OK.
So now we know that we can put any code we want in here and it's going to be executed on the system.
So let's have another look now in the statement so the statement says select star from accounts where
user name was equal to the user name that we put here and passwords equal to the password that we put
there.
Let's see if we can use that to log in without using a password without even knowing the password.
And I'm gonna be doing that with the admin so the admin will get the user name is going to be admin
and I don't know what the password is for the admin.
So what I'm going to do I'm just gonna put anything so nothing really.
Any any random password and entry code.
Well I should run here.
We were doing and one is equal to one and or stuff.
So what I'm gonna do is I'm gonna do.
Or instead of and I'm gonna say one is equal to one so what our code is going to be once I run this
once I inject this.
This is going to go in here like we were doing before.
So our code is going to look like this.
So it's going to be select Sarah from accounts where user name is equal to admin and password is equal
to AA.
No this is wrong or one is equal to one which is right.
So anytime you have an R if the R condition is right everything is right.
That's the way our statement works.
So select star form accounts for user names you call to admin.
OK.
User name is equal treatment and password is equal to a.
That's wrong.
Or ones you call two on.
Okay I'll accept that and then it's actually going to execute it and let us log into the admin without
even knowing the password for the admin.
So let's try to inject this now
and as you can see I was able to log in as admin and monkey is the signature for the admin.
Now bypassing logins can be done in so many ways dependent on the code that's written on the page and
dependent on the way you want to do it and how you imagine in the code and in all the cases when you
put the single code here you won't see this message.
Sometimes you do see it which makes your job so much easier if you don't then you kind of need to guess
what it looks like.
So I'm gonna show you another example of bypassing instead of injecting the code like this.
The admin parameter is actually injectable as well as you see when I put the single quote the admin
priority is injectable exactly the same way as the password.
So we can inject code in the user name as well.
And what I'm going to do now.
So let's have a look on this.
And I'm just going to reset it to the way it would usually look like.
So you'd have and the username and password are the fields that you whatever you put in here are going
to be substituted in the username and password.
So let's try to inject something in the user name and what I'm going to say is I'm going to say user
name is equal to admin and then I'm going to close the quote myself and then I'm going to add a comment.
So my statement when I read this statement is going to look like this.
And I'm actually just gonna copy it here and when I inject when I put this code in here in the in my
name it's going to inject that in there.
So this is what the code is gonna look like.
It's gonna select staff from accounts where user name is equal to admin.
I close the quote myself here using this right there and then I'm adding a comment.
So basically all of this is not even gonna be executed.
So the code is gonna be this it's gonna be select staff from accounts where user name is equal to admin
and it's going to let me log in without even entering anything in the password.
So let's do this.
I'm gonna put my username as admin and I close the quote and add a comment and then you can put any
password you want to read I'm just gonna put number one and I'm gonna log in and as you can see I managed
to log in as admin so again and this is blackbox testing so you don't really see the code in many cases
you want to be playing around with it and see how it works with you.
But the main thing is you want to test if the ice kill injection exists and you'd use that using the
method we showed you in the previous video.
So try a single quote try the Army statement try f true and statement.
So once you got one and then a false statement so one is equal to zero two is equal to zero.
And if they work as expected then your target has an Eskil injection and you can start throwing around
all.