OK, so now let's talk about fuel injection.
This one is big, so escarole injection takes advantage of input that is used in an oil query that's
not being sanitized.
So the result allows the user to execute any escudo command that they want to.
And typically, this will allow an attacker to dump the contents of the database that the application
actually connects to.
And if they you know, if they're able to send in the correct commands.
OK, so let's go over some basics of aspro injection.
So the typical rescue you in pretty much looks like this.
So select user name from users where ID equals zero.
We kind of went over some basics of escudo before.
So this selects a specific user name from the user's table where the ID is equal to one.
So that's typically like something that you will see like in an application and some code that would
actually collect the data to actually do this query would look like this.
So it was going to say, like, you know, it's going to make an ID variable and B and it's going to
make it the equivalent to the ID.
That variable has passed in from the get request and then it's going to make an I.D. variable and it's
going to say select username.
So from users where ID equals the idea.
So this is pretty much exactly what we just did.
So we just talked about.
So if we could take advantage of how all interprets the input and the fact that the application doesn't
sanitize, you know, what it's giving, then we can actually use the ID field that we were able to
execute whatever commands that we want.
So I want you to take note of those single quotes that are around the ID variable.
And so those those single quotes actually start in an actual string.
So if we do this so knowing that we can actually use that to test for one injection.
So let's actually go over to the map and try this out.
So we're back in our politics machine.
We're about this some esquibel injection.
So we're going to do it manually and then we're going to do an automated version of it.
So right here, the tool that is vulnerable to injection.
So let's actually start to type in some stuff.
So the user I do this, try one.
OK, that says admin.
OK, two.
Gordon Brown three.
Hack me, don't worry, I'm going to.
So it looks like it's just taking numbers and pulling the names for the uses that correspond to those
numbers.
So let's look at the source.
Check it out, see what's going on.
So is getting the I.D. this passed in from the get requires setting this Quarrie equal to the corrida
we had, you know, that showed you guys before.
And then what I want you to pay attention to right here is the key variable that is sitting right here
in these single quotes around these quotes in school, start and stop a Marsico string so we could potentially
take advantage of that because it looks like the code doesn't sanitize anything at all.
So what we can do is actually try to test this out to see if it's vulnerable to escarole injection.
So let's go back to it.
And this is the single quote, and that kind of breaks the query a little bit.
So it gave us an error.
So it says is an error.
And now we know if we didn't know before, this is my SQL Server.
It is important for like Syntex stuff and specific characters that you would use for the commands like
it was Mariotte.
Maria DB would be different, like commands somewhat.
So now we know that it might be injection might be possible.
So just really quick, this will mess you up.
If you didn't set the security back too low for the app, go back to Devoir security at the security
low.
We're not going to go to meeting them just yet.
So let's see user ID.
So let's try to actually put in one and then a single quote and then put a space or one equals one and
then a pounce on.
So this is going to do it saying, you know, if you look at the query is grabbing the usernames where
it equals this ID that's given.
So where equals one or so since we broke out of the query with this single quote and then we did or
come command, which is also, you know, something in my school, one equals one.
So that's always going to be going to evaluate out the truth.
So this is going to pull users that whether ID equals one or one equals one, which is always true.
So it's in my cycle and it's just going to pull everything in.
This Palsson actually starts a comment in my school.
So it's going to cancel out any other any comments after this and just have it as a comment so we have
complete control.
So if we submit, we just dismiss you all injections and now we got it to list out all of the different
like uses that are in there.
So now we know that these users exist.
We know that we can actually inject, you know, as you well.
So let's actually try to actually do a different ask you welcome in and actually try to pull out the
different like passwords.
OK, so here are the command that's actually going to allow us to pull out the passwords.
So we have the one and then the single quote.
This allows the break out of the query and start our own query.
Then we have or one equals one.
So this is going to just pull everything.
So I was going to evaluate the true we have a union select sort of unique command which combines the
results from multiple select segments.
So we have unions' select user common passwords.
So we're going to look for the username and the password from the user's table.
So knowing that, then we also have the pound sign, which, as you know, creates a comment and prevents,
you know, any of the commands from running and allows have complete control.
So we actually submit this one.
Oh, crap, look at this.
So now enlisted all the user names and then also a list of the user names in their hashes.
So that's pretty neat.
So now we know there's a user admin.
It has Gordon B, that's the user name one three three seven.
So we have the hashes here as well.
We can actually do is actually take these hashes and put them into a worry list and actually crack them
with like something like John.
So let's go do that really quickly.
OK, so I have my hashes into a file.
I see them as hashes Devoir hashes in the home directory.
So I'm going to go over here.
And now we're going to ask you this, John, in so doing, pseudo John Dash as wordlist and now we're
going to feel it in the Rocky Datsyuk.
See where Liz has located and slash user share slash wireless directory.
And this is pretty much a gigantic worry list that has passwords and all kinds of like database leaks
and most of the time will crack passwords for you.
Then we're also going to tell it the format of the hashes, which is going to be raw and D5.
So we do a dash dash format equals raw dash and B five I don't believe is case sensitive, but you can
type like this exactly if you want to, and then we're going to feed it in the password hash file that
we created, which for me is debatably hash is.
And that's going to hit inhered, so I've already cracked this hash before, so it already has done
it.
So what we can do is actually a pseudo John Dash.
So and then does this format.
Equals four and five, and then we'll get to a DV debate, hashes enter.
So now I was going to tell us what the passwords actually found to be.
So the admin password is hacked.
As you can see, I didn't put the usernames on here, but the first one was admin.
So their password hacked.
Going to be as ABC one, two, three one three three seven.
Their password is going to be Charlie.
The next one is going to be let me in.
The next one is password.
So that's pretty neat.
So let's try this, just try one of these just to prove that it works.
So let's see.
Let me in is the fourth one.
So this a back here.
Pablos So let me in.
Let me and Pablo Pablo let me in and we're able to log in.
Hang in.
Pablo actually, you know, as own specific picture that comes up.
So it's very neat.
Now we know, you know, how to go from escarole injection to getting hashes to cracking those hashes.
OK, so we did the fuel injection manually.
So now I'm going to see how you can actually do all of that very, very quickly automated using secure
map.
And it's not too complicated.
So we're just going to use this camera right here.
I'm going to walk you through it before we execute it.
So are you going to do is first you going to press as you our map and then you're going to type in dash
you and then this is where you're going to put the host, the target host.
So right here, we have our address to our Twitter machine and it links out to the school page, which
is this page right here to ask you all injection page.
And then we have our arguments that we're passing in our variables that we pass in any URL, so I'd
equals one and somebody will submit this is giving the information that it needs to actually be able
to, you know, test for injection.
And then we're going to pass in our cookies because remember, we need our cookie to be able to authenticate
and get actually out to this page without this cookie argument is not going to work.
So we're going to do Dasht as cookie equals.
And then you can just come to the Web browser, you can do control shift.
OK, this is going to come up just like before document cookie and it will give you that and you can
just copy and paste that into here.
So it has our recession I.D. and security equals low and then we do dash b dash dash current dash divi
dash dash current dash user and then dash.
That's done so well.
This is going to do as humans go through tests for injection.
That's going to tell us what the current database is like.
If my school is a very D.V. that's going to tell us the current database user and then is going to dump
data from the from the table.
So let's go ahead and execute this and see what we can get.
So once we execute, it is asking us this says we got to drill on redirect.
This is the euro we actually wanted to redirect us to.
That's where we want to go.
So just hit enter and then now is actually going through and testing, you know, for fuel injection
and everything, and especially the database.
So it's actually see you can see that it found the database, W8 and especially the tables, is fetching
the uses table inside of that and is asking us now if you want to store the hashes, you know, it's
a temporary file.
So we just had no right here.
And then it's also going to ask us, you know, if we want to crack them via like a dictionary based
attack so we can actually ask you.
I do it for us.
So you said yes.
And now we printed out a nice pretty table and less than probably a minute the user's their password
hashes and the cracked version of those hash.
So we actually ask you what actually went through, automate the entire process very, very quickly.
Found actual injection, extracted out the hashes, cracked the hashes and gave it to us in a very nice
and pretty format in the table.
So that's pretty neat.
So that's the power of escudo map and that's how you can kind of automate as Google injection process.
OK, so now we're going to do blind escalon injection.
So when you don't ask all the action, it's not always going to output errors.
We look at the source code for this one.
We're going to see that as a little bit different.
They took out the dye come in.
That actually put the well here is out there so that they suppressed it.
This actually decent practice it because you don't want to show users of applications of errors because
it can lead to L.A., for example.
So this was suppressed.
So we can still use the application like normal.
So we know that the queries enter before anyone.
So you start with why, you know, two, it still works as normal.
If we type in this single, though, like before, we're not going to get an error.
It's just going to reload the page.
So now we need to figure out of the way, you know, if our query is actually, you know, going through
and such.
So what we can do is do a true and false test.
So like before what we did have one, then the single quote, then we did or one equals one and a pound
sign.
This works.
So we know that that command is is actually executing and then we can also try a false condition.
So we do one and then or one equals two and we just put the panels on again just to keep maintain control
over the query and only execute what we want to execute it.
So now we know that since we did that, it did a false condition.
So it only grabbed the idea, the user with the line.
So before us, this one equals one.
He grabbed everything but says we put one equals two is a false condition.
So it just did the it just pull the user with the ID of one.
So we know that, you know, our queries are actually running since these pages are, you know, show
different output.
So there's something called the MySQL sleep function that we can actually use and a pretty much a way
to kind of like delay, you know, execution.
And if that works, then we know that our ejection is possible.
So we do one apostrophe that we could put it in and command and then sleep and let's put it inside of
here at the pass in an argument.
So this past tense.
So this is going to make it wait ten seconds, let's put on a pound sign and this is not allow us to
maintain control.
So it's a comment if we submit and then it's going.
So remember, before it was pretty instantaneous, but now it's actually taking time.
So it's waiting ten seconds and then is going to execute the actual command.
So now we know that our, you know, ask you all query is actually being executed and blind as to all
the injection is possible.
So in order to pull data out of here, we're going to have to use the escudo order by.
So we're going to want to do is the one apostrophe.
And then this is going to break.
This is sort of the single call Bergsten's out.
So let's do an order by and then one.
So this is what we're going to do is just slowly increment this number.
This is going to show us how many columns there are in the table for us to be able to actually pull
out data accurately without, you know, running into some type error.
So let's do the exact same command, but then let's put to one single call or two by two and then put
a price on it.
So now we know that that one works right there.
So there's at least two columns.
So let's do one more order by and then let's put three.
So nothing came back this time.
So we know that there are at least two columns in this in this table since.
So now we know that there are two columns.
The next step is to actually dump the database table names.
We can do this using a unique command.
So I have the command typed in here.
So we're going to do a one single quote to break this out of the query and then we're going to do a
union all select would it do one and then comma group, OK, and then put table name in there.
So this is going to pretty much concatenate the table names that it finds inside of the.
So the next step is from information schema that tables where tables go schema equals database.
So this is very much going to take the group names and patni them together and put it back out to us.
So now we're going to be able to see, you know, what tables are actually in this database.
So if we submit this command.
So now you can see, as our command put it right there, but what's interesting is that right here in
the second one under his surname, it says Guestbook and users.
So now we know that these two are different tables.
So we know guestbook is a table and we know users is a table.
So using that information, we can do something similar and actually use the same type of command and
actually pull out the username and password from the user's table.
So now that we know that the user that the user's table exists, we can actually dump, you know, the
username and password from that table.
So let's actually just do a similar command.
So we're going to use our one and then single quote to break out of the query that we're going to union
all select.
We're going to put one comma, we're going to do group concat again.
But this time we're going to need the username and password and then we're going to grab it from the
user's table.
We're going to put this pounce on and start the comments so we maintain complete control.
If we submit it gives us background information.
And now we have the admin username right here.
And then we have actually the password hash right here.
And it's just the same as before.
Same here has all the users and their hashes patinated together.
And you can format this a little bit better to play with the commands.
And so I actually recommend and challenge you to go do that, make this a little bit pretty open, but
that is typically how you can conduct on escapology.