Hey, guys, welcome back to another episode on How to Hack.
So here we are, a beautiful day, too.
All right, so this is the open web application security project.
Mutability to Help helped us learn about Web application vulnerabilities.
So in today's story, we're going to look at how we can actually pull out information from the database.
So over here, we can go in and click under log and register.
All right.
And we can go ahead and click under please register here.
And I want to highlight some really important points when we're trying to pull information from a database.
So not all the times are you able to do, for example, do a search warrant where you can then do an
injection of your payloads.
So sometimes a lot of Web application servers or services allow us to create user accounts on the website.
So in this case, we have to use a name for you, which is usually static.
So user name don't change in your password for you, which is usually injected and only updated on the
database.
And so, again, you may not be able to retrieve the password at all.
So it's just a insert into and it just verifying at a back end.
So you have no idea and have no way of retrieving back to password.
All right.
But one really important way that you could utilize is to look at what kind of data is usually quarried
from the database back to the Web application server and then being displayed for the user.
So in this case, we have these signature few, sort of signature few is usually dynamic.
So users are allowed to change the signature, which is an insert into query into the database.
And at the same time, when a user views your profile, it will be able to do a select from signature
so that you will then be able to retrieve those data as a result of that.
All right.
The signature for you is going to be a very important for us to be able to get certain values data out
of the database or information.
OK, so what we can do is the first thing is to try all sorts of palest to see how and what are you
able to bypass the mechanisms that are used to protect the registration page.
So it could be a Web application firewall doing the filtering, it could be security mechanisms on the
application server.
And so we can go and enter like single code hacks, double slash dash and so on.
Right.
So we drill all this different kind of payloads to bypass de database, bypass the logic in order to
gain access into a database.
So go ahead, click create account.
And of course, we have the error message here.
All right.
Stays the following error number one zero six for you have an error in a sequel, syntax and so on.
And of course, the best part is for your learning is that it even showcase to us what kind of query
is being injected from the Web application server into the database.
So this is very helpful in helping us understand what kind of glory is sent from the Web application
server and into the database over here, hearsays insert into account.
So they are inserting a new role.
All right.
With the following values into the following columns, which is the user name column, the password
column and my signature column.
So all these are columns, names.
All right.
So what we can do next is to copy, to copy and paste it into, say, a notepad or a mouse pat.
So another thing I want to highlight is that majority of the time in the real world, when you're doing
a bug bounty and a Web application penetration testing, you're not going to get that kind of details
in terms of error messages.
What are you going to get?
State is chances are just an error message and error page.
OK, and that's it.
So then how can we prefer to test it out?
Paperless working.
So you use one very common method, which is to put the database to sleep.
So you let a database sleep for, say, five seconds.
All right.
And when a response really comes back to you after five seconds in Nienstedt, your payload is working.
You have access, right?
You managed to bypass these protection mechanisms.
All right, man.
To Futter to sanitize the input.
OK, so what we can do next is we can go ahead and copy the following payload.
And let me explain to you what all the palace me.
All right.
So we can go ahead and copy the payload into username for you.
So we have the following X, X and database.
So we have access to username and password and database to be inserted into the signature for you.
So go ahead and click critical and it stays the following account.
Create it one role in sort of one roaster.
Right.
So go to Ops twenty seventeen, a one injection sequel.
I extract data, click onto user info sequel rights to go ahead enter to name as well as the password
and click view account details.
All right.
So right here, we can find out now the database name is Mutilates.
All right.
So what else can we do?
So going back to please register here, we can also do the following so we can insert a following to
get the version of the database.
So go ahead and enter the following exit username and password and version.
OK, and at the back, as you can see here.
All right.
We have a double dash followed by Spazzed Dash.
So, again, we can add a sequel, Quarrie with depending on what kind of database version if you're
running, it could be a semicolon, for example.
Here we go.
Double dash, lullabye, spazz dash.
It could be a double slash and so on.
So all those are different ways for us to end the scoring.
So go in and click on the create account.
So in this case, we states we see the following account created one row and set it.
So go to Olofsson twenty seventeen, a one injection sequel, extract data, click onto user info.
So right here again I can enter X, Gulabi X and view account details.
So right here we can see the following.
We have the.
Signature, all right, that actually reflects the version of the database.
All right, or possibly I'll write a version of the operating system.
So, again, depending on what kind of database you're running.
All right.
That will allow us the ability to view those data through the queries.
So, once again, I hope you've learned something valuable in today's tutorial.
And if any questions, feel free to leave a comment below and I'll try my best to answer any questions.
And we'll like the channel so that you can be kept abreast of the latest cybersecurity.
Robert, thank you so much once again for watching.