So we've seen how we can do some simple sequel, injection rescue, oil injection, to use an overstatement
to make all of the users true for a equals.
So if their username, if their user ID is one or their or the value A is equal to A, then we're going
to get their user information.
Let's take that one step further.
Let's see if we could get the passwords for each one of these users added in to this query.
So instead of one or let's do a union select union is the way that we join two queries or two tables
or even two databases together we can union.
So we'll do a search for all the users where the user ID equals one.
And then we'll also do a select few are actually typing in some skill here, select user comma password
from users, we just have to know a few things about the table.
You can dig in to find some of those things.
In fact, you can find a good tutorial on Just Devoir, where you can spend hours researching and you
can dig through each one of these little capabilities piece by piece.
But we'll come back, we'll say one quote, Space Union Space Select and we're going to select the user
I.D. or the user name, comma, the password from users.
This is going to give us the password hash that we can then use on any website to look those up and
then we'll add a hash tag at the end just in case there are other things off the end of this query.
And let's click submit.
We got one single spaced union select user comma password from users hash tag and that put anything
else is a comment if it was at the end of the line.
Well let's see what this user comma password did.
Oh, we got our first user user ID one admin and admin, but look what we got next admin.
And instead of a surname, we've got a password.
So we get the username and password for Gordon, for admin for Pablo and Smithee.
So instead of the user name, instead of the first name and last name, we've got the username and password.
So you know what we can do with this password hash?
We copy one of these.
We come to any of the harsh cracking sites, we can go to harsh killer, we can go to MI5 five online,
we paste the hash and click decrypt.
And of course, that was the hash, a password.
We knew that because it means password was password.
We can pick a different hash killer like crack station.
Come back to Devoir and let's select Gordon Beeb's password hash, we copy that.
Pardon me.
Of course, there's another MDVIP decoder dog and we can see that it's ABC one, two, three, just
from doing a Google search so that one turns out to be ABC one, two, three.
But let's choose one of our other users, Pablo Picasso.
Let's see how hard his password is, copy it will come to crack station and paste it and we have to
do another capture.
And that took just a quick second and says that that hash is let me in so we could use Pablo and let
me in as the password if we log in to Devoir.
So I'll open it up in another browser, go to ten dot dot three top five.
Come to Devoir.
And let's go back and see that username that was Pablo and his password is let me in, so let's try
it, Pablo and let me in.
And I am in to our darn vulnerable Web app as Pablo.
Wow.
So a little bit of Eskil injection allowed us to give the usernames and passwords.
And you can see because these are just maybe five hashed passwords, they're pretty fast and easy to
crack.
In fact, you can probably tell what Smithy's password is just by comparing it to the admin password.
Notice the modified hash of both of those is the same.
That means we could log in as Smithie, log out and come in a smithing news password.
We're logged in.
As Smithey So we've already seen that these two main attacks cross site scripting and sequel injection,
both give us way too much power as an attacker.
In the last lesson we're going to see in the final lesson of this section, we're going to see how to
protect our Web server from those types of attacks.
I'll go ahead and mention one other thing here.
If we had a really insecure database, we might even be able to do something like this one semicolon,
quote, semicolon, drop table users.
And this will not work on Devoir, I don't believe, but it will allow us on a really insecure database
is called a stacked query, where we have one query, semicolon, another query.
So if I drop table users and let me put a hash tag at the end, just in case there's any extra stuff
at the end of that MySQL command and click submit, we can say is we still able to pull admin in of
minutes of drop table users.
Probably didn't work.
We can check just by clicking another user ID C three.
So drop table users did not work in this case.
But that is really destructive thing that can happen on a Web server if we're not looking for it.
Like I said, we'll see how to protect against cross site scripting and sequel injection in the next
lesson.