Vulnerable Components Installed 2

Step 1: Go to the URL to access the lab (The URL may be different for each user). http://13.127.128.105/Vulnerable-Components-Installed/Variant-2/

Step 2: Click on 'Click here to buy' button. It will redirect you to the e-commerce website.

Step 3: Search online for the available exploits for Electricks e-commerce. To search, enter Electricks ecommerce exploit. This is the link: https://www.exploit-db.com/exploits/45737

Step 4: Now the exploit says that the search parameter is vulnerable to SQL Injection. Try to enter ' and press enter.

Step 5: Here you will get the SQL error.

Step 6: To exploit it, open Burp Suite and turn the intercept on.

Step 7: In the browser, enter # in the search field and intercept the request.

Step 8: Copy the intercepted request and save the file with anyname.txt in SQLmap directory.

Step 9: Now open SQLmap to exploit it. Enter this command: sqlmap -r anyname.txt --dbs

Step 10: Proceed further with SQLmap to extract tables, columns and the database.