So hi, guys, welcome back to the lecture.
In this lecture, we are going to see how to exploit exquisite condition, how to find its clinician
present on any parameter, OK?
It's not a barometer on any, we can say such form or a feel or password.
So for finding it.
First, we need to set up our lab.
So as we did it before.
So for that, first of all, you need to log into your always bwl, as you can see here.
So I'm going to log into it.
Using my username and password will be always be W8 and now hit enter.
So after hitting enter, it will simply load it up and then simply type if config.
So when you hit enter, you will find this as the IP address just in it.
Address of one 10 zero zero seven.
So this is the IP address.
So now the next thing that that I have to do here is simply open the Web browser here.
So this is a Web browser that I have here.
OK.
So it will take some time, actually.
This this is up on your arm, how much you have allotted, so guys, let's enter the IP address of Always
with the machine in the here and the search bar.
Okay, that addresses it all.
That is why it is not working.
Let me fix it.
So this is like we're just not how to enter so of dating and as you can see, that we are having this
Muzzin, which is always a broken application project and we are interested in ESKIL injections.
First conviction, the best way to practice is Madalena to so simply hit and run this.
So when you hit enter, you will see this kind of interface, as you can see here.
Let me zoom zoom out this so that.
It will be easy to see each and every page.
So when you see in the left left corner, you will find all 2013.
OK.
So when you move your cursor above this, you will find these many vulnerabilities here.
So we're interested in this, which is a square injection, extract data and user info.
OK, so this is the field that I have here.
OK, let me first put it, is it so that I can teach you what it is?
So this is the page this is a page in which we are going to test our SQL queries here.
OK, so first of all, let's see let's see what it is asking for.
So this is asking for a name and the password.
OK, so please enter your username in the password to the account details.
OK.
So as we all know that I do not have accounts in it.
So what I'm going to do here is I'm going to simply register using that.
I'm going to give as like the I w.
And the possibility to see the A.W..
I w so this is the password that it can form signature is d I now create account.
So account created for the and and.
OK, so now let's whereas is top 2nd has been created.
So usernames or guys.
Let's get back.
So now, guys, we are having this field is this.
So we are having this film, so first first on our agenda is to test the page to see if the possibility
exists for an indication or not.
So to do this simply let's use the tick.
Tick means this is the character of can quotation character to see what we can learn from this.
So what we need to do here is simply you need to move closer here and simply use the stick and hit enter.
So after hitting enter, let me I think you can see this.
Let me zoom it a little bit.
And so this is the area that we are getting.
So what does this mean?
Simply using big we were able to learn a reasonable amount information about the database which supports
this application.
So what are the some things that we have learned from this?
So we have taken two things from here.
So the first thing that is, let's see, fight here, fight so we can see that the entire part of the
file which is handling this area.
So for looking at it, there is additional information which can be inferred, such as this is more
than likely a Microsoft Windows device on such which the server is running on.
OK, so as you can see here.
So then the second thing that is message, which you can see here matters.
So from message, we can see that this is my school database.
This is also had a ring at my school.
And from this you can also see this is the minuscule database.
OK, so this is the first thing that we get from the message.
And the next thing is why this is important.
So the database in the back end will determine the type of interaction we can do with a wider application.
So now, guys, let's expand on a big and let's see what it's going to do.
So, guys, let's see.
First of all, actually, this is quite irritating.
Every time it's just become admin admin.
That is quite irritating.
So this is the thing that we did earlier or is the common one is equal to one will always be true and
give some space.
OK, so these are space of the two hyphens and this is needed for MySQL commands also recommends.
OK, so now let's hit enter.
Sorbets.
When you scroll it down.
OK.
So when you scroll it down so often simply entering this particular.
Hmm.
Let me see this.
OK, where's the area?
OK, guys, this is not working.
These parameters are just.
Irritating me.
So let's try with.
This again, this is the.
I take and then all.
One is equal to one hyphen, double double hyphen, and now please simply hit enter.
So when you hit, enter what you can see here.
This is giving us nothing.
So there is some failure.
OK, guys, so there is some failure as to why it is not giving us died.
Let's try with something else.
OK.
OK, let me do one thing here that is let me try with this.
This is not working, guys, so we have to try some other.
Come on, this is not like I have run from somewhere and I'm applying here.
This is not like that.
So now, guys, we have successfully entered our come on, so what was the difference in the last and
this so different was that, as I have told you, that you have to you have to know that the basis of
the two hyphen, this is the space to this thing should be keeping your mind because this is important
and needed for MySQL.
OK.
So as you can see, it looks like we've done the entire table.
As you can see, these are the these are the things.
OK.
These are the accounts that we have here.
OK, so this is the account that we have created, as you can see, we are having the username and password.
OK, so this simply looks like we are making progress and let's see what else we can do.
So how about we are trying to determine a database wasn't OK.
So for this, let's try to as the admin account to reduce the number of rules which will be written.
So our query will now look like.
Let me.
Do it here.
So let me raise it, let me remove it so that I can easily walk here.
This is just irritating me.
OK, so now let's change our query like Edwin.
Edwin, so this is the very simply take a look and now these are the two and just give it do not try
to hit enter.
So guys of building enter, let's scroll it down, you can see here after center of this going down.
This was over command and this is simply we are trying to get the data as well.
And so now let's try with some other.
Come on.
So this is we are inside admin.
So now let's try to run some other command actors, admin and simple tech.
OK, unión, select.
Ateret, okay, now type I wasn't here, so this has the come on.
Hit enter.
So that is when you hit enter.
So, guys, when you hit enter, so we got an error.
So when you see the error, so what it is saying it is seeing that the you select statement have different
number of columns.
OK, Seulement says this.
So now what?
We need to ensure that the number of columns are balanced.
So now let's try to learn a number of columns in the table.
So now let's use admin.
Let me try here.
Let me use Edman this as admin and select this one.
And just to first of all, it is it.
I mean, a union select and used null.
And hit enter now.
So when we run this command, we got the same error.
Let me call it down, as you can see.
We got the same error again, but the number of columns.
So let's build up on this to find out the correct number of no's we need to use here.
So the thing that we need to do here is simply increase the number of notes.
So it will take some time to have to take care of this.
So this was the null and let's simply separated by a comma.
Let's try a double double null.
No, I don't.
And let me see it again, this is giving a seminar, so the next thing.
What I can do here we have now is try with the.
Pordenone, OK, guys, one oh, one, two.
OK, now head into another can see that we are getting the same error.
So now let's try it like seven nil six, not seven.
Now, let's try with the seven one.
We have one to.
Now.
Three.
For five.
Six, so we have now used six no space and hit Tantanoola to that working order.
So this is again not working again.
Let me do it.
Uh, regionalist containing Homerton, letters containing one, I think.
Now let's try with one more.
No, no, let's try with this and see what it is.
One, two, one, two, and it and so as you can see here, guys, as you can see here, so we see that
rather than ever we have now, as you can see here in this and well, what we have here now, we have
reported two columns now that we have of number of columns to try to get the database frozen again.
So how you can do this simply we are going to use without final actually 6:00 a.m. with the wasn't.
Come on, let's try.
We are always OK.
I mean, do I think how much it contains we, uh, because we are having seven, so that is why I'm
using six nil, because one for that wasn't one, two, three, four, five.
Sixth, sixth, we are having six here.
So after this, let's try to find out who wasn't.
OK, so now let's see how it is going to be looked like.
Wasn't so this is what was done and now we have supported it, so one, two, three, four, five,
six.
No, no, let's it is this one.
One to.
Want to another hit enter?
Let's see what it is giving, as you can see, that we have successfully extracted the version of a
DBMS.
Okay, guys, so now guys nesting.
So now let's look at each one, determine which one will accept our strength or at least which one produced
the username, password and signature.
To figure out this, let's put some string in each nail file.
So how you can do that?
So earlier how we know we have use.
So we have you, Sarandos.
So in case of 7:00 in the place of 7:00, we are going to use some springlike column one.
OK.
So let me start it from starting admin take, OK, union select.
It's growing inside the, uh, we can see let me make it.
This one, I think this is correct way.
OK, let me close this string again for another one.
Go long.
To close it again, Coolen three Cycloset, OK.
OK, ok, ok, ok.
Again, Coulomb three.
Coolen for five days time.
That's for you and again, disclose it.
Coolen six is now the next one that we have here, Skogland seven.
Just close it, uh, open it.
So this is what we have and make it to pieces and this is how.
So now let's try to end this.
Come on.
OK, guys, so let me scroll down so you can see that, as you can see, that we have used this particular
command.
So column two, column three and four are the ones which we can use with our strength.
So now let's revisit that attempt to get the database, Wazzan.
We will also replace the column X, OK, NHLBI column.
So now let's try to see again for the database wasn't so how you can do that.
Let me scroll down.
This was this.
Now, let's try to hit enter, let's use it, working with us, giving us Edda.
I gained select.
I think.
We have to.
Okay, guys, this is the thing now, and we need to add some spaces there, so this is the version
that, as you can see, it's a good progress so far.
Actually, I can see that.
And we have now managed to obtain the database wasn't.
So now let's continue.
How about we dump the database schema so we can see a list of tables with the associated names?
OK, so now let's see how we can do that.
So we need to again enter a long string, so long query so that we can simply dump the database schema.
So how we can do that.
OK, so for that simply type admin as usual, just close it using the tick and then union union.
OK then simply as always select.
OK.
Now if the select use null we need to add seven different things inside this because we as we all know
on seven it gives us result and then debelin.
So okay this is not hyphen, this is our Nisko table name.
And then let's see, it's that column.
OK then we are having column name.
Let me do it like this and then null do null and let's see that three null phone.
OK, so faunas you know now from information.
A schema a schema of information is correct, Golan's oggi of the colon's that need to add two spaces
hyphen to spaces now hit enter.
Let's see, is it working or not?
So I think it is not working.
Let's see.
Let's see what it is doing here.
So, guys, now that we have got in dome database structure, let me do it like this.
As you can see that we have done that database structure.
OK, guys, so we can now look at the other tables so we can see where we may be able to extract the
data of relevance.
So going through the list, as you can see, like on tables, tables are accountable.
So the list contains the user information which we are able to obtain in the beginning test.
Okay.
Which is like we can see.
Accounts now let's try to simply, um, let's see for the accounts.
OK, let's do it again.
So we have to write again what we did earlier like.
Unión, let me see, is it president or not?
OK, this was the command that we have entered earlier, so after the schoolin columns, let me use
their.
Let me use their people names, they will name is equal to, uh, and simply give it as.
Account.
Accounts just what the next inclosed as a string and just two.
No, I don't.
Let's see.
So, guys, what we have found here, so so we see the addition of you, such as it is here.
So like this said, is that mean first name and the last name.
So as you can see all of these things here, this is the first name, last name and all of the things
here.
OK, so this is the way.
So now let's see what we can learn from is Edman.
So what we can learn from is admen.
As you can see, we are having here is Edmondson's admin password.
So now let's see how we can what we can learn from this.
OK, so now let's see, let's create one more query for this.
Simply take Espace Union.
Select Simplist, you select a null.
Now said, OK, user name is their domain, is admin null?
OK, again, we have to use two more now to complete the string of seven.
Now we have you three know from accounts.
And now tenter.
So after hitting it off by hitting enter, it looks like value for value for where it was.
Let me scroll down.
As you can see, the value for is admin's either true or false.
So for this, we have no we have a list of Edman users in this database.
Now, let's take a look to see which user of the application is simply accessing that database.
So now let's see how.
OK, guys, so simply use the come on again that I'm going to tell you, like admin admin, let me do
it like this admin space union.
Select nul.
Go around.
User.
Guarantee and assess function and then use the remaining nodes like five nodes, because we have used
to places, so we need to use, uh, at five Nosseir.
One, two, three, four.
Five, OK, is this correct?
OK, let me do it, let me correct it like this, OK?
Is everything correct?
Let me run this.
Come on, let me run this.
Come on.
So let's use working.
Not so as you can see, that guy is so very interesting thing is here.
So this application is running as a model, as you can see at root.
So now what database are we connected to?
So let's see of what it is.
Are we to do so far that again, run one more query admin.
A space union select.
I know for database we are going to use data base.
OK?
And now, again, are remaining null, which is OK.
This is just quite dated.
Two, three, four, five, OK, is this correct?
No hit enter.
Let us call it down, as you can see, that case we have gotten here, we have got something.
So now let's try to read this is the database, actually, this is the name of the Jewish senators.
Try to read a file from the server systems of how you can do that.
So this is some very interesting thing.
So how you can do that.
So this command that I'm going to give here is going to be very difficult because it looks like very
small.
You can see uninteresting, actually.
OK, so now let's see how we can do that.
So the command that I'm going to give is Edman single take and then simply union select.
This is for select and nul this as one nil and then load flight load.
Lord, file inside this.
Let me do it like this, and the part that I'm going to give here is this.
Mm.
Okay.
How many bars I should add.
Here, let me do it with four.
OK, so this is for now Windows.
This is the part.
Let's see, is it working because currently I'm using Linux, let's see, is it working or not?
This is how.
Drivers, ADC.
And then will host Wookey host now disclose this.
Everything is fine, looking fine.
So now add the remaining Nosseir, which is around five.
One, two.
Three.
For.
Five.
No, I don't.
Let's see, is it working or not, records, as you can see, that record is not fine because currently
we are using Linux systems.
So that is why it is not working in our case so that we are not able to get this.
So what you can do here in case of this, you can simply use your Linux pod, so then you can simply
get the right part of it.
OK, so as you can see that we are using Linux, so that is why it is not working here.
OK, so guys, the question arises here.
All is we did we were able to manage to get the database was on database named Password's inside parts
of what is contained inside the table.
What we have the column name.
So a number of columns, table names, username passwords and the signatures we all managed to get.
We managed to get all the information.
So the question arises here that.
How you can simply
simply protect yourself to how to secure your organization from single injection, so as you can see
that we did a lot of lot in terms of demonstrating the effects of fiscal injections.
So I'm understanding how we protect ourselves from this.
It's just a very important thing.
So the guideline is like at the time, based on this particular understanding.
So the only proven way to protect our website from a single injection attack is to use ESKIL parameters.
Statistical barometers are the values that are added to the ESKIL queries to the simple execution time
in a more controlled manner.
So this is the way you can protect yourself.
So, guys, I think you hope I hope you understand this.
So if you if you're not getting anything, you can simply message me.
I will simply make a separate lecture on this as a clinician, by the way, I know you all have got
this very well, but if in case you are having any kind of doubt, you can ask me, I will answer your
questions within 24 hours.
Don't worry.
I will make a separate video and I will show you one by one how you can automate the process of masculinization
without doing all this, because I'm not adding that particular feature in this particular election,
because I don't want to just do anything on an automatic mode.
If you are if you are doing it on manual mode so you can understand it, you can put your hard work,
your brain on it.
But in case of automation, what you need to do, it is simply copied and copied this particular copy,
which will let me do it for you.
OK.
OK, why does not?
OK, so in case of automation, you need to simply copy this email and put the button there on the tool
and it will simply tell you what kind of environment it is it has and you need to exploit it.
And so that is not the best way to learn ethical hacking on a website hacking.
So the best way to do it manually.
But there are some cases where we need automation, so there you can use it.
But in case of a conviction, if you are able to get all of these things so there is nothing like you
will go with automation.
OK, so this is all about this lecture.
I understand it.
And thank you for watching this lecture.