Hi, everyone, from this lecture onwards, we are going to start with Escorial one zero one, so I'm
going to Logits is going to be very crucial.
If you want to learn Eskil injection sooner, first understand what is SQL injection.
So Ascoli stands for a structured query.
Language on it is a standard language used for retrieving and manipulating data in a relational database
management system, which is also called RDBMS.
So duties exist through the use of Qualys, which allows information to be created, read, updated
and deleted.
It's upon you.
And DBRS can be used in a variety of situations.
But one of the most common configuration is a database serving as a backbone to the application.
So inserting Exxon's upper forms, such as logging or searching queries, are sent from the application
to the database.
So this is the basic procedure of it.
And now let's talk about injection.
What is addiction?
Cindy Sheehan is allowed to occur when input are not properly sanitized and an attacker can enter malicious
ethical commands in order to access data that should always be out of sight.
So as congestion is generally considered to be a high impact because it allows attackers to retrieve
sensitive information, tamper with the data and destroy data, or even escalate religious and issue
operating system commands on the server.
So generally, any kind of input on a Web page is potentially vulnerable to ESKIL injection because
that is where it interacts with the database.
So authentication form where the user logs in with the username and password are the most common types
of input and data exploit as such, such as we can talk about, like search forms, contact forms and
file uploads at all, potential target for an injection.
So now, guys, in this lecture, we will explore the basics of school in order to better understand
the types of attacks that you can perform.
So first of all, let's talk about the anatomy of a database.
So data contains in a location based database is stored in objects called tables.
So these tables are the virtual representation of relations between different elements, which consist
of rows and columns, as you can see it.
So, OK, guys, let me change the color of it.
So now these are the columns and these are the rules.
OK, so we are having one, two, three, four columns in this table and actually four roads, actually
three rows, actually, OK, because we will not consider it as OK.
So as we all know that this is how it looks.
Right.
OK, subfields, which are columns of the table, represents a specific piece of information, whatever,
every record.
So this is better illustrated in this particular table as you can see here.
So I be having it name, username, password and all the details.
So this table contains three records and fulfills each user in the database is given and I'd name,
username and password.
In reality, tables are much larger than this and can contain millions of records and the database itself
can hold just as many as DBL.
So you can see how valuable Escalon Jackson is to an attacker with this most data ripe for picking snow.
Guys, let's talk about the data type and operators and what is the syntax of it.
So in order to understand the data that we are working with, we need to know that there are different
types of data utilizing squill, all the exact data type of very before we can see very different between
the database system.
In most of the cases, they are similar enough to tell what they are.
Usually they are categorized by the text number and date.
So operators allows us to manipulate and interact with the data in the.
So they are five main categories of operators like automatic bitwise comparison compound and logic.
So most of these are similar to other programming languages, but few are simply different.
OK, so now let's actually see what the syntax and the statements suggest.
So if you talk about the syntax in a statement so called statements are the code that is passed to the
database in order to retrieve or modify data.
So now let's look at the example, as you can see here.
So this example here.
OK, so don't look at this example.
I understand the square.
So first we are having select.
A star from user weird name, uh, is equal to John Smith, so first part of the statement is select.
OK, let me change the color because this is not visible to the eyes.
OK, so first of all, we need to take this first date and we just select from selected from.
So this simply means that select all the fields from the user table or select all the fields from the
user table.
Now here we are having Veera so we're close specified that we only want to see information from the
record we are.
John Izmit is equal to Nate.
OK, so this is how this statement works.
So Ascoli just single calls for a string.
All the maldita with system will permit double codes and the semicolon marks at the end of the statement.
So this is the basic syntax.
So it should be noted that key words like select and are Akis insensitive.
That means they are not case sensitive.
OK, so now let's understand what is comments enescu it.
OK, so as you can see here, we are having, as we all know, every programming language contains how
to command OK, in every program programming language there is the section of command which in which
brogrammer which you used for inside their programming language.
OK, but in case of actual school we are having this is a single line.
OK, so let's understand it.
So select from user, select from users which will select everything from U.S. will display.
OK, so this is multiline in if you want to do a single incoming Ulu using the word hyphen and if you
do, if you want to do multiple anchorman's, you will use this symbol and this and you can just close
it by.
This is a skill induction exploits the way complaints are handled by the rendering, uh, certain parts
of the query unnecessary.
So now, guys, let's see this one.
Let's see this one.
So this will retain all the records from the database since an empty string, as you can see.
And so what this all means here.
OK, so what it will do, let's understand it first.
So select from users.
It will select a user table and then we use a name.
Is this or one is equal to one and password.
So what it will do.
So guys, in this case, let's understand this will simply return all the records from the database
since an empty string or one is equal to one, which as you can see here, this is the empty string
and one is equal to one always evolutis at two and the double basses, as you can see here, coming
out the password fit.
So that is why commencing a school is very important.
OK, so now, guys, let's see some more we can say key words.
So they are also key words that exist to make change, arranging data easier, such as min max between
inaudible.
OK, so now as you can see, we are having this organization table.
So this table is long in session.
OK, what is right, Gosa.
OK, so log in.
S. is the name of the statement.
OK, so suppose we wanted to know who was logged in in the longest and when.
So the query will simply, as you can see here below would return the Idee username and the softest
and longest session Vidana between duded as our listeners nodded.
So what it would do to select Idy it was select this username to select this and minimum minimum session
length minimum session and it will select from this.
Maximum sition from Log-in session, maximum session and the longest we're log-in builds between one
2021 and 2005 one.
OK, so what it will do, it was select each and everything in between these parameters.
I will give you the result.
OK.
So this is how it works.
So group by concertedly, we can see here we are having Kuraby.
So now what is good by Sugrue by consolidates the rules by I.B. and order by Max Linta and it sausen
in decreasing order to the user.
OK.
So other useful statements includes insert into which insert some new record into a table, updates
which updates existing record in a table and deletes to which is used to delete record in the table.
So these steps squaddies can be useful for Eskil injection when you want to do more than just retrieve
information from the database.
OK, so an attacker could insert a new record indicating that they had bought something from online
store, for example, and claims that they never received the product and can be compensated for it.
So if they really wanted to cause maximum damage to a drop, statement could be used here.
So drop they will will remove an existing table and the database will drop.
Stateman will remove the entire database itself.
So now let's understand what is doing and union, so joints are used to combine for combined rules from
different tables, so when there is a fear related between them.
So here is as you can see, we are having user table.
OK, so here we are having to use a table.
Let me first name them.
This is the user and what the stabling.
Let's say it is login.
So having those two tables.
So now these are the greatest that we have here.
Select user select users.
It will select this table, not use it will select username logins.
Loggins date details log-in dot, it was like this from users in a joint logging on user ID and logging.
So it will simply in a joint.
So any joint or simply joint like, as you can see here, was simply written records that have matching
data in both the tables.
So I left joint returns, all records from the left table, as well as a record that matches in the
right to surveiled.
Right.
While we if we see a like right joint returns all records from the right tool as well as record in the
left over.
So a full joint will return all records that match in either the left or the right table.
All the joints are not required for fiscal injection.
They can prove they they can be proved very useful when extracting information across table after you
have found your way in.
So now, guys, let's talk about union.
So what does the union.
So in the last lecture we have talked about join, but in this case, going to talk about a union.
So unions used to combine distinct data from to a more select statements.
Each state one must have the same data type and the same number of columns, and they they must be in
the same order.
So this thing should be noted down that they must do it in the same order.
So Union all does does the same thing, but it won't eliminate duplicate rules in case we are the same
data exist in both of the union tables.
So now let's look at the example that we are having two tables and that is used here.
And this is.
User.
And this one, let's take it as admin.
OK, so we are having two tables, so as you can see, this is the query that we have here.
So it will simply join password from user and password and Union Pathfinder's will simply join us.
OK, so obviously this won't be normal carry that is run against the database.
But if we were allowed to inject this, we could obtain the admin password or any other information
that isn't usually accessible.
So guys, this is all about Escadrille injection basics because these are the things that you should
know.
So if you don't understand anything you can ask me, I will answer your question within 24 hours.
And if you have any doubt, you can simply reverse the video.
And it will be very easy to understand because A is not a very tough thing.
This is like English language.
So, guys, I hope you guys understand in the next lecture we're going to overhaul SQL injection because
what what what is the approach for a second injection?
So I will teach you in the next lecture how to approach Eskild injection, how to exploit SQL injection
and what are the commands that will be useful and how you can use commensal union.
And so this these two lectures are going to be very crucial if you want to learn script injection.
So thank you words.
I hope you guys understand and thank you.
What in this lecture.