Hey, guys, welcome back to end of the episode on How to Hack.
So over here we have mutal the day to running and Mutulu Data is a vulnerable Web application platform
that we can perform all penetration testing on.
So wonderful platform for us to learn all about Web application penetration testing.
And on the left site, we have a website so open Web application security project, and we have 20,
17, 20, 30 in 2010 and 2011 seven.
So wonderful way for us to learn the history about all these vulnerabilities and how we could possibly
exploit them, the evolution of all these security vulnerabilities as well.
So if I go under the left side of Ops twenty seventeen or a one injection sequel I which stands for
a sequel injection and we can click onto the first user info sequel.
All right.
So over here we need a username and password to view account details.
So right now we don't really have a user account being registered or created.
All right.
So if I enter some name and password, likely not be able to indicate.
So we need some kind of a translation mechanism.
So the first thing that we can do is always to enter the following, which is to check.
All right.
Whether the login or input form is susceptible to a.
Single quote here, so go ahead and click on view account details and immediately we see the following
result of feedback coming from the database system.
And in this case, it has the MySQL handler.
All right.
And it provides us some error messages.
So in this case, we have the following.
So we have you have an error in a school syntax check tomatoe to correspond to your bicycle subba version
for the right syntax to use near, etc..
And we have to query and it even provides us TIFU query.
So if you think back about defense, we have to make sure that whenever there are such error messages,
OK, all these error messages are only accessible to Internet employees like the administrator, the
Web admin.
All right.
Rather than being displaced outrightly here where anyone could actually see the results of those inputs.
So from the following technical, they'll be able to pick up all these error messages that could help
80 hackers to perform more precise attack using very specific payloads.
So in this case, we have to query Anastasiya following select all from a culture where username and
password equal.
So right here, this over here.
All right.
I've highlighted is where our payload went in.
OK, so right here, the payload actually went in.
And this is the whole structure of the Syntex.
So what we can do next is to enter the following.
So I can do singer all right.
Or one equal one and I can copy the following organic and can into a password and go ahead and click
on a view account details.
All right.
So what exactly are we trying to do here?
We've been following the falling payload before I show the results.
What we are trying to do here is to close the first part, which is the username and or one equal one.
So anything or one equal one is always true because one is always equal to one.
As a result of that, we are able to run dictionary as intended.
OK, so next is also to do the same for the past few.
So again, if we pace it, you click viewer call details and when we scroll down immediately pulls out
all those information directly from the database.
So you have your username, you have your password signature.
So you got all these usernames and passwords.
Now we can use them to actually log into the Web application server to run some attacks or further attacks
using other people's credentials and accounts.
So that's exactly how these hackers could do it.
So right here, we can toggle the security level.
And I'm going to toggle this to security level one, which is clean site security.
So going back to Ops twenty seventeen, a one sequel injection, extract data, click on a user in full
scale.
So we're back here again.
And if I enter the following payload and I click view account details immediately, we get stop by JavaScript
states to following dangerous characters detect it.
We can allow disk much like padlocks filtering cannot be defeated.
So as a result of this, whenever you have any of these special characters, it gets checked at a browser
level on the JavaScript that has been downloaded into your browser.
It checks to Paillard before it is given the opportunity to be sent into the Web application server.
So what we can do is go to the top right corner.
All right, click onto the preferences tab, Orient scroll all the way down and click under network
settings and click under menu proxy configuration.
So this will be the proxy where you're running Web Street, all the WhatsApp or any of your own proxy
that you want to intercept the payload before we send it over to the Web application server.
So in my case, I'm going to enter one two seven zero zero one one followed by the Port It 080.
So click OK on this open up terminal.
And what it can do is go ahead and enter suite.
All right.
And hit enter on this.
So this will begin the community edition.
So go ahead and select temporary project.
OK, click next use Burp D for Starnberg.
So we have here the proxy that has the intercept is on.
So I can go back to Firefox, go back to the browser and right here I'm going to enter name for example
Tarsa as well as the password test and go in and click on a view account.
Details so purposefully is now intercepting all connections from the browser to the Web application
server.
So in this case, you can do a right click and send to repeater and your repeater tap on grapeseed will
be blinking an orange and you can see the following information.
Right.
So we have to your name as well as the password right here.
OK, so we have to test as well as tests.
So what we can do next is to actually look back into the payload.
So I have to payload right here that we need to send over into the Web application server so we can
send it directly from Pepsi.
So I can.
Hasty information here, all right, to use your name, as well as to the few pastorate, OK?
And when you click send, you notice we get an error, so it's four hundred bed request because there
are pallets of single cut, so you kind of messes up the you all information.
So what we need to do instead is to go under the decoder to decode ATAP pastie information right here.
OK, and we can look at following so we can encode as you are l and we'll get the following information
so I can copy now, now that we have to you are including copy the information, go back to repeater.
And in this case what we are going to do is to remove the previously use payload.
And we replace it with the new payload from the Eurorail encoding, so pace it like Weisse for you,
pass it for you.
All right.
And go ahead and click send.
So once you click send, you can scroll all the way down.
So this is the part where we're able now to retrieve a probable response from the Web application server.
OK, so right here we have the results and we have the following information, twenty three records
phone and we have to username Etman, we have to pass Impasse Pass.
We have all these different details right now of the username, as well as a password that we can use
to help log in and access into the Web application server.
So right here we have security level five as part of SQL injection under user Lucka.
So over here, what we have done is you can actually go under preferences and you can click on the network
settings and you can set the manual proxy configuration.
Click OK on that.
So what we need to do is to be able to intercept a traffic that is going to be sent over from the browser
into the Web application server.
Click view account details.
All right.
And we have it here so I can go on a proxy and I can actually do a right click on this and I can send
to repeater.
OK, so on a repeater.
So we have all this information like the username, the password that we will be fuzzing so you can
do it right.
Click and send it over into intruder so you can see the intruder tap running over here.
And we can look at the positions that we want to highlight on so we can clear any information.
We can reuse the same session ID.
All right.
And we can have the user info dash summit button to be clear as well.
So we have to fuse that.
We'll be testing our payloads on it.
And of course, if you click on our payloads, we can load the payload.
So if you go under this particular folder under us, our share what list w phos under injections.
So we have some ejection.
So go in and turn that and it will list out all the payloads that we can utilize as part of the attack.
So that can be a lot, a lot more kind of payloads that we can inject into the system.
All right.
So once you have all these details in place, all you can do a check on the options and you can go ahead
and click start attack.
So once you click OK on this, this will be sending all the payloads into the Web application server.
So in this case, we have multiple responses.
All right.
And of course, on level five, what it does is that it is a server site, server site check validation.
So as you send those payload on the server side would actually be validating what kind of payload you're
sending into orbit and ascertain that you are sending a proof list of payloads or depending on what
kind of filtering technology they're using, what kind of ways they're utilizing to actually stop those
potential malicious payloads.
So I'm going to pass the intruder attack right here, OK?
And I want to highlight what we can utilize, which is SQL Map to help us run the attack.
So SQL Map is another form of a sequel injection or an automated sequel injection that can help us pass
all those different payloads against the Web application server as well as the database so that we can
ultimately retrieve those data and information.
So I have the instruction right here, so I'm going to copy this whole list of komando instructions
we can send, opened up a new terminal and I can pace the instruction here so I can go ahead and enter
SQL map so I already have it.
So we have the IP address.
We have the link.
All right.
Indexed and use the dash infl and we have the username and password for you and go ahead and hit enter
on this.
All right.
And right here.
All right.
It starts to follow.
You have not yet declared cookies.
All right.
So we can use a new cookie.
Yes.
And of course, right here we can look at these results.
So over here we have the following information stays to following.
It is subjected to a time base.
OK, so it is a blocking sequel injection, meaning that when we send the payload into the system,
we are not sure what kind of response is coming back.
So what we can do in those bowline base attacks is that we can do a sleep and wait, OK, so we can
wait for the response to come back to gain or wait for some of the instructions to go through.
So if the Web server is waiting for, say, five seconds and five seconds later, it then reload the
page, that will be an indicator that the psychologic injection works for this particular type of payload.
And in this case, we have the following payload.
So we have to each user info and username.
So we have a single quote and select nine four zero eight from Select Sleep five.
All right.
And and Alex.
All right.
And if Lobi password for you.
So this helps us gain access to the system in a second one.
And work is a union query.
So unit growth right here.
So username union all select null and Katani and we have all the payload right here and again right
here.
Allow us again the ability to actually access into database ultra.
Helping us retrieve all of the database names out of the database platform.
All right, so once again, I hope you've learned something valuable in today's tutorial.
And if I have any questions before you leave a comment below and I'll try my best to answer all of your
questions and feel like I've got the channel so that you can be kept abreast of the latest cybersecurity.
Thank you so much once again for watching.