Electoral map automates the process of detecting and exploiting a skill injection flaws in Web sites
and it will allow you to take over the database server.
It comes with a very powerful detection engine with a broad range of switches that can be from database
fingerprinting accessing the underlying file system and executing a lot of comments.
If you open the web browser here and go to Google just take BHP question mark equal.
This is known as the BHP idea vulnerability.
It will mean the last set of Web sites that use this vulnerability here.
They might possibly be vulnerable and possibly not so I'll take the first Web site here which is contemporary
Romanian writers.
Click on that as you can see it uses the identical one.
If you want to know if the website is vulnerable just go to the URL here and add this apostrophe after
the one just press enter it will pop up this at or message.
You can just copy that without the apostrophe Of course.
Just copy that link and go to your console and issue the SPL map comment you can use the hyphen H to
get the list of switches that you can use but it will go directly into executing the command so ask
you a map you can use hyphen you for the URL just based that your l here and then space hyphen hyphen
DV s.
This command will try to get the list of databases that lie behind this website.
Just press enter and wait for the magic as you can see here the database available are to information
schema and Romanian as we see so we're interested in this Romanian SBC here.
The other comment we should issue is remove this yes.
Just use hyphen D and specify the database.
Romanian underscored as V.S..
And then use hyphen hyphen tables so the hyphen hyphen tables will fetch all the tables that are in
the Romanian underscore as we see database press enter as you can see here.
This is the list of tables in this database.
So we're interested in getting the content or the columns of the table name.
For example are a underscore authority.
So add that and then hyphen hyphen columns into display all the columns in the table are a story under
the database Romanian as V.S..
And here we go.
This is the schema design of this table here.
It has like couple of columns that we can dump to our local computer.
So just get back the previous command and remove these columns.
Use hyphen C uppercase and then you can select the column names like and you and E then and you and
e the score and the comma.
Those are pre new etc. and then use space hyphen hyphen dump
it's retrieving the list of the content of this table as you can see on the screen with all the relevant
information in it.
Pretty impressive right.
This is the table the content of the table.
As you can see here and the dump actually is now on our b c.
The dump was downloaded to our computer under this path here.
So if you want to see it just copy this link and let's try to open a new window here just use leaf pads
and paste press enter and you know you go This table doesn't contain like confidential information.
It's just for tutorial reasons and some of the websites might be vulnerable and you might be interested
in targeting tables that have usernames and passwords.
Some of the vulnerable websites have their passwords hashed so ASCII map can decrypt these hashes for
you automatically.
Sometimes a squirrel in my poem would be able to crack the password so you can use other application
tools like John the Ripper to do that.
Let's take another example here clothes again.
Open that here and let's go to this website here.
It's test BHP not on the web.
Dot com it's intention and vulnerable upside by kinetics.
Just you might go here browse categories posters cetera.
You'll be able to see vulnerable your Ls as well.
Just copy that.
Open your terminal again.
Ask you a map.
I find you based VB s and the same thing will apply.
This is the acquired database.
You can do the same as we did before.
That was actually the get vulnerability type of ESC fuel injection of the website is using post method.
You can do some kind of walk around to do the same.
Just make sure to launch the application called Bridge sheet that comes with Kelly.
Once you click on that.
That's the boob suite.
Select a temporary project then start brb.
And this is the application.
Now we want to rout our traffic from the browser to hit the proxy.
Go to your preferences on just any browser and type network or proxy you go to the proxy settings and
configure a manual proxy.
In this case it's the local host listing on the port.
Just press okay now all the traffic will go to the proxy server before it hits the Internet.
Now I'll open just open any website that can be vulnerable or uses the post method.
So just go to the smiley var remember Web site.
Just put any username any password and press log in.
Now just go again to the burbs suite the proxy HDTV history and chicken log in page.
Just see this is the post command.
This is the host the agent etc. And these are the parameters that they were passed and you have the
username and password.
Just select this all and right click and press copy to file and named this as well.
I got the and say that.
Now go to the terminal as we did before with the get the vulnerability of the S kill injection and type
SCA map and then minus or hyphen are the name of the file which is askew.
L I thought d d then press enter it you'll do the same steps and the same techniques it did with v get
since now we have the parameters that might be vulnerable.
It will take some time and if the website is vulnerable it will give out the name of the database and
you can do the same hacking techniques we did earlier with the get method.