Hey, guys, welcome back to another episode on How to Hack.
So over here, we have already installed Web Gote and we have Web good running.
So we're going to go into a one which is under injection on the left side, as you can see.
So, as mentioned earlier, Web Gote is a vulnerable Web application system that we can penetrate into.
At the same time, they have structured the entire curriculum to make it very, very easy for us to
learn about cyber security, especially in a real Web application penetration testing.
OK, so we are going to go into sequel injection intro.
All right.
So over here, we're going to learn about structured query language and how it is being utilized by
websites, Web application systems, as well as mobile application systems to actually allow users and
systems to store records.
And when I say records, it could be a user database, credit card information shopping cart and many
other database systems that they could actually use to manage and power recording all this different
data.
So, of course, they're going to go through about query, sequel injection and how SQL Fundamentals
work.
So I think this is a really important step in terms of learning how SQL injection come about.
So first thing, first on no.
Item two, what is Eskil or ask who else stands for structured query language?
So it is a query language that help us be able to pool, record updatable information, dilute table
drop tables and all this manipulation inside a database system and a database system can be from Microsoft
SQL.
It could be from possible SQL.
It can be many of those different kind of database systems.
So here we have a table.
So a table is a 2D ruwan column and allow us the ability to store data almost like an Excel sheet format.
And over here we have the columns.
All right.
Sort of columns, as you can see, are identified by the column names.
So we have user ID, first name, last name, department salary of 10.
All right.
So this can be, for example, a password for you that is used to authenticate users into the system.
And a user ID is a unique value, is a unique value to uniquely identify and distinguish across the
different roles.
So all these rules represent data for one specific, perhaps user as part of recordkeeping.
And of course, as we screw all the way down, we can look at how we can construct a system to do SQL
query.
So in our case.
All right, look at the example table trying to retrieve the department of the employee, Bob Frankel.
OK, so what we can do here is we can try to retrieve those data and we can see the Broch.
Franco has a user ID of the following.
So what we will do now is to use of course, you can go to school costs dot com so we can use select
astir extends for all from.
All right.
Employees where user ID equal and we can paste the user ID data over here so we can paiser user data
and it click submit.
So once you click submit it will immediately pull those records that complies to this specific future.
What a user IDs nine six one three four.
And he will pull up this specific roll of all these different details.
So in this case, we can see the salary, the often the department last name, the first time to use
it.
So all those information inside a table with all of those columns in relation to the role will be pulled
out.
OK, so this is the basic of how scoring is being run.
So every time you're logging into a website, you're logging into a site and so on.
What it does is that it will actually pull those records, do a check on a record, and then after that
allow you access into the site depending on whether you pass or fail to log in.
And we have GML.
VML stands for data manipulation language.
OK, so they allow us to select, insert update, delete tables, information and of course, attacker.
If we know how to utilize data manipulation language, they can change to information of a particular
table record or many roles in a table.
OK, so this are the different data manipulation language commands storing, retrieving, modifying
and deleting data.
OK, so over here we have an example where we are receiving and retrieving data.
OK, and now what we will do is to change information of a particular role using data manipulation language.
So what we can do is use update or update will be the instruction that we will send so we can to update.
OK, and not a good thing is that I'll be I'll be pasting into the comments section over here.
So I've actually created and all the payloads that we will use as part of learning about how to run
all these attacks.
So this is for item number to update employees set deposit.
An equal sales, all right, and where user ID is equal, so we are doing a direct Futter again.
OK, so all I got to do is paste the information here.
Update.
All right.
This is the table name set to call them name.
All right.
Into cells and in where the user already belongs to and of course, Toby Barnett has a user idea of
eight, nine, seven, six, two.
So go ahead and click submit on it.
So once you click something on it, it will say you have successfully completed the assignment.
And this will immediately show us the information that has been updated to the department of the user.
So immediately we can find out those details over here.
OK, so we have updated the table.
All right.
So moving on into section number four.
Look at a lesson number before we have data definition, language or so.
This is about creating the database, especially in the area of defining data structures.
Database schemas will let us understand how data should be signed in a database.
OK, so this is also important in terms of the database structure.
All right.
So we have create creating a table.
All right.
Or trimming a table, dropping a table in itself.
So whenever we have a table inside a database system, we have to first create a table.
And by creating a table, we have different multiple columns.
So the columns would have over here first name, last name, user ID.
And over here we can see there was a primary key.
All right.
So one of the columns has to be a primary key to uniquely identify the values inside each of the roles
inside the table.
OK, and then we have variable and character.
OK, so this is the type of data that we are going to input into a particular column.
So over here we have the skill query as well.
OK, so what can we do now?
Trying to modify the scheme by adding to column phone to the table employees.
So over here I'm going to explain to you what the payload looks like.
OK, so we can copy.
All right.
So what we are doing is we altering the table because we have first created the table, but now we need
to add in a column.
So we need to alter the table.
All right.
And then, of course, you specify the table name in this case, employees.
And then we put in at OK, we ate this particular column as well as a column data type var char and
then followed by the open bracket 20 and a close bracket followed by semicolon and instruction.
So go ahead and click submit and immediately.
OK, I can enter over here going click submit and we'll be able to add the information into the system.
All right.
So alter table employees at phone char or character.
All right, so as you can see over here, like we said, the database quickly so that we can rectify
what could have already been added into the database system.
All right.
So we have auto table employees at Ford, which are 20.
So that helped us able to add in this particular column into the table.
All right.
So we've now we're going to pass here.
All right.
And we're going to Section two in subsequent videos.
So once again, I hope you've learned something valuable in today's class.
And if you like what you've just watch, like share and subscribe to the channel so that you can be
kept abreast of the latest cybersecurity.
Thank you so much once again for watching.