ORM Injection: TryHackMe Walkthrough

With advancements in cyber security, many developers have adopted object-relational mapping (ORM) to mitigate SQL injection attacks. While ORM is intended to simplify database interactions and improve security, the threat of injection attacks is still not over. Object-relational mapping injection occurs when attackers exploit vulnerabilities within ORM frameworks, allowing them to execute arbitrary queries. We will explore advanced ORM injection techniques in this room, providing an in-depth understanding of sophisticated attack vectors and effective mitigation strategies.

By the end of this room, you will gain a comprehensive understanding of various ORM injection methods, which will help you identify and exploit these vulnerabilities to safeguard web applications.

Learning Objectives

Throughout this room, you will gain a comprehensive understanding of the following key concepts:

• Understanding Object-relational mapping
• Identifying Injection
• Weak Implementation
• Vulnerable Implementation

Learning Prerequisites

An understanding of the following topics is recommended before starting this room:

• SQL Injection
• OWASP Top 10

Let’s begin! 

The Room Link

// 01 Task 2 Understanding

What is ORM

Object-relational mapping is a programming technique that facilitates data conversion between incompatible systems using object-oriented programming languages. It allows developers to interact with a database using the programming language’s native syntax, making data manipulation more intuitive and reducing the need for extensive SQL queries. Object-relational mapping is particularly beneficial when complex data interactions are required, as it simplifies database access and promotes code reusability. 

Question: What is the default ORM for Ruby on Rails applications?
Answer:Active Record

Question: Which of the following is NOT a feature of ORM?

a) Reducing boilerplate code
b) Increasing productivity
c) Increase attack surface due to direct interface with the database
d) Ensuring consistency

Answer: c

// 02 Task 3 How Object-relational mapping Works

Mapping Between Objects in Code and Database Tables

ORM is a technique that simplifies data interaction in an application by mapping objects in code to database tables. In PHP, this process involves defining classes that represent database tables and their relationships. Each class property corresponds to a column in the table, and each class instance represents a row.

For instance, using Laravel’s Eloquent ORM, you might define a model class like this:

namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class User extends Model
{
    protected $table = 'users';
    protected $fillable = [
        'name', 'email', 'password',
    ];
    // Other Eloquent model configurations can go here...
}

Question: What is the method used in Laravel to define the table’s structure?

Answer: up()

Question: What is the file name usually used to store database credentials in Laravel?

Answer: .env

// 03 Task 4 Identifying Object-relational mapping Injection

Question: What is the path in the DOCUMENT_ROOT variable?

Answer: C:\Users\Administrator\Downloads\orminjection\public

Question: What is the ORM library for the Spring framework? (The one mentioned in this task)

Answer: Hibernate

Question: Once you have reviewed the cookies to identify the ORM, what is the cookie’s name that is responsible for maintaining the session in the attached application?

Answer: laravel_session

// 04 Task 5 Object-relational mapping Injection — Weak Implementation

Question: What email is associated with the name Jane Doe?

Answer: jane@thm.com

Question: What is the name of the vulnerable Eloquent method that is used in this task?

Answer: whereRaw()

Question: What is the flag value after submitting the payload in the secure input field?

Answer: THM{SECURED_001}

// 05 Task 6 Object-relational mapping Injection — Vulnerable Implementation

Question: What is the total number of rows in the users table?

Answer: 5

Question: What is the password for the email john@thm.com?

Answer: THM{101}

// 06 Task 7 Best Practices

Question: Is it a good practice to write raw SQL queries in ORM? (yea/nay)

Answer: nay

Question: Which side should input validation be carried out? Write the correct option only. a) Client b) Server c) Both Server and Client d) None

Answer: c

// 07 Task 8 Conclusion

Question: I have successfully completed the room.

Answer: No answer needed

If you have any query contact us