Skip to content

PHP website that is vulnerable to SQL Injection allowing Remote Code Execution

Notifications You must be signed in to change notification settings

braydenNP/Vulnerable-Website-with-SQL

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

ctrl shift v to preview turn off double click to exit preview in visual studio code: File > Preferences > Settings > double click to...

Optional: Clear any existing website

sudo rm /var/www/html/*.php
sudo rm /var/www/html/*
sudo systemctl stop apache2

1. Install and start nginx

sudo apt install nginx
sudo systemctl start nginx
sudo systemctl enable nginx

2. Install PHP and PHP-FPM

sudo apt install php php-fpm php-mysql

3. Install MYSQL

sudo apt install mysql-server

4. Secure the MySQL installation

sudo mysql_secure_installation

simply click 'enter' or skip every prompt

5. Configure Nginx to use PHP

sudo nano /etc/nginx/sites-available/default
nginx
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        root /var/www/html;
        index index.php index.html index.htm index.nginx-debian.html;
        *add in index.php above ^*
        server_name _;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
            include snippets/fastcgi-php.conf; 
            *uncomment this line*
            fastcgi_pass unix:/var/run/php/php8.1-fpm.sock; 
            *^uncomment this line, 8.1 should be the version of ur php, run php -v to check*
        }
    }
    

6. Reload nginx

sudo nginx -t
sudo systemctl reload nginx

7. Set up SQL

sudo mysql -u root -p

enter the below 3 queries:

CREATE DATABASE testdb;
USE testdb;
CREATE TABLE products (
        id INT AUTO_INCREMENT PRIMARY KEY,
        description TEXT
    );

7.1 Set up SQL user 'phpuser'

CREATE USER 'phpuser'@'localhost' IDENTIFIED WITH mysql_native_password BY '';
GRANT ALL PRIVILEGES ON testdb.* TO 'phpuser'@'localhost';
GRANT FILE ON *.* TO 'phpuser'@'localhost';
FLUSH PRIVILEGES;

7.2 Clear SQL table

TRUNCATE TABLE products;

8 DISABLE APP ARMOR for sql

sudo apt-get install apparmor-utils
sudo aa-complain /etc/apparmor.d/usr.sbin.mysqld

9 Set permissions of /var/www/html

sudo chown -R "student":www-data /var/www/html
sudo chmod -R 777 /var/www/html
sudo chmod g+s /var/www/html

10 disable secure_file_priv

sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf
secure-file-priv = /var/www/html
sudo systemctl restart mysql
sudo mysql -u root -p

check that it worked

SHOW VARIABLES LIKE 'secure_file_priv'; 

LAST STEP: Add the files to /var/www/html

sudo nano /var/www/html/additem.html
sudo nano /var/www/html/additem.php
sudo nano /var/www/html/viewitem.html
sudo nano /var/www/html/viewitem.php

Paste the 4 scripts into their respective location

About

PHP website that is vulnerable to SQL Injection allowing Remote Code Execution

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published