All right now we're here.
We're going to do our first web app attack of sequel injection.
Now we have the account log in page make sure you navigate to that.
And that's kind of where the hint came from on the scoreboard and said hey we're going to utilize the
logging feature to kind of attack sequel.
So I kind of want to go over this and talk about what we're we're expecting here.
So let's say that we log in.
Let's turn to intercept on and let's say that we log in and we say test test.
Right.
And we log in we'll intercept that request and we can for this one we're looking for the username password.
Here we go.
So we got e-mail password here.
And let's go ahead and just right click and send that to repeater and if we try to log in it says invalid
email password.
OK.
That's fine.
What happens though if we try to throw something in here malicious and let's back up just a second I
want to cover what's going on behind the scenes.
So what's going on.
Let's open up a notepad.
OK.
So we have this input right.
We're putting in the e-mail field.
We're putting an input of test and what's happening behind the scenes say we have a sequel injection.
All right.
The sequel injection is trying to grab that.
It might be grabbing something along the lines of select star from users where e mail equals test.
OK.
So what it's doing is it's saying hey I want to select everything from users where the e mail is equal
to this test.
What we just input into here.
Now if we have sequel injection let's copy this.
I'm going to paste it let's say instead we put you know a single quote in here well that single quote
is going to come in and it's going to add into that.
Right.
So we're saying hey from test here and guess what this completes the statement.
And now this little other single quote that's left over is going to throw an error because there's no
end to the second quote.
Right.
So this isn't logically correct.
And because of that we could cause injection if this is allowing us to inject this single quote here
that we might run into issues.
So let's take a look at repeater.
Let's say we put in the e-mail here we put a single quote and we send it.
Oh look what happened.
So we got a 500 Internal Server Error and from that we have got a sequel I air.
All this is so good.
What is this telling us.
Well this is telling us one.
This is a sequel I database so that gives us some information.
And if we come through here we're seeing that there's a database error.
And when we get an error like this this means we have some sort of injection.
OK.
This is a a big sign that injection exists and something I actually have never really seen before.
When you come down here it tells you the sequel what's happening.
So the sequel of what's happening here is it saying hey select star from users where email equals test.
So we guessed that right actually.
And again there's an AND condition here.
Password is equal to.
And it looks like it's just hashing that password of test and then is putting in here and delete app
is null.
So if the account was deleted if it's no then it wasn't deleted.
Right.
So it's saying hey this account still exists.
It matches this password and it matches this email address.
Perfect.
So how can we improve upon this.
Well let's take a look back at our our notes here.
So we've got a notepad let's make one more of these so what if I made a situation like this I said test
or
one equals one dash dash.
And what's that going to do.
That's going to come into here and that's going to say or one he goes one and the statement dash dash.
OK.
So what is his doing.
Well first let's focus on this part right here.
We're closing out this e-mail.
It says test and then we close it out.
Right.
Then we're adding condition and we're gonna say or so this email doesn't exist.
Right.
Because we're it could exist but it's going to say hey where it matches this or this is true.
Well guess what one is equal to one.
So this is true making this entire statement true we add a ending here OK.
We add our Ender and then we put in a comment.
Now what happens with the comet.
Everything after that comet no longer exists.
So if we put that into here and we put the common in guess what.
We don't have to check for a password we don't have to check for and delete it is no it doesn't care
what's going to happen here is it's going to allow us to log in with this statement and it's going to
allow us to log in as the admin user.
Why is that.
Well if you recall the users we had we had like I.D. of one two three four or five.
We had Frank Castle at the top typically I.D. number one is your admin user OK.
So if we were going to log in as the first user in the database this is going to pull back the first
user.
Typically if you're avid user so we're going to utilize common sequel injection here.
We can do.
We can copy this entire statement if we want and just paste this in you can put anything you want in
the password and then attempt to log in I'm going to undo the proxy here and that actually solve the
challenge for us.
We wanted to generate an error and I could show you that really quick if we tried to log in with this
you can object Object error which is another indicator that something's going on on this side.
But this is why look at what this shows you compared to what repeater shows your computer shows you
a lot more information.
So I always like to run my testing through Peter.
So let's go ahead then and try this and log in with it and guess what.
We are logged in successfully log into the admin account.
All right so here let's talk about some more things we've completed the challenge and that's great.
But let's also focus on what we're seeing here what we're seeing here is SQL injection.
And this is classic sequel injection.
Now there's a possibility that we have sequel injection and we aren't able to see it at all and that
is called Blind sequel injection.
That becomes a little bit more complex and to talk about this because it may show up in an interview
blind sequel injection if you're trying to test for it you might have something like this and let's
go ahead and pull up our little notepad again.
So you might have a command in here where you say we'll just make up a fake injection Don't worry how
it plays into the sequel statement but you might say something like sleep five.
Right.
And it depends on the the sequel database you're using.
So the sleep term changes in how you enter it.
So I'm just making this up right here.
But you're going to say Hey sleep five and what's going to happen is the Web site is not going to respond
to you for five seconds and then you're gonna say Hey sleep 10 and then the Web site's not going to
respond to you for 10 seconds.
Well that's how you can determine that.
You know even though you can't see an error code like this like when we see this error code we know
we have sequel injection this is bad OK.
It's only a matter of time to figure out how the sequel injection works.
And then we can kind of go from there and pull it off.
But when we inject this and nothing comes back it just comes back as like a normal log in screen and
we just have no idea.
Well then we could start throwing in like these sleep patterns in these testing to go with it and seeing
if the page responds back or doesn't respond back and burp active scanners actually really good at doing
that and at least trying to pick up on these it'll send sleep commands and see what the responses are
and kind of help try to identify some of that.
So that is it for this video.
My challenge to you is to go into your injection here remember injection look at the different challenges
that are available to you and play around with them.
Make juice shop your friend and understand these if you go through all of these challenges you don't
have to know how to solve them.
That's that's not necessarily the point here.
The point is to go through the challenges and even work through them in order of difficulty.
So you just did a two star challenge maybe you'll look at the three star challenges and see how you
can take those the Christmas special is actually a really good one and you can keep going through this
and you can learn a lot about different injection here.
And again you don't have to know how to do this.
Go to the challenge solutions read the challenge solution and follow it along.
Take notes understand what's going on and why it's going on.
So now you know what sequel injection is.
You understand that hey we're we're getting injection here you know and we're putting it into a statement
and we're modifying that statement to make something happen in our favor.
That's all it is.
We can get very malicious with this very quick.
So from here we're gonna go ahead and talk about how to defend against sequel injection.
So I'll see you over in the next video.