Hello everybody and welcome back.
And now let's start off by trying to exploit our first target which would be our always work machine.
So I'll just close this which was from the previous video we do not want to save it.
Let us just go on to our virtual machine and also go to the once again to the vulnerable Web application
which is DV W A.
Once you get there if it asks you for the log in screen just up there.
Admin Admin and it will open up this window from there you just go to the actual injection right here.
So as in the previous command injection tutorials ask you can also be used to query with the get method.
So if you have a source code to the Web site you can easily see if it is vulnerable to the actual injection
but it is more.
In most cases you can have the source code right here.
We do have it as we can see if we click right here on The View Source you will see the source code of
this website and we can see our actual query which is right here so we will get to this a little bit
later on.
For now on let's just see what this website is all about.
So as we can see we get we get prompted with the user I.D..
So you already could possibly be some kind of a number.
So let us just type here one and submit it and we will get the first name and the last name or surname
for the user I.D. under the number one if we type here.
User I.D. 2 we will get the user I.D. under the name under the number two.
So that would be Gordon Brown.
So we can conclude that this website is basically the is basically giving the first and last name based
on the user I.D. that you typed right here.
Now let's try here 32 for example.
There probably isn't.
So as we saw if you typed here 32 it won't give out any awkward since there isn't a user under the I.D.
or of thirty two or three either know what type I forgot.
Doesn't really matter.
So let's continue now.
It all seems good for now.
But what happens if we type here a special character that is used in programming languages for example.
Now we can cheat right here and type and view the source code but the basic check the most basic check
for the actual injection is always the apostrophe a single apostrophe
in most cases.
Once you type this it will if the server is vulnerable to the ask injection it will print out an error
it will say that for there was an error in the ESC will query and let us just check that out if I click
here on submit you will see we get some weird error that says you have an error in your ask you out
syntax check the manual that corresponds to your my actual server version for the right sic the syntax
to use near this at Line 1.
Now if you see this on any website it means it is vulnerable to the actual injection because this error
means that we actually entered something that messed up with the servers code and it even says it right
here that we have an error in askew else index.
Now that error basically is the three apostrophe one next to another.
So in order to explain that a little bit better Let just go here and you source.
Let me enlarge this.
We can see that this is our actual syntax we can see that basically as I explained in the previous video
it selects first name and last name from users where user I.D. equals.
And then here it types the any input that we typed in the user I.D. form.
So for example if we type there too it would print out to the user the information about user under
I.D. too.
And you can see that the idea is it has the apostrophe from the left side an apostrophe from the right
side which means that the user input is anything between these two apostrophes which is good.
But what happened when we typed another apostrophe it happened that this basically let me just show
you let me copy the entire command letters copied and let us open a leave pad so really had it open
so just open once again and paste a comment right here when we typed the user under now under IDEA TO.
IT LOOKED LIKE THIS WHEN THE typed user I.D. one it looked like this.
But once we typed the apostrophe we had these three apostrophes and it counted first two as the part
of the query and the last one was basically
basically SGA.
Didn't know how to interpret the left apostrophe and it gave us an error an error in sic text in obscure
language which means that it actually read our apostrophe as a part of the code and that's how we know
that it is vulnerable to the asshole injection.
So let me just open this now and most of the time you won't have this code but you can actually try
to guess how the code might look like based on the website itself.
So we could actually guess once we type here too we know that it queries for the first name and the
last name from some table with users where I d equals to now.
Now now that we know that it is vulnerable we can actually try as few of other things so let us try
to actually type here too and add the apostrophe which would end the first which would be the correspondent
to the first apostrophe in the source code.
So let us keep the source code right here
so for now on the select first name last name from users where user I.D. equals one apostrophe to then
second the apostrophe and then we can check right here for example and which is escalating text and
one equals one Now let me just delete the last apostrophe since we already have it specified in the
source code.
What this does is basically it will check for a condition if 1 equals 1 which is always true and it
shouldn't give us any error if you just paste this in the R instead of the idea you will see that it
is a good written syntax for the rescue L and it shouldn't give us an error it will print out the idea
of user name 2 and it will not print anything else.
So if we just type you submit you can see that it's just printed the Gordon Brown which is the username
under Ida too.
And it also checked if one equals one.
And since that is true it didn't give us any error but let let's do the same thing and instead of one
equals one we typed here 1 equals 2.
Now since this is not correct one is not equal to it will not print out anything.
So basically it wants to print out the Gordon Brown or anything else.
If you click here submit you will see that it doesn't give us any information since it would only print
out the username under I.D. too if the second condition was also met which it wasn't since one is never
equal to two now you might be asking.
Let me just type here.
Why am I not using the apostrophe at the beginning and at the end.
Well basically I already have those two apostrophes in the source code as you can see right here.
It starts off with the apostrophe.
Then we just type here too.
And then the second apostrophe and one apostrophe.
Then one second apostrophe equals.
And then another opening apostrophe 1.
And we have the closing one right here.
So we do not have to type it.
If we were to type it we would get another syntax error since we have another apostrophe which is not
which shouldn't be there as we can see right here.
We have a few extra apostrophes so we do not type the apostrophe at the end.
Now that we know that we saw how this works let us actually try to find out how many rows and columns
and tables and all that kind of stuff are there in order for us to get to the valuable stuff which would
be positive which would be usernames and passwords.
So in order for us to find out to the existing number of columns we should type here this comment.
So we delete basically anything I'll you just delete also retype your two apostrophe and then we use
the command order by
and then we type you one.
Now what this means is these folks try to find the existing number of columns.
This order by 1 will basically see if there is one column and we will just go one authored by one authored
by two or by three.
And once he doesn't give us anything it means that there is not a column under that number now.
After this what we want to do is type your hash tag.
Now we won't be asking why are we typing the hash tag now or basically hash tag is the comment in the
Eskimo language.
So anything that comes after the hash tag is a interpret it as a comment.
So we type your hash tag and then apostrophe and if we type right here we can see that the column one
exists.
Now let us try to see if there are two columns for example.
So we type here the same command but instead of one we want to check out two.
Does that exist as well.
And it does.
And let us try to find out about the third column does the third column Colin possess exist in the database.
And if we type out here it will say unknown column three in order clause which means our database only
has two columns for now third one doesn't exist.
And that's why we get this error now that we found out how many columns are there.
We can basically try to do what we can basically try to select them both and see what they are.
We want to see for example in which order are these columns and we do that with this as well query which
is two and basically I maybe I didn't mention but this too is the idea for the.
GORDON BROWN I believe.
And we use that so we can specify another command after that.
So it gives us our desired output so we will use union select one and then come up 2 and then hash tag
apostrophe.
Basically this will give us in which order are these columns and these two columns that we found out.
If you for example found out that there were three columns right here we would just type here.
Another comma and then three.
But since we only have two we just type here one comma two and we can see right here that the first
name is the column number one and the surname is column number two.
Now this union command right here that we used basically it is use together results from two queries
as we can see right here so we will continue.
We basically just found out some of the uh basic things right here.
But we will continue to exploit it in the next tutorial.
So I will just cut the tutorial here and we will continue from where we stopped right now.
And I hope I see you there and take care.
But.