Ethical Hacking and Penetration Testing Guide

370
◾ 
Ethical Hacking and Penetration Testing Guide
Command
./sqlmap.py –u http://localhost/?support=yes --os-shell
This screenshot shows the output of the “
id
” and “
cat/etc/passwd
” commands executed 
via 
os-shell
.
OS-PWN
OS Pwn switch of sqlmap allows the attacker to spawn Metasploit’s meterpreter shell or a normal 
command shell on the database server, assuming that the webserver and the DB server are the 
same. The attacker can issue commands and compromise the webserver too. The shell can be either 
a bind 
meterpreter Shell
or a 
Reverse Meterpreter
command.
Command
./sqlmap.py –u http://localhost/?support=yes --os-pwn
Depending on the scenario, sqlmap will ask for webserver document root to upload an 
intermediate stager on the remote server. This great tool supports PHP, JSP, ASP, etc. Sqlmap 
provides various options to guess the document root, if not supplied by the attacker. It will 

---

Web Hacking
◾ 
371
brute-force directories and search common locations (default locations) to upload its intermedi-
ate stager.
As we can see, we have successfully managed to get meterpreter shell via sqlmap.
XSS (Cross-Site Scripting)
XSS is one of my favorite subjects in web application security. It has been a problem for more than 
a decade, and still is. XSS is an input validation issue just like SQL injection. XSS occurs when the 
user input is not properly filtered or sanitized before it’s reflected back to the user.
This allows the attacker to inject malicious code, which is later executed in the context of a 
victim’s browser. XSS vulnerability can be used to carry out various attacks such as stealing session 
cookies and even compromising browsers. We will discuss this later.