WEBVTT

00:00:01.740 --> 00:00:02.230
Hey there.

00:00:02.230 --> 00:00:02.870
Welcome back.

00:00:03.130 --> 00:00:04.010
Before we go,

00:00:04.019 --> 00:00:07.550
I want to show you how much impact this tool can have in the hands of a hacker.

00:00:08.310 --> 00:00:11.310
The attacks in this demo are not usually in the red team engagement

00:00:11.410 --> 00:00:13.360
since they can cause data loss for the client,

00:00:13.690 --> 00:00:16.470
but I still want to show you how this is done since

00:00:16.470 --> 00:00:18.250
the bad guys do that all the time.

00:00:19.540 --> 00:00:23.200
First, from previous demos do you remember a table called accesslogs?

00:00:23.740 --> 00:00:24.950
So yeah, let's take a look at it.

00:00:25.540 --> 00:00:28.650
I'll use the same Get‑SQLQuery that I was using before,

00:00:29.340 --> 00:00:31.890
but now the only difference is that I will be using the

00:00:31.890 --> 00:00:34.150
Select all in the accesslogs table.

00:00:36.140 --> 00:00:36.640
Take a look.

00:00:36.820 --> 00:00:39.650
In this table we have the login attempts for every user.

00:00:40.200 --> 00:00:43.910
As you can see here, I was trying to brute force the password for the user test.

00:00:44.340 --> 00:00:46.250
So, I don't want to leave tracing here.

00:00:46.640 --> 00:00:50.400
So what I can do is delete all the login attempts for the user test.

00:00:50.940 --> 00:00:53.850
For that, I'll run the same Get‑SQLQuery command,

00:00:54.080 --> 00:00:57.440
but instead of doing a Select in this table I'll use the command Delete

00:00:57.650 --> 00:01:00.290
to delete every row that is related to user test.

00:01:01.290 --> 00:01:04.750
So the command line will look like this Delete from

00:01:04.800 --> 00:01:08.550
accesslogs where username = test.

00:01:09.720 --> 00:01:12.360
Basically what I'm saying here is delete every row

00:01:12.370 --> 00:01:14.350
where the username equals to test.

00:01:15.040 --> 00:01:17.850
And when I press Enter you see that a connection was successful.

00:01:18.540 --> 00:01:22.370
And then if you do the same Select all in this table we will see that now

00:01:22.380 --> 00:01:25.220
all the rows that had the test user are now deleted.

00:01:25.580 --> 00:01:27.850
And this is a really good way of covering your tracks.

00:01:28.830 --> 00:01:32.750
Now, let me show you how to modify stored data using PowerUpSQL.

00:01:33.670 --> 00:01:36.100
Since we are in the HR database let's say I want to

00:01:36.100 --> 00:01:38.050
modify the salary of some employees.

00:01:38.680 --> 00:01:42.410
So first, we have to find the table where the salaries are stored.

00:01:42.410 --> 00:01:45.470
And the easiest way of doing that is using the exactly same

00:01:45.470 --> 00:01:47.440
command we were using to find credit card data,

00:01:47.660 --> 00:01:50.250
but now we'll change the keyword to salary.

00:01:50.710 --> 00:01:53.290
And if you don't remember what this command does go back to our

00:01:53.290 --> 00:01:55.150
previous demo and your understanding there.

00:01:55.540 --> 00:01:56.290
But basically,

00:01:56.480 --> 00:01:58.690
in here I'm searching across all the tables in the

00:01:58.690 --> 00:02:01.450
database for columns with the word salary.

00:02:04.420 --> 00:02:08.550
Then, it seems that the salaries are stored in this table called employeesalary.

00:02:09.009 --> 00:02:09.350
So,

00:02:09.400 --> 00:02:11.630
let's use the same command that we were using before to

00:02:11.630 --> 00:02:13.250
do a quick Select all in this table.

00:02:13.640 --> 00:02:16.150
I'll just change the table name to employeesalary.

00:02:19.640 --> 00:02:19.900
Cool.

00:02:19.910 --> 00:02:20.350
Take a look.

00:02:20.360 --> 00:02:22.510
We have a list of the employees and their salaries.

00:02:22.960 --> 00:02:25.850
Now, let's say I want to change this salary for Adam Robs.

00:02:26.490 --> 00:02:29.070
So, I'll use the command Get‑SQLQuery,

00:02:29.200 --> 00:02:32.630
but instead of using a Select clause I use the Update clause.

00:02:32.630 --> 00:02:37.450
It will look like this Update, then the name of the database,

00:02:38.140 --> 00:02:42.250
dot the schema, and then dot the table name.

00:02:43.310 --> 00:02:46.950
Then we write SET and the field that we want to change.

00:02:47.440 --> 00:02:51.150
In my case I'll put salary = 250000.

00:02:52.440 --> 00:02:55.610
Then I have to specify for which employee I want to change the data.

00:02:55.950 --> 00:03:02.950
So I put where employeeid = 130, which is the employee ID of Adam Robs.

00:03:03.730 --> 00:03:04.360
And that's it.

00:03:04.370 --> 00:03:05.750
We just have to execute it.

00:03:07.760 --> 00:03:08.190
Perfect.

00:03:08.190 --> 00:03:11.470
Now, let's do a Select all in the same table to double‑check the results.

00:03:13.130 --> 00:03:15.300
And there you go, the salary was updated.

00:03:16.080 --> 00:03:19.170
But if you want to really cause an impact on a company you can

00:03:19.170 --> 00:03:21.250
delete the entire table from the database.

00:03:22.120 --> 00:03:22.410
Again,

00:03:22.480 --> 00:03:24.730
if you're working on a red team engagement your client

00:03:24.740 --> 00:03:26.650
probably will not authorize you to do that.

00:03:27.090 --> 00:03:30.760
So I don't recommend you doing this at all, but I want to show you how

00:03:30.760 --> 00:03:33.050
it's done since hackers have the power to do that.

00:03:33.930 --> 00:03:38.300
For that I use the same Get‑SQLQuery command and then I will

00:03:38.300 --> 00:03:42.730
write the query like this Drop table and then the name of the

00:03:42.730 --> 00:03:43.780
table that I want to delete.

00:03:44.480 --> 00:03:46.750
In my case it is the employeesalary table.

00:03:47.840 --> 00:03:50.250
When I press Enter this entire table will be deleted.

00:03:50.720 --> 00:03:52.680
And be aware there's no way back.

00:03:53.060 --> 00:03:57.000
If you don't have backups the data will be lost forever so be really careful.

00:03:58.100 --> 00:04:00.680
Once executed, it shows this connection's successful.

00:04:01.290 --> 00:04:04.170
So then, now, to double‑check let's start to query this table.

00:04:04.340 --> 00:04:05.550
Let's do a Select all.

00:04:07.920 --> 00:04:08.540
There you go.

00:04:08.590 --> 00:04:12.130
As you can see we get a successful connection and then a failed connection.

00:04:12.330 --> 00:04:15.060
And this means that we're able to authenticate to the database,

00:04:15.120 --> 00:04:16.450
but no tables were found.

00:04:17.140 --> 00:04:18.320
And that's pretty dangerous, right?

00:04:18.589 --> 00:04:19.050
So again,

00:04:19.140 --> 00:04:22.320
make sure you know what you're doing before trying any kind of impact attacks.