OK.
Now I'd like to show you an Eskimo injection and then a different file and different page and I'll show
you a few different things that you can do to exploit that vulnerability.
So the first thing I'm going to go to the log in page which is here.
User info.
So the first time I went to the log and page from there.
This time we went to the user info page.
So this for this page will show you the information about the user provided you give the username and
password.
So I'm going to Zaid and I'm going to put my password.
One two three four five six.
And it'll show my details username and password and my signature is a so the statement that's been executed
here is similar to what was being executed.
When you log in so it's selecting star from accounts where user name is what you put in the user field
and password is what you put in the password field.
So what we're going to do now is we're going to see a different way of exploiting this kind of vulnerability
in the previous video we were doing it using a post text text box.
So whatever you put in the text box was being posted using a post method to the web application.
Now these vulnerabilities can exist in to get and what I mean by get is when you do a get when something
is sent as get you will see it here in the URL.
So if you look at the URL here you see it's being sent as the user name Zaid and password 1 2 3 FOUR
FIVE SIX.
So let me just copy this your e-mail here and we'll start playing with it from the URL and instead of
doing it on the web page I just want to show you a different example because in many places there might
not even be text boxes for example it could be something like in use and use that BHP.
So we can see here for example in this example it's indexed BHP and in your pan testing you might see
something like in use that BHP and for example I.D. equal to two and then you can try to inject stuff
in there.
So we're having an example here where we're going to be injecting things into the user name field which
is this field and we're going to be injecting stuff in here so anytime when you're doing your pen test
anytime you see parameters like this you should try to inject them anytime you see something that BHP
and then you have a parameter equals something that always try to inject stuff in there and see if it
works for you.
So we also seen a way of discovering the injection and that was using the quotation mark and using the
and so we do are false and and a true and and one is equal to one and then and one is equal to two and
if the server is executing what we want then we're going to know that there is an Eskil injection I'm
going to show you another way of discovering these exploits and it's using the order by as the name
suggests the order by statement is used to order the results that we get on the screen based on a specific
column.
So our injection is going to be like this.
So I'm going to do or there by 1.
So this if if the injection exists this should work because in each select statement there should be
at least one column is being selected.
Therefore when we say order by one we're saying I want to order the results based on the first column.
Therefore this should always be acceptable by the database and return true or something that we expect
we also need to add the comment in here and execute this code.
So it's exactly like before.
So when we're doing this basically this is our U.R.L. URL and what's going to happen on the database
so this is the code that's been executed on the database it's going to look like this
so it's gonna be select star from accounts who user are usernames equal to Z and note how this is close
in the quote and we're gonna do an order by one and there should be this code here for the end.
And this this comment comment will tell the school interpreter that to ignore anything that comes in
after it.
So all of this is going to be ignored.
So I'm copying this
so you can actually paste this injection for Z order by one into the name right here and that's gonna
work.
But I again I just want to show you a different way of doing it by injecting it through the browser.
Another thing that I want you to note is when you inject himself into the browser the browser the code
should be encoded.
So for example this sign usually when you put it on your URL it should be written as percentage 23 spaces
for example get converted to percentage 20 and percentage 23 is the comment that we're using.
So I'm going to copy that and replace my common sign with.
Now we can google Hey CTP encoder and you'll see online there is online tools that'll just confirm this
for you for me.
Now I know that the hash tag can be converted to percentage 23.
So that's why I'm using it there and I'm going to hit enter and as you can see now we're seeing something
that's acceptable
nothin wrong and then it's shown me the information about Z.
One two three four five six and seven with the signature.
So it is ignoring the password.
So the injection worked and it's ordering by 1 so it's not shown me anything wrong.
Let's try to make this number one a very large number so put in 10000 or 100000 now.
So what we're seeing right now is I want you to order the results that will be returned by the current
select statement based on column one hundred thousand.
Now chances are there aren't 100000 columns used in this select statement and therefore this should
return an error.
So when I execute this you'll see that there is an error and the error is in the order close and still
that there is an unknown column for 100000.
And this is great because now we know that the database is executing what we want.
So when we told it to order the results based on the first column it showed us results.
So it followed what we told it.
And then when we told it to order the results based on a column that does not exist it gave us an error.
So it's obviously vulnerable to a scale injections.