All right, welcome back, everyone.
This is a speech and this session is actually about hacking or performing the injection manually, and
this session will be getting access into our target Web site without even having the valid username
and password.
All right, let's get started.
So for those who will be making use of.
Yeah, let's first get into a candy machine.
Yeah.
So this is where we are and we need to have.
So let's log into our Altero Mutual, by the way, the actual name is Temodar.
That's fine, but it is pretty easy to remember this spam.
OK, so now we are on on our Altero side from each side, and now it's pretty, very similar to any
banking thing.
But remember, this is just a demo site and intentionally infected site itself, so you go to sign it.
So now we have just learned that there's a payload which we could use.
We can make use of the payload that we created, which had apostrophe, and then R one is equal to one
that was for user name and then for the password we can use anything great.
So let's see if that works so I can use both stuff.
OK, and then or one is equal to one.
And then there was the double down after that.
So if you remember correctly, this was the username where I posed to indicate to ignore everything
before this.
And double dash indicates that anything after this will be taken as common.
So it is just a common denominator.
Then what would be the password?
So if you remember, I said you're going to have passwords, anything, so you can have simply anything.
I mean, you can type even just the term typing desk.
OK, it doesn't matter what you type after this.
But remember one thing, you have seen the signaling, what it comma that is just to indicate there
is some string inside, some some something into it.
But because we are in the field at this moment.
So you don't have to do that.
Right.
And what you have seen as a part of a.
Great.
Now once we submit this information to the Web application, the application get it.
And this will be given to the database in the script query format and Lowville head blogging.
And we'll see if we get the access to the system right.
Without even having login and login.
Valid login and password.
Right.
That's it.
And let's see what happens.
Oh, wow.
Lovely.
Can you see this?
We actually got the access to the system as an admin user.
And this is we are already into the system.
We can view our accounts.
We can view over a checking account.
We can see the balance, our saving account details.
We can see all the information in it.
Right.
So it is possible and this is the way we can begin compromised the system as well.
Now, this is this is something we tried on the infected system most of the time.
This is not the only way we can compromise the system.
There are possible payload.
We can have we have budesonide right now.
You may ask, OK, how do we get all those, you know, possible strain for first things?
You have to learn my script quite quickly.
First of all, the way I have talked to you about how the how the my school is basically how the individual
rules as created databases created exactly the same way.
There are multiple Syntex.
So you have to learn those indexed.
You will have to learn the union as well as a part of a screen injection, which I'll teach you in the
advanced section as well in advance section of Web application.
And that's but as you go further, you have to really be smart enough and understand the skill already.
Second, as you have to you have to understand the need in the real world.
You have to test and try multiple keywords.
You have to make use of multiple databases, which is available on the GitHub.
If you remember when I talked about the lab setup and the resources video, that's what I have mentioned,
you three GitHub repository.
And that you can if you go to all all of them individually, you get to see there that are individual
dictionary and that individual payload for the screen.
So you can copy all those Eskild injections, you know, below and try and assume this is the manual
way of doing it within.
The next station will be making use of a tool called UpSweep to perform the same operation.
But the beauty is, if you want to do it for multiple trial and, you know, multiple trial, you have
to get into it.
You will you will get a login for a year.
You will try another payload, organ failure, trial and error, all this stuff.
But the bumps are it it just automated.
You have to just plan your payload and wait and watch what's going to happen next.
All right.
So I hope you like this session with catching the next one.
Thank you.