal password : karcobia
$sql = “select * from users where pass=$password”;
2) Attacker's password : abc. or 1=1
$sql = “select * from users where pass=$password”.or 1=1;

6. As we can see here we got all users and
passwords in the Database!

7. Hacker can execute any sql statement like
Admin privileges!
Result

8. dvwa Project
http://www.dvwa.co.uk/
Damn Vulnerable Web App (DVWA) is a PHP/MySQL
web application that is damn vulnerable. Its main goals
are to be an aid for security professionals to test their
skills and tools in a legal environment, It also helps web
developers better understand the process of securing
server and web app or can also be use to teach students
ethical hacking and pretesting.
- See more at:
http://www.hackw0rm.net/2013/02/how-to-create-
penentration-lab-in.html#sthash.AXAhpGPY.dpuf

9. Let’s Try it!

10. SQL Injection
Gather information of database :
1 ) Version of Database
2 ) User of Database
3 ) Database name
4 ) Tables in Schema information
5 ) mysql Table information
6 ) Users and Passwords
7 ) Decrypt Hash Passwords

11. How to ensure that your password
hash in not in the MD5 huge
databases?

12. What we learned ?
What is Sql Injection.
How to attack using sql injection?
What is dvwa project.
How to use dvwa to develop your
skills?

14. Thank you for your time and
attention!
Contact info:
Email: Yusuf.alquran@gmail.com
Twitter: @YusufAmro
Junior GIS Web and Mobile Application Developer
JoGulf Spatial Data Systems