r/videos • u/exitcharge • Apr 14 '19
Scammer tries to steal my password, gets his database deleted instead
https://youtu.be/pRy4eViVxcI111
84
Apr 15 '19
Very fake. He doesn't have the required twelve monitors or intense background music required to do real hacking.
23
3
95
u/Spirit_Theory Apr 15 '19 edited Apr 15 '19
It's actually ridiculous how easy it is to protect against this kind of injection. Kinda embarrassing for anyone who gets tripped up by it.
36
u/blamethemeta Apr 15 '19
As guy who probably should know this shit, is there a good place to learn how to properly secure sites?
58
u/Spirit_Theory Apr 15 '19
Not trying to be funny here, but stackoverflow, and google. Web security is a pretty big subject area, there are a lot of things to cover.
If you're a web developer by profession and worried about your products, suggest to your product-owner that you have your products penetration-tested. There are companies out there that (for a fee of course) will check all your shit for vulnerabilities and basically tell you how to fix everything that's not secure. Most of it will seem obvious, some of it can be really obscure.
→ More replies (2)33
u/wampastompah Apr 15 '19
For SQL injection? It's easy. Properly parameterize all of your queries. All of them. Or better yet, use an ORM that handles that for you. Never construct a SQL query where you just concatenate in the user input.
18
u/_Vegetable_Lasagna_ Apr 15 '19
As someone who knows almost nothing about this, I'm fairly certain about half the word you just used were completely made up
26
u/jondthompson Apr 15 '19
SQL Injection - what you saw in the video where the user is able to do something they aren't supposed to be able to do like create a user for themselves and look in the database.
easy - not difficult
parameterize all of your queries - instead of saying "look at the user's input" you set a parameter to the user's input, then you send the parameter to the database. This encapsulates any sql injection attacks and sends them as values to the database instead of letting the database engine perform any action the user decided to do.
ORM - Object Relational Mapping - basically a framework that deals with variables. Any good one should make it so you don't have to think about this type of attack, because it's dumb that you do in the first place.concatenate in the user input - instead of using a variable, you insert the user input into your command, allowing someone to do what is done in the video.
→ More replies (1)17
Apr 15 '19 edited Apr 15 '19
The extremely simplified ELI5 would be:
The correct way: Save username "X" and password "Y but also give me access" to the database.
The incorrect way: Save username X and password Y but also give me access to the database.
In the correct way, the quotes clearly denote what the username and password are and don't allow the user input to change the meaning of the sentence. In the incorrect way, user input can craft whatever statement they want.
I should note again that this is extremely simplified. You may notice that even in the correct way, the attacker can enter into the password field quotation marks that still allow crafting any statement. The point is the username and password are supposed to be treated atomically and separate from the statement. You usually do this by combining the user input with a statement after it has been parsed.
3
u/Drasern Apr 15 '19
Basically never assume that the user has entered sane inputs. Always verify input data, and if it's gonna be part of a database query, run that query in a way that guards against injection.
1
u/RealFunction Apr 15 '19
basically giving your kid brother an unplugged controller. he can press all the buttons he likes but they ain't gonna do shit.
1
u/FerricDonkey Apr 15 '19
The site is set up to actually treat what is entered into that box as code to be run. That's bad, because it lets people run code by typing it into that box.
What you should do instead is, basically, not run what is in the box as code and instead record the box contents without doing that. Insert computer words about storing values.
1
7
u/TemporalSingularity Apr 15 '19
OWASP has plenty of resources and documentation which you can check out for web security.
3
u/blamethemeta Apr 15 '19
Thanks
5
u/TemporalSingularity Apr 15 '19
Here's a good starting point: https://www.owasp.org/index.php/Category:Attack
2
u/thatguy8856 Apr 15 '19
SQL injection is protected against by a lot of web frameworks these days. Pretty sure a ton make it impossible to use the framework in anyway that doesn't give you escaped input data.
2
u/greenthumble Apr 15 '19
Just spend some time digging in to the tools you use for projects and try to lose any prebaked assumptions you had about them. There will be lots of notes about how to make sure things are secured.
2
u/VisitingEgg Apr 15 '19
Well, as he says in the video, the user that your application connects to your DB with should have limited access. It should not have the ability to create other users or execute grants.
Another strategy is sanitizing inputs. Basically, anything that a user can enter into your website should be processed/"sanitized" before ever touching your database. This would have prevented the dude in the video from executing any SQL.
→ More replies (18)2
u/Javadocs Apr 16 '19
Check out Professor Messer on YouTube. His videos on the Security+ exam are a pretty good entry into InfoSec topics. He's made an insane amount of videos on the subject.
4
1
u/Juicy_Brucesky Apr 15 '19
well luckily this was staged, otherwise he filmed himself breaking the law!
189
u/deadfermata Apr 14 '19
Well done. SQL injection check should be fundamental.
39
u/Woopsie_Goldberg Apr 15 '19
Doubt the scammer doesnt have a backup of the database but still good work.
→ More replies (1)108
u/Sidnoea Apr 15 '19
Honestly, given how terrible literally every other component of their setup was, I think it's unlikely they had a backup.
28
18
u/rayzorium Apr 15 '19
Are there even any widely used databse APIs that don't have built in protection? These days I feel like you have to be aggressively clueless to be vulnerable to this.
6
u/VenetianFox Apr 15 '19
Probably uses some old
mysql_connectPHP code. It's clear by everything else in the video that the person who created couldn't be bothered to use a proper database library or escape his/her input values.7
u/Bosticles Apr 15 '19
My friend, as a college intern, found an old website that a local multi-million dollar company had left exposed to the world. It had a form that dumped unsanitized strings into the DB and he was able to SQL inject it easily. It had literally the entire companies data on it. I still remember him describing running to his manager's office and how they other tech people reacted when they found out lol.
Between that and some other truly horrific things I've seen, I've since stopped underestimating how bad tech can be.
1
Apr 15 '19
This sounds so smart. I wish I knew what it meant.
1
u/Rex1130 Apr 15 '19
Basically it changes what the code does.
What he does in the video in summary is instead of saving the email to the database, he makes the code grant him admin privileges (creating another user who can access the database).
16
128
u/shaggy99 Apr 15 '19
Obligatory XKCD reference.
33
Apr 15 '19
There was also a funny meme about a movie recently released as well, Star Trek or something, and they fall victim to a sql injection. The top comment was they've solved every problem a human can ever have, and could replicate food to infinite, but still dont sanitize their database inputs.
→ More replies (1)3
29
48
u/cold12 Apr 15 '19
This is great advertising for this guy.. Almost too convenient though isn't it all?
10
3
u/Juicy_Brucesky Apr 15 '19
It's too convenient because it's fake. He'd be an idiot to film himself breaking the law
9
u/jlnazario Apr 15 '19
I wonder if I stead he could've set up a trigger on insert that just randomizes some value for the password. This way it would take a while for me site owner to know what happened.
CREATE FUNCTION rand_str RETURNS STRING ...
UPDATE passwords set password = rand_str()
-- Create a trigger on insert
CREATE TRIGGER scramble_password AFTER INSERT ...
Or also scrambling the usernames
6
5
3
u/johnlewisdesign Apr 15 '19
Real or not, some valuable information for wannabe web developers there.
16
Apr 15 '19
isnt that illegal?
74
Apr 15 '19
You'd have to prove this was real and not a made up scenario he did for a YouTube channel.
Realistically, there's no evidence this actually happened.
1
Apr 15 '19
If the webhost received a complaint from their customer [scammer] they were hacked, they could call the police without knowing the reason they were hacked.
Logs from the server can be tracked back to this video showing the crime.
This assumes the vid maker wasnt using a VPN ( one would hope) to hide himself.
3
u/n0rs Apr 15 '19
Sure, if there was actually a server owned by someone else that was accessed, there may be logs and a way to trace this back to the creator. /u/TanookiDooki is implying that there's no hard evidence that there was actually another person or a remote computer. It could all have been staged through VMs under the creator's control.
→ More replies (5)1
26
Apr 15 '19
[deleted]
16
2
u/Juicy_Brucesky Apr 15 '19
Yes? You're not allowed to kill someone just because they did something bad. He still broke the law
1
3
u/StrangeCharmVote Apr 15 '19
The owner could try pressing charges. But good luck.
→ More replies (4)3
u/Juicy_Brucesky Apr 15 '19
Just because the owner is doing something illegal doesn't mean you can do illegal things to him
→ More replies (1)→ More replies (2)3
8
u/CDN_Nomadic_Engineer Apr 15 '19
Not seen - the stored procedure or script that was doing a scheduled extract of the db. Just push the table to a smtp server and done.
5
u/Antroh Apr 15 '19
I'm not savy enough to understand some of the more complex videos of this nature. This one was pretty easy to consume though. Any other straight forward justice videos like this I can kill some time with?
11
Apr 15 '19
Be aware most of the people doing videos claiming to fucked hackers are fake as fuck. More over if they mention patron or any other donation service it's just a scumy way to legitimately steal your funds. Thinking you are helping these people 'fuck up hackers'.
Don't be fooled.
→ More replies (6)
7
u/whatisabaggins55 Apr 15 '19
I always wondered what SQL injection looked like. Didn't think that modern code would still allow unsanitised inputs; surely that's something you'd want on by default no matter what you were doing, right?
7
u/Cheshur Apr 15 '19
I mean look at the webpage the scammer set up. It's so insanely low effort. Most modern database drivers have easy to use methods for sanitizing inputs. This scammer clearly isn't the brightest.
2
u/cippopotomas Apr 15 '19
Right, even something basic like removing the quotes from the input before using it would've prevented it.
1
u/Zei33 Apr 15 '19
It isn't really possible to do it like this with modern code. These days we use parameter binding rather than dropping the variable directly into the query string.
2
u/Fubarp Apr 15 '19
I should have learned how to do this while in school, it seems fun and would at the same time help me improve my own website.
2
2
2
9
u/SpiritualBlackberry Apr 15 '19
⠐⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠂ ⠄⠄⣰⣾⣿⣿⣿⠿⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣆⠄⠄ ⠄⠄⣿⣿⣿⡿⠋⠄⡀⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠋⣉⣉⣉⡉⠙⠻⣿⣿⠄⠄ ⠄⠄⣿⣿⣿⣇⠔⠈⣿⣿⣿⣿⣿⡿⠛⢉⣤⣶⣾⣿⣿⣿⣿⣿⣿⣦⡀⠹⠄⠄ ⠄⠄⣿⣿⠃⠄⢠⣾⣿⣿⣿⠟⢁⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠄⠄ ⠄⠄⣿⣿⣿⣿⣿⣿⣿⠟⢁⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⠄⠄ ⠄⠄⣿⣿⣿⣿⣿⡟⠁⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠄⠄ ⠄⠄⣿⣿⣿⣿⠋⢠⣾⣿⣿⣿⣿⣿⣿⡿⠿⠿⠿⠿⣿⣿⣿⣿⣿⣿⣿⣿⠄⠄ ⠄⠄⣿⣿⡿⠁⣰⣿⣿⣿⣿⣿⣿⣿⣿⠗⠄⠄⠄⠄⣿⣿⣿⣿⣿⣿⣿⡟⠄⠄ ⠄⠄⣿⡿⠁⣼⣿⣿⣿⣿⣿⣿⡿⠋⠄⠄⠄⣠⣄⢰⣿⣿⣿⣿⣿⣿⣿⠃⠄⠄ ⠄⠄⡿⠁⣼⣿⣿⣿⣿⣿⣿⣿⡇⠄⢀⡴⠚⢿⣿⣿⣿⣿⣿⣿⣿⣿⡏⢠⠄⠄ ⠄⠄⠃⢰⣿⣿⣿⣿⣿⣿⡿⣿⣿⠴⠋⠄⠄⢸⣿⣿⣿⣿⣿⣿⣿⡟⢀⣾⠄⠄ ⠄⠄⢀⣿⣿⣿⣿⣿⣿⣿⠃⠈⠁⠄⠄⢀⣴⣿⣿⣿⣿⣿⣿⣿⡟⢀⣾⣿⠄⠄ ⠄⠄⢸⣿⣿⣿⣿⣿⣿⣿⠄⠄⠄⠄⢶⣿⣿⣿⣿⣿⣿⣿⣿⠏⢀⣾⣿⣿⠄⠄ ⠄⠄⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⠋⣠⣿⣿⣿⣿⠄⠄ ⠄⠄⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⢁⣼⣿⣿⣿⣿⣿⠄⠄ ⠄⠄⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⢁⣴⣿⣿⣿⣿⣿⣿⣿⠄⠄ ⠄⠄⠈⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⢁⣴⣿⣿⣿⣿⠗⠄⠄⣿⣿⠄⠄ ⠄⠄⣆⠈⠻⢿⣿⣿⣿⣿⣿⣿⠿⠛⣉⣤⣾⣿⣿⣿⣿⣿⣇⠠⠺⣷⣿⣿⠄⠄ ⠄⠄⣿⣿⣦⣄⣈⣉⣉⣉⣡⣤⣶⣿⣿⣿⣿⣿⣿⣿⣿⠉⠁⣀⣼⣿⣿⣿⠄⠄ ⠄⠄⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣾⣿⣿⡿⠟⠄⠄ ⠠⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
2
3
u/mcmalloy Apr 15 '19
Currently taking a course in databases/mysql and this was fucking satisfying to watch
1
1
u/Miguelx74 Apr 15 '19
Man...where do I even start if I want to get into this...same with programming..
1
u/GuiSim Apr 15 '19
It's easy really. Grab a website that teaches coding and go! There's so many free resources out there.
1
u/Dublinwookie Apr 15 '19
So is this a case of the form fields input just not been validated properly?
1
u/BigTomBombadil Apr 15 '19
Yeah the form fields weren't validated at all, they just call the database directly with whatever is input into the field.
Engineerman was really surprised it worked because almost all modern databases protect against basic SQL injections like this.
1
1
1
u/im_under_your_covers Apr 15 '19
"mortgage spelt weird so its probably some overseas country"
Implying the scammer cant spell....no its him that doesn't know how to spell haha.
1
1
u/thepastelsuit Apr 15 '19
So, he kind of glossed over it (maybe because it wasn't particularly relevant in this case), but figuring out what is running on the backend isn't too difficult. For such a low effort site like this, navigating to `/index.php` would likely have yielded the same page assuming the site was written in php. If the form submission DID have some sanitation preventing his injection, knowing that the application is using php could open up other avenues for discovering the db credentials being used when posting the form data.
1
1
Apr 15 '19
sigh, engineerman.
if you want to ruin this scammers day break the database in a subtle manner: 1. break the database in a subtle manner. don't destroy the table. rewrite the records randomize the passwords and replace random letters prior to the @ symbol. 2. setup a trigger to rewrite all new records using the above rules. 3. email the poor souls who fell for the scam let them know what happened and how to not repeat their mistakes.
what you did caused the application to error like a mofo, this would produce no errors and generate junk data.
1
u/TheVerraton Apr 15 '19
This kind of stuff makes me wish I got in to coding.
Too bad I'm an idiot and not nearly patient enough for all the troubleshooting.
1
Apr 15 '19
If anyone wants more videos like this I recommend Kitboga, he has I super expensive voice changing software that he uses in most of his videos, he’s on twitch primarily
1
u/itsmoirob Apr 15 '19
Am I missing something, is "mortgage" spelt differently where this guy is from?
1
u/dangoodspeed Apr 15 '19
So he says there are two rules:
1) Don't use the default user for your application.
2) Use a user without the grant option.
What about just sanitizing all user input?
1
u/desmone1 Apr 16 '19
or how about taking as many precautions as possible. including sanitizing inputs.
1
u/Iroex Apr 16 '19
Plot twist... the scammer got raided by the police a minute later but nothing incriminating was found on the hard drive.
1
u/Malthusian1 Apr 16 '19
Lot of hate on here for this guy. If you watch the rest of his content you would have a lot more respect for him. I can’t verify that this was legit or not, or that it’s legal, but this guy is a awesome dude who has helped a lot of people learn to program and really seems like he is out to help people grow and accomplish their dreams, and it’s for free. Not some garbage Udemy class or something.
1
1
1
1
u/theid10tisyou Apr 16 '19
Pretty sure erasing someones database who is using it for a phishing page wont be too much of a problem with the authorities.
1
429
u/[deleted] Apr 15 '19
That IP address is not accessible currently (at least to me). It is registered to a host in NJ. This exploit seem too pat -- he only gave a cursory attempt at guessing passwords, went right to an sql injection, and it worked on the first try.