Installing XAMPP and DVWA on BackTrack 5r3

What is DVWA? Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

A step by step guide on how to install XAMPP and DVWA on BackTrack Linux. 

Before we begin, download the following:

> Xampp for Linux: http://www.apachefriends.org/en/xampp-linux.html#374

> DVWA: http://sourceforge.net/projects/dvwa/

Once downloaded, put it into a folder in this case i created a folder in the Desktop called Tools. Then cd into the folder.

1. Provide write/modify access to the file

#chmod a+x xampp-linux-1.8.2-0-installer.run

2. Run the installation

#./xampp-linux-1.8.2-0-installer.run

Click Next 

And Finish once done

A default XAMPP website will launch. Close the browser.

Start the XAMPP services

#/opt/lampp/lampp start

Open up your browser and type in http://localhost/ . You will see the XAMPP page

We are done for XAMPP. Now let's proceed to do the DVWA

Unzip the file

#unzip DVWA-1.0.7.zip

Move the folder to /opt/lampp/htdocs

On your browser, type in http://localhost/dvwa

Click on 'here' to create the database

Database created

Go back to the http://localhost/dvwa and enter the default credentials

username: admin

password: password

And we have installed DVWA and XAMPP on LINUX

NOW YOU HAVE MY PERMISSION TO HACK!!!!!!!!!!!

MSSQL Enumeration - Using Open Source/Freeware Tools

In this article, we will demonstrate on how to find available M$ SQL servers within a network range and enumerate or get information about them.

Using Metasploit

msf > use auxiliary/scanner/mssql/mssql_ping

msf auxiliary(mssql_ping) > set RHOSTS <IP Address/range>

msf auxiliary(mssql_ping) > set THREADS 10

msf auxiliary(mssql_ping) > run

Website: http://www.metasploit.com/modules/auxiliary/scanner/mssql/mssql_ping

Using Nessus Cmd

#nessuscmd -i 10674 <IP range> --max-hosts 25

Website: http://pauldotcom.com/2009/11/attacking-mssql-with-metasploi.html

Using Nmap

#nmap -p 1434 --script ms-sql-info --script-args mssql.instance-port=1434 <IP range>

Using SQLRecon

Result of the Scan

SQLRecon: http://www.4shared.com/get/VmkLFFCW/SQLRecon_Setup.html

Website: http://www.specialopssecurity.com/labs/sqlrecon/

Using SQL Ping v3

SQL Ping v3 and SQL Recon has the same interface. The difference is that SQL Ping v3 has additional option for Brute Forcing Passwords with the ability to input the User and Password list.

Result of the Scan

Website: http://www.sqlsecurity.com/downloads

I will find more tools that can be used to gather information for SQL servers and will list them down here in future. If there's anything out there you readers are aware of, do share!