Now to try and discover Eskil injections you need to browse through your target and try to break each
page so whenever you see a text box or a parameter on this forum for example page those BHP then some
things equal to something try to inject stuff here.
So try to use a single quote try to use an aunt or the order by statement to break the page and make
it look different.
So I'm going to show you here an example and I'm going to go into the log page first right here and
it's asking me to log in now I've actually registered with my own name so you can just go in here and
register.
I have a user name called Zaid and a password with 1 2 3 4 5 6.
So first let's just I'm going to log in just to show you so my username is Zaid and my password is 1
2 3 4 5 6 and now I'm logged in as a.
Then my signature was a just not a really just like as a test so I'm going to log out and we're back
at the log in page.
Right here we have the page so you can try to inject in that but we'll go we'll get into that later.
So at the moment we're having an example of injecting into text boxes so you can try to inject into
the name and into the password.
So I'm going to put my name Azadeh and I'm going to put a single quote so I'm putting this sign into
my password so let's see if we can break it and as you can see now there is an error being displayed
to us and it doesn't look like a normal error.
It looks like it's a database error.
And usually you'd be very lucky if you get an error like this.
Now usually the error won't be as informative as this sometimes you'll just see that the page is not
acting as it's expected as you expected.
Sometimes it'll just be a page that is not does not look as it should.
For example if it's a news page maybe it will have the article missing or if it's a blog it'll have
one of the posts missing or different kind of posts.
So you need to keep an eye on what's changed in this example we are actually getting a really nice error
as soon as we file it has and is telling us that there is an error in the statement the error near and
the quotation marks that we added and it also tells us the statement that's been executed.
This is really good for learning because now we can see what's the statement that the system is trying
to run and the system is trying to do a select star so strength select everything from accounts where
the user name is equal to Zaid and the password is equal to a single quote and note that the this system
the web application is already adding quotes around the name so when I said Zaid at other data between
two quotes and it adds the single quote that I added between another two quotes so that's why we have
three quotes right here.
So from this we can.
It's like 70 percent of the target website has a nice girl injection we're still not sure if it can
execute what we wanted to do.
So can I actually inject code and get it to be executed.
Let's see if we can do that.
So the user name is going to be Zeta again and what I'm going to do with the password I'm going to put
my password so I'm gonna put one two three four five six and then I'm closing it.
So I'll tell you why I'm closing it because the current statement in the system is it's select star
from
to Zaid
is equal to and is going to open a single code by itself.
So let's call this as password.
So we're treating this as a variable and it takes in whatever I put in here whatever I'm gonna put in
this box and is going to insert it instead of the S password which is a variable.
So I'm just mom giving you an idea.
So you need to be able to imagine this happening.
So it's taken whatever I put in there and is gonna put it between two single codes and it's going to
be inserted in there and executed on the system.
So what I'm doing is I'm gonna put one two three four five six and I'm going to add the quote myself.
So what I'm going to do right now.
The code is gonna be like this.
So it's gonna like this and password is equal to that and I have two quotes right now.
Okay.
And then well I'm going to do it.
I'm gonna say.
And
one is equal to one.
So one is equal to one.
And I'm just trying to see if it's going to execute what I wanted to do.
So my statement right now is gonna be select star from accounts where user name is equal to Zaid and
password is equal to 1 2 3 4 5 6.
And note I'm gonna be inserting this myself and one's is equal to 1.
One problem that the system is gonna complain about is that we have an extra quote here because I'm
gonna be inserting this myself in the text box.
So it's gonna be complaining about this it's going to say this this is an open code and never be has
been closed.
So what I'm gonna do is I'm going to add the comment.
And when you add the comment basically everything that comes in after the comment will not be executed.
I'm gonna use the hash as the comment.
So anything that comes in after the hash the system is going to ignore.
So I'm going to inject now is gonna be this and one is equal to one and this.
So as I said usually what you have here you have slashed your password.
Or depending on what the programmer called it but we're just imagining this and I'm gonna be inserting
this inside.
So when you do that and you insert it inside this is what the code is gonna look like.
So it's gonna look like the right user name right password and one's equal to one which is true and
then it's not gonna it's going to ignore this quote right here.
So if we paste this we should be able to log in it should allow me to log in and perfect.
We were able to log in and username is eight.
So far we haven't done anything but this kind of shows us that is it running our code.
Let's try a different thing now.
Let's try to add a false statement.
So what we did we did 1 equal 1 and that was correct and it executed what we wanted.
Let's try 1 equals 2.
And this is false.
So I have the right password and I have the right username but I do two and one is equal to two and
this should be wrong because it's false one is not equal to two and I'm using an add.
So everything has to be true so it should give me an error even though I'm gonna put the right username
and I'm going to put the right password so I'm put in one two three four five six and one is equal to
two.
So it's going to be like oh this is wrong.
And as you can see it's given me an authentication error bad username or password even though I'm given
the right to the right password and the right username.
So this confirms that this website is actually injecting anything we want in the password so we can
use the password field to inject Eskew L code and it's always gonna be on this form so we're gonna put
a password and you're going to put your code here so I'm just gonna put it in capital code here because
we're gonna put any password closed the quote and then put the code that we want to execute on the system
right here and it's going to be executed on the target system.