All right, so welcome back, everyone.
This is Rick's List, and we have reached out to one of the very, very important section.
This is about a secure injection, widely popular.
Still, many of the websites are vulnerable to this attack.
OK, and if you if you even recall what we have learned in the last best practices, security testing,
best practices, the first was information gathering, then the input output manipulation.
All right.
So input on foot manipulation, as I said earlier, than when the attacker compromised, when I thought
I could exploit the server by sending the data, by sending the data into the server.
And if the server is not performing any sort of standardization, it can actually compromises that we're
OK.
So the in case of a skill injection, it is all about the data coming in to the databases.
OK, Eskil is the squaddie language.
It does the query language for the database.
So whatever we send of whatever the request, we send it to a website or web application on the backend.
The Web application then forwarded to the database and that's where the compromises and all the vulnerabilities
really arising.
If the database is not performing any kind of sanitation or the Web application in the whole not performing
any kind of input check sort of thing and check if it is not doing this and attack it on malicious user
can send any sort of data which he cannot generally able to see.
Right.
That's what we are actually going to learn here.
So that's a good indication.
It's the first thing is in order to understand it, of course, it's a Web security vulnerability where
and the attacker compromises the vulnerability we're sending make use make use of a vulnerability in
the server.
If the server is not performing any kind of input check by sending in a script, great, OK, by sending
a database query to the server directly and then allow the attacker to retrieve the information, which
he generally can't see, which he generally won't be able to retrieve.
Right.
So information like customer information, credit card information, personal information, it could
be even password credentials hash a combination sasebo.
Right.
And in case of a successful Escorial injection, if the attacker is able to make any privileged escalation,
it can even follow or you can even perform the denial of service attack where it can prevent the genuine
user to get the access from these to get solved by the server where in the dummy or dummy traffic will
be available to the server and then the normal user won't be able to get this service from the server.
So that would do so.
It could be a complete destruction in that situation.
It can even be make you meet.
It can even be useful in case of long term optimization, like advanced persistent threat.
If the skill injection is that powerful at all, depends on how strong you are.
The greatest.
OK, at school, Curis has been made for better purpose, for managing their databases, for standardizing
the way the databases are getting structured.
But before you really understand the skullcandy remember this.
The purpose of B2B is to have a systematic, systematic arrangement of information.
Of course, you have on the one side you understand the storage, right?
Just like your hard disk.
You can just keep on storing your information the way you want it.
But imagine in a situation where you have a lot of random information, username, password of address,
location, interest, all those feet you need sort of mechanism, sort of schema wherein you can store
the information in a search or get or, you know, you can organize the information so that whenever
you want it, you can record the information in a faster way.
So that was the major purpose of standardizing the databases by making Escorial grace.
OK, but it can even be make you it can even be made used for the malicious purposes one.
And let's see how so.
And the normal scrutiny, I'll tell you how exactly the critic looks, so I will be understanding in
much more detail in the photo session, but even better, I'll even teach you how to deploy the bases,
then create the tables, then even make an individual entry into the in the individual room as well,
and then assigning the rights to the individual user.
So we'll be doing that step by step in the fourth position.
For now, you will be understanding the fundamentals of do it right.
So let's get started.
Let's get started.
The first thing is we have user and web server and the databases.
So I understand this one user for the from the user point of view, just a website.
OK, but that server is needed to store the information in the back and the purpose of Web server is
to serve very fast enough and efficiently.
OK, but the information is usually stored in the back and database and the database store the information
in table format.
So in our case, the stable name is student and it has got multiple columns.
Right.
I.T. first name, last name Emin's.
So these are all the columns and the user is might be interested in retrieving the 81.
The data corresponds to Idy one, which is for our Nalu and there are some information available for
him.
So he might mind on the he might go into the browser.
This information might be available on the website.
Right.
So the Web server is having a Web site on the back and he is storing the information user.
Just log into a site, maybe example, dot com and that's where it is asking for information.
Say if you see example, dot com is the Web site, then it goes to a certain maybe, maybe a tab, maybe
tap on the on the top and the tab.
He wanted to select the item number one.
That's where he get the information about it number when he just click on it.
This information goes to the Web server.
Now, Web server was just about getting the data and give it back.
You know, it is all about
handling the request and the response request and the response.
So on the moment he get the request from the user, it is as a part of you are if you if you are following
me correctly, it is a request.
Right.
And he needs a response against it.
Now, this would be forwarded to the database and in a different format, and that's database form.
And that's the query.
It's good.
Gerti is used to retrieve the information and this is the way it is being used to select information
from students where the ID is like any of them from the table.
Basically their is one.
It means the first information flows through will be selected and that will be given to the user and
the user then able to see that information on its browser.
So that's the way it usually works and that's the standard way of working and that's being used from
years and years did, in fact, the way it has been deployed.
Now, let's let's see how the ESKIL injection basically works this time.
We have a malicious user against the same Web server, same Bidvest, same day, but now malicious users,
in spite of sending the normal query, in spite of saying normally he sends a malicious you are like
he know about these students.
He knows about the Nektar student.
But that also adds some value.
This is that value, OK, Iot is equal to one that is that is seems to be very much valid.
If you see example, dot com slash student I t where it is equal to one.
This is pretty, pretty genuine.
This is there's nothing wrong with it, but there's something very special just after it is equal to
one.
Right.
There's a single column column or one is equal to one.
That means so be the data of one or where or information where one is equal to one that mean someone
will be converting to an equal footing and will be giving to the database, will be going in very deep
about what exactly the square you can do in much more detail.
But just under that.
Understand.
One is equal to one, as will be to always forever, right?
So that means I am through about all the entries.
So in that case, show me everything that matches.
Right.
What's going to happen is website one would be sending a query from a table where is equal to one or
one is equal to one and then dash, dash.
That means anything after this will be considered as a common trait.
So that's pretty much OK.
And that's nothing to do with that.
But one is equal to one.
Miss, I need just like I'm OK with all the information and do show me all the data where one is equal
to one where all the entries are true.
Yes, it is not just one is equal to it's equal to one but entries which are true.
So that means in all the situation, entries will be true.
That's why the entire information in our database will be forwarded through the malicious user.
And that's how the ESKIL injection basically works, because you inject your malicious code into the
query.
And that's exactly the malicious code.
The code is or one is equal to one.
But you can think of is it really malicious code?
No.
Right.
But you are making me if you are exploiting the schoolgoing for the malicious intent.
Right.
That's what it is all about.
You need information where all the all the possibility is true.
That's where all the all the rules will become through all the entries become true.
And you are eligible to read all the information.
And this user who is of malicious intent can get the all the information of the database without any
special privileges.
That's the sequel injection.
So if if this information can be user database, personal information, health care records, username
and password, this could be seen for all the user.
And I just saw you actually on a real on our target website, how we can retrieve all the information
and we can how we can get access to a website without even knowing the login log in it and the password.
And it's going to work just the way I have shown you.
So this is all about it will get you in the next session.
Thank you.