In this tutorial, we will be going to set up a Lab Environment to test our skills in the path of SQL injection. The lab we are going to set up here is SQLi-labs.
SQLi-Labs was created by a security researcher named Audi-1. SQLi Labs is a collection of PHP files and a script to populate several get and post scenarios, they are been listed in this tree.
.png)
The main purpose of this lab is to hone our SQL injection skills both manually and automatically. Let’s have a look at its installation step.
Setting Up on Windows VM
You can easily set it up on any platform. But I suggest you, never try to install it on your native system, install it within Virtual Box.
If you have previously tried to set up this lab and got this error, it means the running PHP server might be 7.0 or higher.
.png)
So, our first priority is to download the proper version of the Apache server which supports PHP 5.0.
Firstly, I have to uninstall the latest XAMPP server.
.png)
Now, we have to download the old build XAMPP server from below link:
Once the old build is downloaded, install it.
.png)
This process is quite similar to the previous installation steps. So keep waiting till the installation is finished:
.png)
Once the installation is finished, click on Finish to launch the XAMPP control Panel:
.png)
XAMPP control panel is launched. Now, we have to add the SQLi-labs-master.zip file to C:\xampp\htdocs\.
- Download the sqli-labs-master.zip file from the below GitHub Link.
- Once downloaded, move the downloaded file to C:\xampp\htdocs\ and extract it.
.png)
Now go back to XAMPP Control and Start Apache Server and MySQL server.
.png)
Let’s go back to the browser and access its content by navigating the following URL on your browser.
.png)
Now our first priority is to set up the Database. Click on Setup/Reset Database
.png)
As you can notice the database was created.
.png)
Now, we are ready to test the SQL Injection attack.
If you want to access it from any other Virtual Machine i.e. Kali Linux, then first you have to identify your IP address using the command prompt. Before that Always remember to check whether the Attack machine and Attacker Machine are connected to the same Network:
Here I am using a Host-only Adapter on both sides:
.png)
Now run the following command to identify the IP address of the Attacker Machine (Windows PC).
The IP address is 192.168.56.108. Just navigate it through the browser.
.png)
- If you got any connection error, then check whether your network adapter might not the same.
As you can notice, we have successfully accessed SQLi-labs from our Kali Linux machine.
Setting Up on Linux
The steps are similar to those previously used in Windows. Instead of Windows, download XAMPP 5.6.39 for Linux.
Once downloaded, install it.
Once the installer command is executed it will automatically start the installation process graphically:
.png)
Once the installation is complete, start Apache and MySQL services.
.png)
The rest steps are the same as Windows. So try them in your own way.
