In the last video, we saw the manual SQL injection and we actually saw how much time it took to just
get the data, you almost actually did 15 minutes of coding and inserting queries.
And then finally we got the data.
But what if I show you an automated tool to calculate and find the data within using just basic commands?
In this video, we are going to see automating SQL injection using a popular tool known as a good map,
a skill map is a tool which is available in Mac, Linux as well as Windows in this lecture.
We will see how to use a scale map in Linux.
Let us get started.
So before moving ahead, I would like to tell you that when using a scale map, there are basically
two types of escarole injections get based iscar injection and post based SQL injection inject based
SQL injection.
The parameters that user passes through the input values is clearly seen in the world, whereas in post
based ESKIL injection the parameters are not seen.
So while using post based as injection, we will use it to capture the request and then insert into
a school map.
But for this lecture we are going to see how this map works with get based SQL injection that its parameters
are clearly seen in the user.
So first go to Google.
Make sure that you do not use these tools for illegal purposes because you will get compromised, all
the tutorials and the videos in the scores are only meant for educational purposes.
So the Google search engine type BHP questionmark idea is equal to one.
And then.
Contemporary Romanian writers is the website which I have found out to perform SQL injection.
So there are basically two types of physical injections, get based ESKIL injection and post is conviction,
post based conviction.
The parameters that generally user enters are not seen to the U.A., but in our case, as you can see
on the screen, it is equal to one parameter is clearly in the world and hence it is a get based SQL
injection.
Now when I enter a single court after one, I get an ESKIL syntax error, which means this is also vulnerable
to error based as good indication.
No, just remove that single code and copy the link.
And then go to a terminal and launch a school map.
Itch and hit, and these are all options provided a school map, if you are a keen learner and every
security expert must know how to use all these tools, and he should be able to know the options in
a school map.
So just clear the screen.
And type a school map that shows you based the order that we have copied, just do not add a single
code after one and after that you just type Dash Dash DBAs, which stands for database and hit Enter
the U.
Stands for the euro, which is specified.
And now you can see we have started getting results by.
It is dynamic.
It appears to be dynamic.
Whenever it asks the school map asks you to enter yes or no, just hit enter so that it will take default
value.
We will wait till we get the full the result of a school map.
So you can see that we have got the two database names, information schema and Romanian as see now
information schema is the default database, which is present in all of my school databases table.
And we have therefore we have got that.
There is only one database Romanian underscore.
As we see now, we are interested in Romanian underscore services.
So what we have to do is you have to pay the same command as earlier and just instead of dash dash DHBs,
right.
Dash capitally, followed by the database name that is underscored svc dash dash tables, which turns
to find out all the tables.
Now in this command, Dash U stands for the usual dash distance for the database name and dash dash
tables tells the it's map to find out all the table names which are in the database.
Romanian underscore SWC.
Hit enter.
It's Goolma will work and find out all the tables which are present, as you can see, we have found
out Ottey, Undersecretary Ari Underscore, Carti, Orte, underscore Carti, Ottery, etc..
So you can see how easy it was to just find out all the table names, but in the last lecture we saw
how tedious it was to write commands and then get the database stable name.
Now, since we found out all the table names, we will find out oh columns from the contact table.
So just type the same command.
And instead of dash dash tables type dash capability, I mention the name of the table in which you
are interested for this practical I will be using Dasch are a contact and just write dash dash columns
to find out all the names of the columns present in that table are a underscore contact and that added
underscore contact is then present in Romanian underscore evc.
Vola, we have got Eile, email, Phonte, Neum and Booza, since I do not know which website is this
and where it is Hosten actually, but I found out this website on some blog where they have told that
this website is for practical purposes and this site is also not functioning.
So basically now we are interested in finding out the data inside that column.
So what you have to do is just you have to write dachsie and mention the names of the columns in which
you are interested.
In our case, we are interested in all the columns.
So just straight idee, comma, email, comma, func the comma and you m e composer.
And then dash, dash, dump and hit enter.
We have got an error here.
Instead of the brackets, you have to write double quotes.
So just remove the opening and closing brackets and insert double quotes and then hit and.
So hopefully we will get all the details.
There you go.
We have got to databased.
We have got two emails.
You have got to neum.
That is name and proposal.
That is position, I'm guessing.
And frankly, that is the function.
We have got the editor's e-mail, Islay.
And we have got data now how hackers can use this data is just like an email from the from this e-mail
to some victim and then using social engineering techniques that they can just fool the victim to get
some malicious data.
So right now, I'm hiding the details in front of you because this is just for political purposes.
You might have seen that the screen is blurred, but I'm just doing it for educational purposes and
make sure you do not use this tool for any illegal purposes.
We are the security experts and we are ethical hackers.
So this video, I hope this video was very useful and we actually learned how to use the school map
and we actually finished finding the database in almost five to ten minutes.
So this was all for this lecture.
In the next lecture, you will see how to prevent from escalating attacks.