We don't need this anymore.
Let's go to the next challenge.
It's 20.
So you.
Gateless OpenNet.
Kick this time, Derek finally taught that execute his slogan and has asked you to test the to test
its security.
That's a nice joke.
So try to look in as the mean.
You can log in.
As for your water.
Oh, OK.
But first thing first it says was that Duric finally told that he secured his in.
Let's try to check this thing, as we did before, to inspect Element and check network.
And then we freesheet so that we get the information, if BHP finds.
All right.
So let's go up here and check index.
No.
We don't need that.
We will peak.
Okay, so let's see how he encrypted.
Now.
You know what?
Forty seven now.
Massive crowd, frail.
So he used to be here.
Was Far War crowd flow.
Sishen cookies.
Stay tuned.
Say H.
DP on nail care.
Excellent, including Jay-Z defrayed be all.
Will Cain.
Kay.
Scheme it is all right.
So hate to admit you security.
Really?
So now we can do we can try to log in as fire water as it seems to also like fire.
Does that mean.
And then water and then was our.
Let's see.
You are logging in as fire king.
So what do we want to do?
Let's go and check Corky's.
Okay, so you're here as a whole in my.
Now, what we can do?
Let's check this first thing again to see what was the requirement.
To shake your old.
This stage, a secret is sure to try to log in as the main.
O kay, so let's use the cookies again.
Let's stay put.
Let's try to put Doug in here and do like Dad.
We check this out of information.
We get nothing.
So or let's try again to put in this code injection.
Let's say that it's too and not.
Space or meeting space again?
So a score we can do quotes.
Now to Google.
Let's say you hit.
To see what we will get.
And we see it.
Okay.
So.
That's when it all it's.
Well, look.
Why don't you put his hand in the cookie?
You see, it was about DeCourcy.
So congrats, 40 points has been added.
So we don't even need to go there.
OK, because we we will pass this challenge.
OK, so let's close this and let's go.
This we don't need them anymore.
Now, let's look ahead to the next challenge.
Craig.
And then he'll.
Kay.
So we're going to click here to enter the page.
It's this time joik invented antiracist group BHB and M.S. Cure Game.
But he once again failed to secure it.
OK.
So, as usual, the basic things that we are going to do is to see the view, page, source and segment.
And as we grow, so you might have to analyze the code and you analyze it.
And then after that you can go to inspect and to see more stuff.
So put this challenge.
We we are just going to see the content of the network which are here.
So we just refresh the page like that.
And we want.
To see this page headers, to see what kind of information Jerry has now and so we can check it out
old said Cookie Ghitis.
It could be.
So, okay, operate and secure.
We caught one.
All right.
So, gentlemen, have a little bit if not.
But again, the event.
So now let's go in and allege the they first kersting first.
If you want to use in, you can use Duby to fine on the folders.
And this is challenging.
Basic 21 sought to do so.
You just open your terminal and then type dharam like this one Dharam.
And this challenge is anyone and just wait to see.
So we get a page which is secret as we can to take off those so we might get it.
So we might want to open it to see.
So this page is about when we are going to take let's say.
I mean.
I mean there.
So this page.
Bob so your username password didn't that much anyway.
Court in order.
So what we're gonna do, we're gonna try to use it command, which will give us some more information.
So let's go back first.
Goldberg.
And we're going to try discriminant.
Which is interesting, named.
And first thing first.
Here, okay.
So we would have been equal or having one equal to one and and then equal dash, dash.
So what?
Which means that all the worst behind will be ignored.
So we can go on again.
Your username and password did not match any records and so on.
That abates.
All right.
Okay, so click on log in.
But before we have to delete the space or case or no, we're going to take on log in to see.
Or you just listen.
OK.
And now we have a new new message.
New Escorial, you all that says that you called on users I.D. is invalid in this cell, at least because
it is not contained in an aggregate function.
And there is no micros.
OK, here we get some information.
This may be turbo and you might be called on it.
OK, so let's go for Fruita information.
So we have these users, that Aidi.
Since we've just got some information about the Tybalt and some contend so the table is users and then
it column name is 80, we can try to find out much more information about the table.
I mean, so that we can find more more columns to do so.
We are going to use a commons, which is good by then.
So let's go back here and let's go back.
So we have to note that users is the table and I.D. is a clone of the table.
So when we go back here and then instead of having this common single common space of having two equal
to one one, and then we want to try to type group go by.
So the information that we get was the table name users, dot idee.
And then we put space and then we let this comment still late that would dash, dash, dash.
That means it will not everything behind.
So we know that already.
So just was under.
O kay.
Now it's genuine, it's always in you.
You will message, which is call on users.
That username is invalid and deselect least because of that.
Now we get another caller name.
This is still the table.
And then this is under local name.
We can try it out to find more information.
Dissimilarly like we did.
So we will remember the quote unended name is user name.
So we just go back.
So now we still keep going with this and process using good bye, and then we're going to try to put.
Let me move this mouse.
So now we're going to try to put a comma.
And then users the table name that we get.
And that you won't miss Agent Dot.
And then user name.
User name.
So having one equal, one dash dash.
Always.
So we presidenta.
To see now we get your message, which is users the passwords.
So decem that abey's that at least this intimate ending within your column.
So now we are still looking for new cologne.
So let's go back because all member password.
Okay.
So we will not try to.
And now coma and users the Tibaldi name password.
And then also we have space and newquist in order to see if we get more information or can we get one
for missions.
So this is brave, a big capital, a capital D, and we still keep going.
Keep going.
So we gonna go there.
All right.
So Engelbach, you know, push.
We put comma and users datable name.
God, we've a I d.
And then we still post Endor.
Let's check it.
OK.
Everything is void or I think.
OK.
Well it's Masuo Center.
If not we would see o k.
Let's check again.
Deforesting first that we get.
I don't know if I had a mistake.
And uh and the user we've idbi forget our how it was.
We then said he remained so excited barrooms or let's try to use it and try to enter again to see looking
gleave.
So let's just copi eat dirt.
We could be and then you go back here.
And then we just a comma behind it here.
Come on.
Yeah.
And then it's basically just, quote, beaten, just eat here.
So get it.
We think he's owed having one equal one and dash.
Dash.
So, Mr..
So at this point, we didn't get any new message from the database, which says that the state will
name and colognes but under the dub dub.
That means there are no more colognes in the table.
So what are we gonna do?
We are gonna use now a union select command so that we can extract the information that that is in each
wall of decorum that we have get.
So we have found that there exists two equal Enns and two users.
It was username and password.
And we've idee even the idea as well.
So for colognes.
So now we will use the union said, so that we can extract information in each of these of these Koran's.
Okay.
So let's go back.
Let's go back a gut.
OK, so now we're going to do you and your uncle and let's whisk control a so tight, so leg we day
union
select space.
Me, mom.
I mean, in Long Island, disease, user name I dead.
So there is a user name that that is that can be is user name.
Of course.
So wee wee wee now grows the bone disease and you put coma.
One, one, one.
So do is that we put one on one.
Is that because that we have or.
We did that.
And did tambour.
We have Four Corners.
So since we are trained to do a union day's values, so we use therefore they use it in value as, as
it's a part of the Tibor.
And then so that we report.
So we assume them as new or new in Europe.
So if you want to know which one for me.
Sure about it.
So you can go to decide.
Let me show you.
We can try to find much more information, but just work usual.
So here we will be finding Cologne's with a loose.
Would that type in any escarole injection attack?
The reason for performing in this cruel injection, as we said it is to fight an attack, is to find
much more information.
I mean, if there are some colognes and some some corones in the table to retrieve Deusen from an injected
query, Jan do interesting that I guess you want to which way it will be in stream form.
It might be in an integer form as well.
So you need to find one corones at least into the original crew.
You're always told always that that type is all which is compatible with Distin data.
So having that in mind.
So let's say that.
So you can probe or you can check each call on to test whether it can hold string data by submitting
a series of union select payloads that plays a string value into each column in turns.
So as an example, we have already know that.
Oh, Tibble, it has Falkland's.
So and this base.
So we had the user name.
So first, first we got the I.D. and then the user name and password.
And we've added.
So I mean, we've it was the last Calon that we get.
So to do so, you can just try unions select and then you put one of them here and new éluard newel
value and then dash.
Dash.
We do we.
Which will be ignored the worst of the part.
Or you can just try to contain them to put them in your head here and then a year and so and so and
so on.
So if the data Calon in the data type of economy is not compatible with destroying data.
So the injected query will cause it at least equal.
So China's conversion frails would converting do for value a that type integer?
So let's go into the death of this policy that we can show you or how it works.
Exactly.
Okay.
Okay, so after that, we take from the table name.
So the table name was what was users?
It was ours.
Okay.
We are the user name.
We'll get that you that you have put.
And the bone disease where user name is greater than a single than a single stream.
So we put a a week.
And then we put ups.
We didn't finish with the string yet.
And then by accident we was in there.
So let's go.
Here we are.
We are the streamy where the user name is Grieder.
Dun Dun.
A single stream.
And then so we're going to try to two to ignore dearest.
So then was it good?
What we're focusing on, let's try to verify if a comment is oil, it is OK.
It might be it's not okay because we we've got to put a single quote before the union.
Of course.
Never forget that.
Okay.
So now we can just put it in order in order to see, you know, the syntax.
A walk on her thing.
VAR Shaa Veeru at main two accord on the data type integer.
Now we knew that there was a name.
Which name is and mean.
So this is exactly that you want recision that we that we show you that we have shown you earlier in
this page.
Let me go back first.
In this page, it's a condition for when Gordon devalue the Russia value, a two debtor type integer.
So quite decent.
Okay, so now what are we gonna do?
So what are we going to do?
We're going to.
Let's come back here.
So the reason that we get the message is because that.
We were trying to put a string in the first call on and then the first call on us.
We have phone.
It was in Nadie.
So they cannot be extreme.
So it should be like an integer.
So, no, let's try to modify disco men's or let's say we wanna put user name use or we can boot something
like.
So let's see, first thing first.
One heel and then he'll boot.
User name.
Okay.
As the second step and then so can center to see what's what's going on.
So we get back to our origin all in one message, which says that it did not in user name password in
that much, any records in a database.
That's perfect.
Well, before continuing.
So let's try to test the first comment at the first union common that we have put to this one.
This one user name might be inside the user name.
And then instead of here, we are trying to get Deewar back.
We bought one.
And then instead of putting just a single string inside, we get a user name and the table already,
which was I.
So we're going to try to put all this so that we can extract more information.
I mean, more user name.
If there are any.
So now we just created.
Check it again.
Presenter.
You see, so we get this same message as we get as we did earlier, because we had a mistake.
Mistake.
We wanted to have mistakes and we see what kind of information or what kind of message that the database
will generate us.
So therefore, we have changed the I.D. to to this string so that we get that one message.
And then after when we did think that.
So we changed to first the first by meter in the call on us one, which is two.
And then this again, might be user name, which is a string.
Let's say password or user name.
And so it's a little one.
Okay.
Now what are going to do?
We can try to extract the information now for a password.
Now we do need to work for the user name anymore because we get it already that there are probably new
user names at the table.
So therefore we will just try to extract the password.
To do so, we will use the same common, but instead of mean instead of meaning long.
So we're going to try to put password.
We don't need this anymore.
We just need a password.
But instead of design, good are done.
I mean the district I mean, because we already know that user name there is admin.
So we should put a net greater or equal at one end and then that's it.
So let's just wait for him before we enter.
OK.
Or the user name is equal admin.
OK.
And then just Eskinder.
All right, so we get a new what message would say to that Syntex, the walk on everything and do show
Vario one to go to court on that day in Darfur or get a D is passed.
Would destroying.
So let's let's COPD because we don't know exactly what it is called be.
Let's move it again.
So Syntex converting the of shock value disvalue to it caught on tape.
Into de.
OK, so we understand as of this might be a buzzword, but it says that it convert destroying into an
integer type.
So that means.
So instead of coding the password here, we can try instead to put one to you, you know, because it's
the 80.
And then we can just put password.
Let's say something like that here.
And so let's try to within two before continuing.
So we get this and you want me said it again, so prefer yes or no less U.S.
The details that we get.
And so let's try to click here and control these two parts of the puzzle.
Bill Gates is there.
So now let's put the user name, which we already know, which has had mean jobs, which is I mean,
and and he was going to bust this.
So he just to see if it will be if it will work or if it is encrypted, but we'll find a way so that
we will agree.
So let's just pause, enter or just click on log in.
Congo at 45 points has been added, so that's good, guys.
So we have used group by comment in the union say comment so that we can fool the database system so
that we can get the more information that we need to push it.
Okay, so let's close this table.
We've got five hundred thirty five points.
So let's go to the next challenge.
We are going to challenge twenty two can.