Part A: Practical demonstration of SQL Injection and XSS attacks. Use your DVWA service to demonstrate following attacks.

Q1: Retrieve all the usernames from the table User using a SQL injection attack. To demonstrate that write a SQL injection query in the text box and click on submit button. Make a screen capture showing the results of the SQL injection attempt and paste it here. Use Level of Security : Low

Q2: Retrieve all the first names and last names from the table User using a SQL injection attack by means of UNION. To demonstrate that write a SQL injection query in the text box and click on submit button. Make a screen capture showing the results of the SQL injection attempt and paste it here. Use Level of Security : Low

Q3: Retrieve all the usernames and their passwords (in hash) from the table User using a SQL injection attack. To demonstrate that write a SQL injection query in the text box and click on submit button. Make a screen capture showing the results of the SQL injection attempt and paste it here. Use Level of Security : Low

Q4: Convert the above hash passwords to strings. These hash functions are easy to break. Use any online convert which convert Hash value to string. Write down the URL of your conversion tool.