OK.
So he would go to just school hero.
The last challenge is to be that Drake has been experimenting with classified databases as he has never
had any success, we might as well.
But alas, more problems try and find the end.
Or so we have a formal fusion of a password and log-in so that we can try.
But once it says below, once you have.
The insurer submitted hail.
So what we can do first thing first in all the cases you just try.
Inspect Element and your page and view page source.
I'm sorry.
So but since it is this based on.
It is an input user space so we can try to insert some some payload or also injection inside it.
Either X excesses or obscure injection.
So first thing first, we are going to try to go to Newbridge Source to see if we find any comment,
Dex.
For debugging proposes to put this case.
So we see hundred green ticks.
Let's go on.
Go up.
Come on, go on.
Come on.
Oh, okay.
It's all in there, as usual.
So let's go here.
Okay.
Nothing.
So again, not growers.
Let me.
Stay here.
All right.
OK, so let's go back.
So what we're going to do, we're going to try something like this.
This is and was under.
EOWA anybody user name or password to get it, it's gone.
Let's come back.
So let me show that all worksheet proxy is.
Good, because we don't need Birchley for now.
Let's try.
I've been and was an.
Nothing so.
Now, what we can do, we can try to inject some payload, some or some, some command escort in addition
comments or let's put two single quotes and one space or space quote and to quote you, one quote one
in this.
And that is obviously we use this one.
So let's show the log in to see.
Plug it in as D or K, say something nice now.
So what we can do now.
Let's try.
What can we do?
OK, so let's just be in this for debugging purposes.
It's joy.
And it's could be controlled.
See?
Let's come back here.
Got it.
Let's let's put it to me.
Heidi, you were posted here.
It's.
What information you gave us?
Nothing.
He gave single called.
It's two days.
We are going just like this.
That's good single quote.
Oh.
I mean.
And so let's.
This
one.
Single called.
Space.
Oh, space.
Single quote, one quote.
What is?
Lovin as unbe.
Gay.
Now we are looking at the baby.
So it's still not work.
So when we put a command, we dentin blogging or 054, it is always like that is one one single court
or meeting space and single quoted in one one.
This is.
Did they do this?
Yeah.
Slug in.
Well done.
It is so feel good in your.
Go again.
So it's Attorney Craig in a.
It's good.
Oh.
OK.
Let me come back here.
So.
Oh, you will, it has to.
Quotation marks or let's put it to you again.
Conjola
did this one single quote, space between them and one equals one all as we have copied this comment
so we can just pass it.
And he was on and on and on the puzzle.
That's right.
Let's try it out to see what kind of info we will get.
Doo doo doo doo.
O k.
So.
As you can see, we are logging as this as this comment.
And then let's just try to read what we have.
Similarly, man, to kill her.
There are more.
Well, King delayed it in Leeds, soft on Keir.
System is better.
Okay, system is built.
So let's wait.
Creek and you page.
You page source gain.
So so let's let's go into code.
Let's find.
We have some information.
So we get a deal with someone from we share our day period here.
But let's just try to understand how it works.
OK?
Here they are.
This is your one, two, two.
Equal five.
OK.
It seems that there are so many user names also on password.
So we're going to try it out.
And so it's cool down.
Nothing.
So that's going back.
So against they who are click on them that we know we should not.
Kate, let's let's say, you know what I'm gonna do?
We're going to try them out to see if they are so music names or password.
So now we come here, come back here and we go back.
They did.
So let's try to copy this.
I'll get a copy and then come back here.
We passed.
We passed it in here.
In here.
Good to see you.
It will be long in.
No.
So as we can see, we get in your invited username or password queerly users.
User.
He was a name you quoted is a name you use an impossibility.
So this is invalid.
So let's come back like that.
And.
Go on, go on.
Okay, so let's process what it does.
We went about the same thing here.
Now let's try to win, you find.
And then we want to take this one.
And with Kobe.
Could be gone by ear.
The bastard who tried to broken it, see?
All Kia, we get in as XP.
So that means.
This is it was a name.
This is a password, and this is.
This might be egos and this might be password.
So let's just test to see.
Okay.
Let's come back here.
It's coming back.
Dirt.
McCain, now we just SCoPI, this bastard here.
But you.
Underground corpuses them.
Just to see if one is.
If before first is using this again and the following one is a password and this passage here, let's
try.
You are invalid.
You use it.
OK.
So it's under games, yeah.
So let's come back here.
So let's try to see how are we doing to give us what kind of what kind of yours to give us?
But again, we have to be careful of disguise.
Come on, let's retender.
Okay, so let's assume caught in a single quote again, smoking.
Right.
So.
What we have here is that we have slash user slash user and open this bucket and user name each quarter
and password not equal, which is what it is, one single quote.
So one single quote is here and it double quote and then it is closed again.
User name and I.
Space slash was.
OK.
So know what we can do.
We are going to insert some command like this, some payload.
We have to close all this on this board, which are opening.
So let me.
Would how would we be so first thing, first we're going to type.
But we're going to close close it.
So we're going to close the car out earlier in a single quick update or so we ticket.
And then we take the work it.
And then we skip this.
We skip it.
The sword is gone.
But here we skip it.
And then we take the pay then.
Now what we can do.
So we will take all the waste.
So to do so, we just type store.
Okay.
So those what we have just opened.
So the next one of the debate is.
Which one.
This slash says she reserves.
And so on.
So we just whiz this and slash.
So we are not going to take all this stuff out and we just waste store.
That means we take on the waste.
Okay.
So often that he what's become of the edes slash?
So we come back here.
We dig this sludge.
And then we're going to close anything we want.
Let's say that we're going to craws.
True.
Blah, blah.
Let's see.
Blah, blah.
And then off to we can Didi's.
Opening work, it's this one.
OK.
And then again, blah, blah, ekwall equation or something, let's say a single quote.
So now we're going to be Despain Lord.
We call, we eat, and we're going to come back here and go back like dirt.
So let's come back.
It's a moment.
It's the moment.
Let's do this again.
Your OK.
So on this quickly, we are going to post it here.
So do is in that.
That's because we have already quickly closed all those characters.
So if we can come back, let me show you foresting first.
Single quote again, single Gord's.
Just a moment here.
So what is this gluey?
So on days when we get here.
So it will be users slash user.
Well we just put.
Blah.
And then we skip all those things and.
OK, what does things.
And then we get inken the characters.
And then he would type password if we wanted.
So it doesn't matter.
So and then ekwall something.
So we just put two single code.
So that's how we made it.
OK, so let's go back here.
Political bug you.
So it's just one new one.
OK.
So we could a state.
Hey, I know all these coalman and then decem things we posted here just to see how are we to be just
Enquist noggin.
So we don't find any information yet.
So something is wrong, something is wrong because everything is OK.
So let's go back.
Let's go back.
Let's try something else.
Lou.
Kay, so we can just.
Peter.
So, Lou, let's list type again of command, control the.
Oh.
What do we have to take care of?
How or single quotes is coming here?
Let me press control and cheer so that I increase the page.
Let me.
Jill.
OK.
Come on.
So let me try to not just copy from the scene at all.
Let me try to put a dead.
So they are at the same.
The odina, Anderson.
OK.
Go in and disarm.
So that's why we could modify it.
Let me use this.
Okay, let's go look.
You watch this one and let me sit you down.
Don't let this in.
So let.
Now control a so that they copy it and then control see or just copy and then Busteed here.
Control the.
So let equals control.
Shoot my nose, so did a.
I would this in a little bit smaller done.
He's going to show you
one.
It can you lose those girls?
Okay, so let me.
Living like that and they voice Loggins.
That's why you see this is exactly the problem that we have encountered.
So because of your single quote, so we have to be aware of how this single could come.
For example, here.
OK, so here they are really not the same.
So this this takes a new toll on or marks a word, kill us, you.
Let's try to see how it would work.
It appears so.
Not really.
Then it would be the same if I go to let's say I can go to Google and then I and then I type this.
So there, you know, they say.
So they are different.
OK.
So let's go back to AutoWeek.
What we have as we still have user username or password, so we use and in that another line of values
and then we'll get a way.
So now we have a value in the airways.
So the UAE is not just empty.
So if we want, we can just view page source.
And let's go, hero.
To read it more clearly.
Okay.
You successfully injected and next month log in.
The password is all interesting.
So let me compete and come on.
Could be.
So this is the element object for the baby to sustain a password in need.
The call or a little soft dot com looking as though you don't find the interview.
So it's not that that means for this username and for this password.
This is the ensure that we have to.
We have to put it because here we can find it.
You don't find your interview.
You don't find the answer here.
So on my marks or.
So, yes, let's come back, he'll come here.
We'll try to bust.
Dignon sword here.
I love it.
And then let's check on you go into an airport store, check this and see.
Concord's.
Seventy points has been added.
OK, that's perfect.
So I really hope that this video was very informative for all of us that you have around with us.
So many ways of how you can click a U.
A website page or your Web site information so that you can get information.
Don't ever forget the basic teams is that you have tried to see the source code and you use the use,
you use all the tactics that we have used earlier.
And and we look, this is a real life page.
So and and your your life environment as well.
If you have some test to sort of you, you can always you can always try these tactics so that you get
in to this system that you are trying to get.
OK.
So we really think that this video was informative for you all.
And then we are looking forward to seeing you the next video.
Thank you.