Let us continue with masculinization practicals in the previous two videos, you saw different types
of injections and from this video will start Manil its continuation practical.
Now in this video, we are going to use different types of Eskil command.
So and this is going to be a long video of about 10 to 15 minutes.
So be patient till you get the result and carefully observe all the commands that I'm going to use.
Now, again, I'm going to use the ESKIL commands.
If you do not have the knowledge of excl commands or database management, you can refer to database
management systems.
And we have also attached a few links to your school books.
You can download and refer to them.
So let us get started before starting.
Make sure you're logged in into Akali Machine and BBWAA.
That is demonstrated.
Their application is also turned on.
Let's start.
So right now, I am doing cardio machine and I will open the Firefox browser and then I will connect
to them vulnerable application to perform a skill injection.
So let us type the IP address of my vulnerable machine, that is ten point to ten point zero point two
point sixteen and then we'll hit enter.
So let us go to debatably and login with the default user interface admin and password that is admin.
I'm sorry, the password is password, so first let us go to DPW security and said the security to be
low, we won't be showing no indication on medium and high because it is a very tedious process.
And instead of that, we'll just show you a tool which will easily get you the database and passwords
and everything.
So first, go to a school injection.
And in this video, we are going to show you a single injection and not the blind one will just see
the normal injection, so it is asking for user I.D. So just for type one and let us see what we can
get.
OK.
It has shown the first name and the surname.
Now, what do you have to do is in in the text box you have to type percent.
Single court space or.
Single code zero single code clause is equal to single code zero.
And then hit enter.
Well, we've got something we have got, but we have got all the usernames and the current first name
and the surname now, which means that the query which we had just inserted is the query which exploits
this vulnerability and tells us that that is clinician present here.
So what we have got is first name and last name, but that is not a critical letter.
But why did we got this now when we entered, the person did sign and the code after that, it told
the server that, OK, the user has entered person as the user ID and after the person symbol is our
statement, which is a boolean SQL injection.
And in the order we can see that the zero is equal to zero, which is always true.
And if you know the basic boolean algebra or boolean logic, if one of the queries of the OR equivalence
is true, then the entire statements become true.
And in our case, even if the user 80 percent, which is an error or false, the other statement was
true and hence the server replied with all available usernames and surnames.
But again, this is not critical data.
We need to find something else.
So now let us use union query to find out different data.
So again, type person single code or zero is equal to zero.
Do not write a single code here because it is.
In the last case we used zero as a character.
Here we are using zero as an integer and then after zero space and type union select.
No.
Comma, user.
Comma, user bracket, double brackets.
And Husch.
And then hit enter.
You can see that you have an actual error syntax now, which means now what is telling you to observe
it closely?
I persistently show that you have to show you the error for this thing.
Now, check the manual that corresponds to MySQL server version.
And it it has told that we deliberately used hash which wasn't allowed.
So let us try to insert another query.
So what was the error in the last query?
I had entered the bracket similarly, so I got an error.
And why I did that?
Because I wanted to show you the deliberately the descriptive error which normally applications show.
And from the descriptor errors, you can actually get a lot of information.
So again, we have typed the same query, but here I have just entered the user and brackets in a proper
way and then we will hit submit.
You can see what we have got in the last surname section.
You can see the local host route.
Aderet localhost is what we are looking for.
So what will this is the name of the database user that executed the behind the scenes because basically
the route executed and we got the output.
Our next step is now to enter the following things.
So again, enter percent.
Single code or zero is equal to zero union select null comma.
Database.
Brackets and hashtag now before hitting the submit button in the last, we had executory user, and
that is why we got the username that is Ruth Aderet localhost.
Hopefully after executing this query, you will get the name of the database.
Let us see.
So function DeeVee, W8 or database does not exist while we got this error, there might be some error
in the query that we had inserted.
So let us go back and check what was our error I had by mistakenly misspelled the database name.
So let us again hit submit and there you go.
At the bottom, we have got the database name that is Divi w e.
Now if you scroll up and see the query we had written null common database.
No.
Why?
Because the first query is returning to fields.
That is first name and username.
And therefore the rule of the union query is that both the fields that is in the first query and the
second query should match.
Since there are two fields in the first query, first name and surname, we should also write to Fields
in the second query and then use the union function.
And that is why we wrote NULL Commodity's.
If we again write the same query and do union database common database, we will get the name twice.
Let us see the same.
So percent single quote, yes, just click the query, so instead of null, write user brackets, common
database brackets, hopefully we will get the user name and the database name and hash and then click
submit.
So if you can see at the first name, we have got the root name and the surname, you have got the database
name.
This is the main reason many inclination to do is do not explain why did we use Nelsa?
So this was the basic explanation why we had used none.
Now, since we have got the name of the database, we will not stop there of a next job is to actually
find out what is inside that database.
So let us execute the next query.
So type person single code and one is equal to zero
union.
Select.
NUL.
Coma table, underscore name.
From information underscore schema.
Not tables.
And then hash.
Before entering, if you come down here, I'll just show you why did we write and one equal to zero,
if we had written or one equal to zero zero zero, we would have got the result of the first query as
well as the result of the second query.
But here we do not actually need the result of the first query because we already know the database
values.
So we are interested in the table names.
So just hit submit.
And there we go, we have got the table names, character, sex, coalitions, columns, privileges,
Parola things, routine's schemata, statistics, tables.
There you go.
We have got the tables now.
Our next job is to get the names of the tables.
We have also got the user table, the DBI, the funk, etc. Now let us hit the next query.
Now, since we are interested in that user table, we will get the contents from that user table.
So let us write the query to retrieve the contents from that user table.
Right.
Percent single code and one is equal to zero
unión select.
No, comma, people underscore name.
From information underscore schema.
Not tables there, no vivir because we're interested in their user table, their table underscore name
like.
Single court user.
Percent single code.
Hash.
Now, this query will show all the tables which have the word user in them so you can see user privileges,
users, user user groups, user objective permissions, etc. Now we have got the result, which shows
that these are the tables which are actually related to the users.
Our next job is to find the details of the user's table.
So just take the query person single code and one is equal to zero union.
Select nul.
Coma contact.
Bracket, open table, underscore name.
Now we want to break the line, we will have to input on new lines, we just type the hexadecimal for
Brick Lane that is comma zero zero A.
Colma.
Column, underscore name.
But I could complete from information underscore schema.
Got columns.
Their table underscore name.
Is equal to users in single courts.
And then hash.
Hit enter, so you can see we have got all the names of the columns that is user I.D., first name,
last name, user password and after.
Now we are interested in password.
So let us type the following query.
Ampersand, oh, I'm sorry, percentage single quotes and one is equal to zero unión select null.
Guma concat in bracket, first underscore name.
Comma zero zero eight, which means on a new line.
Goma last underscore name.
Comma zero zero eight.
That is again on the new line.
My user karma zero zero e karma password.
But I could complete from users and hash.
This is the syntax of finding the data.
There you go.
We have got first name, surname, that is admin, admin and the password.
Now, this is not the actual password.
This is the modified hashed password.
You can use various modified hash or breaking tools.
Hopefully we will see one of the tools in the next upcoming months.
We are going to update the contents.
We are going to keep updating the contents and we will see different types of hashing tools.
But for now, we are successfully able to compromise the database.
And we have finally got the data.
We have got the so name that is Hack, then MI 137, that is the user ID and the password, etc. So
you can see how long it is to actually retrieve the data manually from the database.
So this is spoiler alert for you.
In the next lecture we are going to just use four commands.
Just use four commands by typing only five to eight letters in each command and boom entire database
in a good graphical view, will be in front of you.
So let us start with automation of fiscal injection.