Hey, Lou, everybody, welcome to my advanced ethical hacking, networking, penetration testing calls.
E!
In these you guys, we are going to INTUITY practical part of the Web hacking and then be aware and
be in mind, please, that we are not going to show you how to hack.
But yes, of course, we are going to show you how to hack, but we're going to show you how to hack
in order to know how to prevent yourself, in order to know how you can help people secure do system.
Therefore, if you do know how the hacking works so you will not be able to know how you can secure
yourself.
So this is a logical thinking.
All right.
So let's close this because we don't need it any more from the previous video so you can minimize data.
So we are going to open all Firefox or Firefox is working.
Let's stop Ortberg Street.
So we are going to intercept these off.
Put it off now.
All right.
So then therefore we can try to consolidate things.
We don't need them anymore.
Right.
When it comes to hacking, one thing that you have to have in mind is the common sense.
So always try to put your your head in place so that you can understand some tricky things, because
sometimes you might you might ask yourself, how can I have this Web site or how how can I bypass all
of this?
Log in form or some stuff like that.
And it's so easy after knowing it, you as you say, you as a whole.
So easy.
But that's before you did it.
Put yourself at a very piece for Leever so that you say, can we Lacassine and try to understand some
tricks and just perform this attack.
OK.
So we are going to show you these three guys in the next few minutes.
All right.
So let's go to Sitting's manual Boxey.
Use system, Boxey.
Okay, so now we can use Firefox the way we want it to be.
All right.
So we are going to show you here.
We've been testing page so that we can practice or you can train yourself in the cyber security.
So it's OK to be ahead and down hackers.
That org and the new presenter.
So it's it's a website that allows you to penetrate, to do some pin pin testing.
And then as.
Oh, wait a moment.
So let you minimize Berp Street.
I would like to close it because I will need it.
But we have done so.
We will see.
So I let it just happen.
Okay.
Well, let me open it in full.
All right.
Here you have so many so many options so that you might use to start your your your training phase,
if you will.
We have since some explored basic web hackey application, coworking and JavaScript hacking.
A lot of stuff, guys, encryption, logical step.
Guno, you know, you have a lot of auction so that you can train yourself.
But to be able to train, you have to register on this Web site.
So we have already registered.
So let's just try to log in and then we will walk you to the step by step, how to hack it from the
basic level to the advanced level over hacking phase.
All right.
So now let's go and type or user name.
Is anything else on the nowaday Cassady's password?
Okay.
No, no, no.
Thank you.
All of our folks.
I don't need you.
OK.
So we have already started.
So we were each already 75 planes.
So we you can choose.
Let me make it a little bit bigger.
Come on.
Be good.
Bruce.
Well, Kenny
Gross was a little step might be enough.
It's big.
You get like dirt, you do better for us to be seen.
Because you want to see everything.
Application.
OK, perfect.
So now we can after looking name, so we have seen that we have a few points here.
But you can try to hack some zip files.
It depends on your.
Let's let's try to go in, for example, to see what kind of options you have.
You see, this is all the training that you have to be solved and submit them if they are OK.
But let's go first step by step.
So we click on basic hacking.
Basic Web hacking.
OK.
And when do I click on it?
Open in a new page.
As we have seen in the previous course, the path one when we were trying to hack some some labs operating
system always be in mind and always having you have in your mind that if you are going to hack into
a Web page.
Always try to view the source code if it is P HP.
We will show you in stepper a stapler, video clubs.
If you did it by the first cost yet you we will encourage you to go in bait and then go to Stopera.
Let me show you where it is.
So you tell me your name.
Come.
Let's try to find all course advance.
Eighty eight before hiking.
They do go hiking on new mine, a network.
OK, so let's call down one.
Let's call the dawn to see.
OK.
So here it is, John Alyda.
So.
So we just came.
And then you when I go there at the moment and stuff blows the post up.
That's OK.
Here, guys.
And then we provide you not only DVD, you how to make it.
And we provide you, Dylan, so that we can download it and make the penetration testing and then provide
it step by step.
Phyla is step by step process.
How you can proceed if, for example, you are working in a public place or without a headphone.
So you don't.
You will not want to use the video.
So you can use this to provided file so that you can proceed with your own testing.
OK.
So let's go back to your topic, OK?
Now what we are going to do.
So what do we see?
Nothing here.
So you can just.
Right.
Click and view page source and first thing for us.
The comment is really is really important for us.
We have to always check what kind of thing is is commended.
So nothing is here.
Nothing.
Okay.
For now.
So we can close it by placing control.
We and then now let's try to type anything.
Blah, blah, blah.
As the password and then submit invalid password.
Please enter the password.
Now let's or I click on it and view bridge source.
So let's go.
He'll go step by step so that we can see something.
Let's let us check.
So let's stay put these in full control air and password in defense.
Good.
Here in this Alwiya, when you type into a squad here.
So here you're going to find in each team, man, come and we say something that when you put me a pearl,
I pull.
Let's say when you kick me when you paid me, I per OK, and so on.
So here we submit the good result.
You're going to see it here.
But after that, you won't you won't be able to see the issue medicament anymore because you get this
already.
So.
And so when you see the comment and then you come in since says it says through that.
But no one you want anymore pay or only one animal per wishes.
So this is cut.
And then you go back here and you type password is cut.
And then you press in the end and you will submit and you'll see.
So you already bidis because I have already bidis.
And then I did a few of them so that I didn't do them.
I just want to make sure so that you understand the process.
And I would Midem which you step by step.
All right.
Okay.
Now, so let's just scroll as this page.
Let's close it.
Let's go to the next one.
Double click and I click here.
Okay.
So now what we have here, we have a knife web page.
We say that my friend Jake has begun to program in Yemen and he made this act for him.
But the host of the website has kicked him out and he doesn't remember.
Where is this a him reading it from?
So our task now, because Drake doesn't know where he is.
Ankara is reading from.
We have to find the path of the IDF.
We always have in mind when we are what when we are going to have to make it hackings that even if it's
basic or at events, you have to always find the source code.
If we if we will be able if not, you will get in your way so that we can find the source code if it
is an BHB.
As I have said earlier, just check this Templer and this Tapper in the first course.
So you will see how to get day code within in PDB that or when you are white clicking interview page,
you will not be able to see them.
But following due process in the Stopera tutorial and the first course you will see them.
Okay.
So now less likely cliquey.
Oh we view page source.
So why do we need or we need to type a frame or we are going to first check if we can find something
in common.
It's very helpful because on tarab, something that might be encrypted as base forty six or Shalaan
or any kind of stuff like that.
So.
Or MDG five.
OK.
So nothing is like that.
So let's say I Flindt an upset with common its control f since we only Nook's so we take a forum and
say no and then we can enter instantly and one o k.
So we get it.
Let's try again.
I swim.
Te.
Good, so we can just try again.
Where is this one?
Okay, so now what we see that.
Please email.
Where is this for him?
So this path, we should take Kate here.
And we will copy.
Copy the path.
Let's check all the ethics.
OK?
This is the text that was within.
This is the text that was we can hear your guys.
OK.
So now we have the path so we can close these.
And what we are going to do.
We are going to try if it would work.
So we passed it here.
Yeah.
And then we submit just in order to seat.
And let's wait.
So you already bid this point will not be added.
As you can see, we are still on 75 points because we have already made it.
So now let's go to the third step.
You you will not see this, but you will see a kind of message like, congratulation, you made it or
you do it.
Stuff like that.
All right.
So let's go back and let's go to the third one.
We are clear again.
Open.
Okay, so.
Not it's quick hail.
All right.
So the bitter part is that now Jerry Karrar and how to make its GDP user agent, would it be one user
agent and BW too extreme.
And so the user agent was.
Was it found that this tells us a lot.
So what we are going to do since this is in that phone.
So we have to find a way so that we don't find.
OK.
So always what we are what we are going to do.
We are going to click in your page source.
Let's check if we have some kind of comment, cryptics.
Nothing.
OK, so what do we going to do now?
We we have to, Quaid imagined Foyt.
So, if you will, using force for folks like me so you can use a specific drug and use an agent, or
if you want, you can equate it on Google equipment so it doesn't matter.
But for the sake of this video.
So we are going to use Google Quansah that we make these steps easier to download.
Did it make this process easier?
Okay, so let's open a Google Chrome and we have to find a plugin on Google.
So we're going to take a go, go.
And no sandbox and in the prisoner.
Nuns in books, movies and books.
So when I wait for it, we will come to lunch.
All right.
So he'll.
So you can go to EXT.
And try to install a specific plugin, which is the user agent.
So just follow me.
And then you can type agent switch or let's say quote, so never mind.
So we got wind.
OK.
So this one.
And then you click it added to your Google Chrome extension.
So now we can just.
Caused a disturbance.
OK.
So now what we are going to do, we are going to click on here and to see the.
To see all the oceans that we are.
We have come.
Internet Explorer and so on.
So on.
So if you want to make your new changes, what you have going to do is wide clicking and then click
on options so that you can make this modification.
So, no, we have as a test that this one, this huge disused agent was not found.
So we are not.
So we have been digging.
It's connected.
So let's that's we've got it now on Google.
Oh, so we can close for folks cause and we can just copy this first copy, and we didn't close this.
OK, so now let's use just Google.
OK.
So we are going to.
Rogan, who?
Oh.
All right.
So this is small.
So we all want this control issue.
Bruce.
OK, so this is enough.
So here we type, we're using and facilities road.
So we are here.
So let's go back.
So we have twenty five point.
So it's scored on the scale basically of hacking and we have been here.
OK, so we are clicking.
And come here.
So now we are going to create and use it.
Agent.
So we are going to compete like that and we will beat and then we come back.
And then we can say, John.
And then he would pass it here positive.
And in the group would pass the string as well.
And then we praise.
We leave it like that and we press one.
And therefore, of the deadlifts, let's make it bigger.
So we click on add to that we add the user agent.
Now, what we're going to do, we are going to keep.
And then before that, we are going to click here.
And we choose the user agent that we have just created.
And then we click here.
Like that.
Now we use it.
This is blah.
So we click on Junblatt.
And then it's going to send the weakest.
You see, Sophie, you already biddy's.
That's because we have already made it.
So as a as we have told you earlier.
Ah.
And this video.
So now you when you do it like that, you will see it kind of congratulations.
So let's go to the fourth one.
So we hopefully that we didn't do it.
So let's close this.
And let's come back here to before one.
All right.
So let's check.
What is that?
Okay.
Equal is to pass this fine.
Not from an NBC crew.
OK.
So, as always, just by clicking to see what kind of things they are, the view suits called.
OK.
But we have to note that this is a BHB phyla.
OK.
So that means we might not find some codes there, but never mind.
So we are going to I can give you a view page source like that.
OK, OK.
So you can scroll down to just see if if they are also encrypted text or Iran or something like that,
that that might be very interested for you, as usual.
But the common sense say suppose that if it is funny, isn't that phone and basic forward.
That means probably it is on basic Twohey two, five, six, and then we just have to try it out.
So let's copy despite first let's go eat and then we will pass it here.
So we will pass it here just to see.
It's not there.
OK.
So let's make it like that again.
OK.
Now so let's just to change change the path.
So we would know what to say to to see if it's there.
Nothing.
So it's not so we enjoy music one into music, one man is one.
And this was it.
It's in there.
So let's try it.
Busiek is it six or is it by first?
So he didn't trade.
It's there.
So we just copy this file.
This this stream, and then you come back here.
And so we are going to put it in this.
And so therefore, we can just put a.
Okay, so now I sit this string U four and then we submit.
So are you already Bidis points will then be added.
You see, so that's good guys.
So let's go back to the next one.
Let's go to the next one.
So what is this going?
This one.
So.
Yeah.
Okay, so it's click here to see what kind of information that we have.
Okay.
Welcome to Asterisk Asterisks.
Certainly Spotify is any metasearch system that uses these new type of asterisk that are paid too much
for search and uses the same type of formal like looking.
And as they put it, it's a no against system, which also uses this advanced type as things that are
based too much.
Your username password is a new buzz word.
OK, so this form is interesting.
This is a put it that is just sort of OK if something is one.
Well, you have found a bug and put a price talk.
OK.
So we have an email address here.
OK, so let's just wait.
Clicking in view page source.
As usual, let's check in, though, on.
See what type of information we do have here.
So let's wait a moment.
Much, nothing.
Nothing interesting.
So induce a new buzz word.
This could be.
This is treeing in Boston.
They'll all be buses there.
So do a search.
OK.
So we are here.
All right.
So.
Let's call.
This e-mail address and try to find it, you can find it under the Tubby's.
So I sit here and the vent.
We will win, it will do much research future.
OK.
So we have to go back.
All right.
It's all.
OK, so you can try to put some characters, because as we know that we are in S2 is so we can put here
or here so as to cut some Stoics characters that we see if we can get something.
So but before that, then we can just try a single quotes and words.
No, nothing.
So let's go back.
Good luck.
No can die well, durras, just Bursley, you will usernames and passwords thought we could add much
more social.
OK, so this is one dusty.
So let's check.
We can tie.
User name.
Oh, Venus.
I mean, a mean.
Let's try to find me.
Good.
No, nothing.
Let's check.
So some people might say this is user name and user.
And again.
Very bustling.
Okay.
Now, what we can do, we have to follow.
D.
D from.
OK, so this one might be a nemer form so we can try to vote.
User name.
Let's say, and then we submit was into nothing.
OK, let's try I mean.
Send me more.
OK.
So let's try the same thing.
No, we are going to take a neat in sauciness.
We are still exporting.
So let's say bad things.
And then you follow this and pussies who us wouldn't it say a mysterious and we submit.
So you already bid disciplines, OK, you would find it late.
Congratulations.
Perfect.
So let's get to the next one.
We can close this and move.
We don't see any smoking cause it's for.
Six.
All right.
So now let's click here.
So this challenges my friend, my friend Juric has found this new way on how to do security.
Unix commands from a simple P2P file.
But it was this thing.
The security and the logs recorded his activities and reported it to the FBI and eat.
Change mode.
The file logs that to 60.
Now, the only chance for him to be safe is that you change the mode of the file to all execute and
delayed that file.
And then you have also to delete.
And then so that he has a chance, you have to delete the tracks file.
OK.
So let's avoid click and it say something that Mr. Data also said the command to do all these actions,
to do all these actions needs a Durrow in the beginning.
So that means that we have to put Durrow sign, you know, sign what is the Unix command.
So.
Okay.
But first let's go to do view page source.
When allays it.
Let's look.
So we have this.
OK, so it's it's nothing.
You do the same thing.
And just looking for something encrypted in common.
Oh yeah.
Okay.
So what we are going to do.
We have found that there exists a log.
But the 60 file.
But we don't know in which path it is encoded or we don't know in which path the logs, the text, the
file is.
So what we can do.
We can't just say it is in the index and declare victory.
It is in the blabbed about our victory.
We can't say something like that to to to be able to test something.
You have to have some techniques so that you can detect it by yourself.
So we will require you to go back and.
And by due course.
Part one there, one who performed some penetration testing in some tutorials.
So we have made many things using durable and map or some stuff like that.
But here, what we want to do, I'm gonna try to find in which path the defined.
This one is looked at lungs, the deep X, the E's.
So what we can do, we can just try to open a terminal and then we'll try to scan the whole website.
So by design of it.
So we claig we we call, we eat and we don't need index that.
So we need to to end my all.
So we type durable, durable.
And then we passed the path to everything.
Then we delay this.
So now we are scanning the basic Seek's path funding to help Bones Harker's.
It's life scanning guys.
So you have to be aware of this since it's a Web site that we can train.
That we can perform or hacking phase.
So there is nothing once so we can do it.
So we just blessin with Endor.
And then we are waiting to scan the whole website.
So it might take probably five minutes or two minutes or even eight minutes until needed.
But we we should just wait.
Just to know the directly when we use Durbar is a very well known tool.
And clearly nukes, which when we are used to eat arrows, goes to to scan all the territories and a
particular Web site for.
But if you want to to scan Yahoo!
Dot com or Facebook that console, you can just type in the terminal dobe and then you pass, then you
pass the website there.
If that Web site is with some some Port Lombroso, you have to know that before you scanning it.
You have to try to find a way to get the port.
No, we can use a map to find it.
Okay.
So we are just going do it.
And were tupa you?
Interesting.
William, I don't think so.
Let's let it you see.
So what did you find?
There were two guys.
I'm telling you that it is a very well-known it.
And it's very helpful for finding that Victoria's.
Well, we shouldn't have to escalate disproof age, but here it's not your task to escalate the privilege
so that we cannot bend this violent butt.
So we know how we can we can have it just go by a different course in the course of one.
So we'll see how we escalate.
Oh, we made the escalation of the privileges.
So let's just meet.
I'm w quiet to the end.
So we can just wait.
All right, good.
So we have can do a Web site, both of them of the basic sinks.
So this is all the territories that it includes.
OK, so now let's go to task.
OK, so no can come back and check what we have as this task.
So they say that the only chance for him to be safe is that you change the mode of the fight to own
and execute and then you delivered it back, which is that.
So that it is this one.
So we can try to bend need.
Now, what we can do, we can go back.
And then we assume that we are here, as would because defined path ease and basic sex.
So now we can just guide.
We do it today.
So don't do what we can just change mode.
And then a loose ex.
And this is execute and define.
He's in this fight and we should never doing drugs.
They would do.
So we go back and slash logs.
That would delete.
And if it is named logs that the.
Perfect.
Now what we can do.
They said that and deleted that file.
So we type.
We move.
And again delete logs ex.
And then they it their trucks.
People dakotah fire trucks.
We put the beach.
It is the beach be fired.
So we like clicking to see it.
So you see, you don't have the right to see his face.
Well, never mind.
We don't need to see it.
We just need to delay to get this or let's copy.
Kopi.
And then you come back here, you.
And then we were delayed.
So we delay the envelopes and then we busted here.
Sit here.
OK, now we can submit.
And when is it?
Let's go back.
We had a mistake because it gives us a..
All right.
So let's let's try first to take in loans thigs.
Okay, let's try if we need to have some some blank spaces which we're in, it need to be.
Look, first thing first, let's go here.
We have to do this space to move this one, okay.
So let's check that begin.
OK.
Looking good in this.
No space.
All right.
So straight to submit it again.
Congrats.
So we had a space after the first line, guys.
So now Open is not 75 anymore.
It's 100 in five.
Oh, right.
So let's go to the next step.
Now we hear.
Oh, right.
So let's read first this time Mr. Do Tree decided to make a cookie like a game script, and he said
he decapitated it, equipped to read from a C encryption.
Oh, interesting.
And for you to go again, you need to encrypt it, OK?
And after you log in, there is another log in.
But it's a log in that uses a skewer that obeys.
OK, so we know we know how to put some obscure command so that we inject some script.
But he thinks that the logging that they ask you to log in page is renewable.
It is is vulnerable to a simple screw it injection.
OK.
And when he gets back from his vacation, he would fix it.
Let's try this one, for example, and try to log in.
It shouldn't be.
Yeah, because it should be encrypted on AC.
I mean by now.
Okay, let's put this.
All right.
You know, so what we are going to do.
Let's embrace it.
We are going to I click and view page source.
Well, before let's let's.
Would this extension of.
Extension.
Let's put it off.
We don't need it now.
All right.
So, as usual, we are going to be worse.
They could you they are something that is encrypted or some information as plain text and a comment.
So.
It's just a joke, Jake.
It.
Oh, cool kid.
This is a joke script, OK?
In using every sum and it's in plain text, we guess we copy it controversy.
Let's go back here.
It shouldn't be working because he said that encrypted form is encryption.
What it say, Logan?
Okay, so never mind.
Okay, so what we are going to do, we have to increase their user name some.
So that we can log in.
So let's try to use terminal first all its straight worksheet if we have any solution on Brooke's route.
So decoding.
The key is, and it's joy to see and good is Exar in Bonaly looking neat and may be good, but we will
need it by no use any power comment.
All right.
So let's let's open a new terminal and then we're going to type this command.
It's movie hero.
So we'll take a call and then, whoops.
There was a name which we phone here, some positive, some.
And Carol, my nose l e.
Then single court this sign on onto a school pulled back.
So this is the command that you're going to type, guys.
He quoted in the book and quotes.
We stopped by Nowy Star.
And then we closed the single quotes.
A dead end presenter.
So despite knowing we're going to try to use it, is Binyomin good encryption?
When I tried to use it so that we can best date and use an informed seniors.
He said that looking for me, he dictated from AC and cushion.
And for you to log in, you need to acquited.
With these encrypted code so we can copy, eat and pass it here.
But before posting it here, we see that Mr. Durch re say to us that he decided to make a cookie rule
against creep.
And he said and he said he decrypted it.
It is C encryption.
That means cookies are involved.
So first thing first, we are going to try to add a rogue and cookies into all Boser.
That's a good extension.
Wudu extension.
Okay, so we have no clue who can go to an open com Web store.
And here we are going to type, let's say, kooky to find any.
If there are any.
OK.
So let's choose the first one.
And extension to Quim.
All right.
So you can turn this off so we don't need you in your own, so.
Okay.
It's just we finish this to see.
OK, Okogie is here now.
So we don't need this bridge anymore.
We can close it.
OK, now, so that so that all cookie gets into action, so we have to do DuPage boss.
But first thing first, let's try to click on cookies to see no cookies here.
Okay, so now let's go back here and we try to reload this page again.
Now let's go back to cookies.
Okay, so we have the user name some here.
But here we're going to we're going to be wasted and we've passed this code.
That could be.
This could be.
Copy.
And then we're going to come back here.
Come on.
And then we waited and we busted here.
And we save.
So let's ban this bigger game.
And then we posted here and.
We save it here.
They did terrific.
Now we can try to do the same for a password as well.
So now so far, so good.
We can come back here and try to bust it here and then not again.
Excellent.
Now we are here and they're looking pitch guys.
You see how it works.
So if you don't.
Since the task force is that cookies are involved.
So you have to use a cookie so that when you lunch the page and your cookies get decision.
And after that, as it says it encrypts it's a wee wee was binary so that we encrypted and we encrypted
and save it in two or cookies.
Therefore we can submit it and boom.
Now it's work.
OK.
So now the task is now he realizes that these logging escarole pillage is vulnerable to a school injection.
So as usual, then they escalate in addition.
So what we can do in just type single code all and space we can put.
Single quotes, one with Rosie Ekwall Peace and War on one end, then weekly submit.
But before that, we are going to click on Submit before we increase or password if my network board.
So where are we?
It's just a matter of trying, so we will try.
But my favorite script for a good injection is not.
This one is first thing for us.
So.
So the easiest one to remember is that you put it single to single what I did here and then you go here.
So now what you are going to do, you are going to type in number one.
That means Drew and you put you close it like that and then you put space.
You see all this is the easiest one to remember.
And then before we are going to wood again.
To what before did you.
We put again.
One.
Equal one.
And that's it.
You see how admitted posting first.
We equate two single comments.
This one did last one.
And the first one.
And this one.
Now we put one, two single quote, all single quotes.
We put this single quote again, because we have to we have to put the all in the middle.
We have to put the oil in the middle of the single quotes.
And then we say one equal one without anything.
Now, we don't need this anymore and we don't need this anymore.
As you can detect that they all in space is big.
All in space and space, again, is between the cause and then one equal, one nothing.
One, this is nothing.
So two single quotes, space or space, single quote.
And then you present it.
So let's go and press enter so that we can see if if it would work without having to encrypt the password
that we have seen here.
OB's.
Well, OK, so we get these cookies.
So we'd would post with us, would you.
Here, okay, so we get you can get it here as well.
I think so, ladies.
Okay.
This one.
Okay, so that's Klieg.
Submit to see if it will work.
Congrats.
You see, we don't even need to increase the password.
So because it's e because it's just a matter of the bypassing the obscure injection common space.
So we get the 30 points.
So let's go to the next step.
We can carry up to it with this and more.
And then the next one was.
So we were on seven, so let's go.
It's Joy.
Eight by accident.
We will have you.
OK.
So it was this one.
Now let's try this again to see if you here.
OK, so let's try to.
Call it a sting, a second dress it a smaller view page source code to see if we have something encrypted
school No.
One.
Like an omen.
Rupertswood.
So let's go.
It's good.
No, no, no.
It seems to have nothing.
OK, so never mind what we can do.
It's tried to put bias toward, let's say.
Swoon, low gain.
You.
We find something that it says, say, look, stuff from fermented Tobey's oil, plus we're equal,
blah, blah.
Your person was not on in order to.
That means we had information.
They did.
It has a database which we each name is Familly Underscore DBI.
OK.
So let's go back.
He'll.
Oh, first thing first, let's come here.
And ups.
They're all about it.
All of you all and and and so let's try to log in again.
Okay.
Now you can try to find a source code if you Peach's was called.
Say again, Intermezzo, let's joyed.
OK, good.
Now we can try again.
Control F.
And let's start with a comment like that to see if we have something.
No, they have nothing as command.
So we can just call this big began.
What?
We have to invade Depass.
They did have these guys.
Now, let's see if we can bypass the log in page sheet using insulin injection.
So we can use this and as usual, the Oval Office or for Voit comment is we don't need you anymore.
And then we don't need you anymore.
Soft fruit non-controlling to.
Gaine.
Nokia.
So now what we can do as we see, we cannot bypass it using escarole injection here.
And this phase.
But we got the E.U. will pop up message or reflected on this page.
Therefore, we can try to put that.
And there you are.
Okay, so let's try it again.
Oh, blah, blah, blah, blah, blah, blah, blah, blah, blah.
And then it was a no, OK.
Now what we can do, we can try to go to view which suits you.
Come on.
Okay, so we are trying to find you.
We hope some some ticks encrypted or in comments.
Let's go to.
We enjoyed it.
It's good.
It's true in your case that.
He will only skewer Chloe.
A.
So we can do some things since we have been this cool you all so we can.
Try to put a specific call in the wheel well.
All right.
Yes, good query is this disguise, because we know the password is not found in the database of family
underscore DBI.
So what we can do now, let's try to put a comment here.
So.
Sings Dispatcher For P, it should be fired so we can try to put this code here.
Let's say it's cruel.
Clearly equal to let's say.
One is true equity.
It's related to what?
Okay, so let's put some of the quote, but.
Well.
It's just.
So what we are going to do because we cannot use this is criminal, that it's a it's a killer.
Here.
Whoops.
So, blah, blah.
Log in again.
Okay, so now let's try to put on this that Abey's.
Here, because since it it's reflected here, Plessey is cruel.
Clearly, this is the BHB commentary Ekwall.
No equal select.
Let's do it like that.
Cevik still hopes.
Really did.
These.
So good.
It's good to see.
Whole Excelente.
Your password is King Kong.
It's not even encrypted.
All right, so let's call it.
Let's literally to see if we can do okay.
We can be gay.
Come on, let's go to submit to see if it'll work.
Congress tour.
The prize has been added again, so that's perfect.
You see, guys always try to know this stuff.
For example, if you have your own if you have the equal of the database, UPU to you.
So it's a very good chance that you have so that you can since the you will be frex to that page, you
can try to take that equal and pass it in the.
You were following a specific comment.
Let me do is actual query equal this, this, this.
Because here we got days as escarole query equal.
So we found that.
So it is a escarole query comment that is required to put behind that.
You were well and then wait the specific message that it has.
So perfect.
All right.
So now we don't need this or we can close it.
And we I to the next step.
It was eight and I can't remember.
Let me try.
It was eight.
So go back here.
It will go nine now.
Or Newbridge in Newtown.
Hulky case.
Gail.
All right.
Search for files with this file.
Search and search engine.
You can search firings only on the photo files.
OK.
Which your administrator has set up for you to search.
You can search anything in files folder.
OK.
And if your search was much easier, then it would show you the content of that file.
Let's we still conserve this page.
Let's copy this and open a new page and pass it here.
Now, I'm going to try a default without having to dub.
OK, good.
So we have the content.
Let's try to open them.
I'd make an opening there to open a new page.
So this is the content or wrong password?
Let me check if I can use this code injection here.
So as we roll or probably is window faludi's on one.
One slash all those pay or select one single quote so that you understand space or space.
Single quote one equals one Gaith.
No, we don't need this anymore.
We don't need this anymore.
So this joy to log in.
No.
OK, so.
So this is the log in page guys that we have now and we click on it so we can try to view.
Source code.
What's wrong with this?
Okay, so that's good on.
It's good, Alan.
So we're hoping both to see their view page, to see the source code of all of them.
Okay, so let's go back.
You.
Since this page is a BHP fired.
So we cannot read the speech codes and sides so we can read the the HDMI codes.
So yes, yes.
And Jeff, as quick inside.
But we cannot wait.
The PSP codes inside.
So what can we do?
So we should just click here.
As we check.
So we had we have to fires so we can try to look for them here.
So we don't need them anymore.
But just what is proposed of this video?
Log into each piece so that you can see.
Oh yeah.
So this is exactly how it will look.
Let's a gain edge.
So we saw it already.
All right.
So now what we can do.
Let's close this.
So would have been, oh, nine.
Get.
Right.
So so what can we do?
We can try to put to logging the PSP and then we put a no bite behind this, the no bite comment.
It is usually the percentage.
And then in.
So this.
OK.
So log in and the percentage.
And then zero.
Zero.
What it does is it truncates all the bytes which should be.
Which comes after.
Which comes behind.
Oh, so let's just click on Search to see how do we add.
Good job.
You doing good?
So continue to the second part.
So it's just.
Check it like that and we can and you scored as well.
So let's go here first.
Okay, so we had a log in page.
So what we can do first thing first we gonna try to come here and find if there is anything in the aid
or commended.
Nothing.
Let's click here, hail.
And now what are we going to do, we're going to try to view the source code for this thing as well.
So view page source.
You see you see how things happen when you used to view suspect, so code of of any page.
They are not even encrypted.
Sometimes it's like that, but sometimes so people they can put it in a comment.
Week by day and coded or encrypted or how she took her.
Sometimes you say that.
Well, it is.
So we're going to use this username.
And we just go be could be cooking it like that.
And then we come back here to.
Oh, oh, come back here.
Congo Tunisian Ocky.
So welcome back.
He'll use a name plus in here and buzzword.
Let's hope.
Inhale.
Lips.
Go on.
OK.
Copy.
And come back here.
Here, that's what we posted here.
In.
When I collude to see, okay, so you know, you know, I it's not you.
So let's just look that.
Since we check.
For research, he'll join with the best.
He'll again just sit here because we had it already.
So now.
In Kobe, again, gold in Kobe again and Pleasant Hill.
Now let's take on search.
Perfect.
Congress, so we have this.
Okay, guys.
So not as good.
Next, Nicholson so we can try to close this Dub's close, close, close, close.
So I.
In about 10.