In this video, we're going to take a look at this change to the tax posture and this data will be exposed
using up with anyone, whether it is clever or any other, uh, vulnerability.
But in this trackway room of the PORTEN, they have shown that there is a database leak and we can see
what's going on in that database.
So they have given here a few examples and there is a database file and you can open this with a security.
So this is also, uh, similar to the MySQL we have had before, but it is used for, uh, very small
projects.
And this my is used for small and medium scale projects.
So it will be very simple to open this database for using this correctly.
And they have also shown you that, uh, that was to to lift the tables.
And now what we are told is they'll set this material to and they have also they are searching this
current situation, uh, website to crack the password hashes.
So, OK.
Now let's do this challenge.
So this is very simple.
Just the data is being exposed using the vulnerability.
Uh, this is a skill on ability.
And what you want to do is we need to extract as much data, as much useful information from this data
server.
Copy this and go to this website.
So we have here this is a server condescension, sensitivity.
So I click on this login so you can perform this as good indications as well.
But what I have on this, I proceed to control you to see the, uh, page, uh, source code.
So there is like plain text that you always you check the, uh, source code for the comments or any
other useful information.
Sometimes even comments can contain very useful information, which can be very useful, insidious and
also normative.
I know there is an image.
Let me open this.
So this so he's like Imagists, let me go to this.
So this is the same challenge that is in the order, not us, and if you you can just take a look at
this, there is one level.
Each is similar to like this be made and you need to go back to the apparatus, could click on this
predator and you have this face, you can see the result.
So this is the database file which is getting exposed to normal user, so to say file and go to downloads,
returns to your.
And let me open this using this escalatory application.
Now you can see that Helfer comments are going to execute.
So these are the kinds I can execute, unfortunately.
I traded a school case, then I just got stuck.
So now what we have to do is you need to share that database's.
So there is OK, this is the data sorry, we need to reset the tables, so let me say this.
So there are tutorial sessions and users let me use the data from the sessions, so start from sessions.
So this experiment has been successful executer but other comments like Shorter will show that the visuals
are not executing.
Uh, no.
I think the sessions table has been empty.
No.
So from the user's table, you have this admin boundaries, so I don't know, I think this is the harsh
reality check or cockiness.
And they have mentioned the.
Let me pasted in here and that this website cracked the hashes for you.
It's not fun, but we do use the hash, try this.
So we can't really see the difference between Herschend or not normal value.
OK, this is the hash, OK, sorry for this, we have got this to you are your copy this and open a
open.
Analysts say.
I mean, past four years, this one and the same are let me try to crack these passwords of Buganda's
copy and paste it here.
And the about is destitute.
So do the same for this, Alice.
So maybe the hash of these arrests was difficult.
OK, so what they have done, what they are asking is why do they never mentioned the three?
You have got this assets.
So it's that it's.
So now we're together three, four in question, what and what stands out likely to continue and which
is where the.
Use this opportunity to access the data and what is the password of that one user?
So this is the password hash of this admin user.
I don't think I'll be this and pasted in the answer for.
And what is that plaintext, quartey, you or you will be?
Now, what they are asking to in as they had been and what is so also, we need to use this as a message
to login as the search had been, the date of the I.P. address.
I think as such, maybe the search service is running on that computer.
All right, so I just forgot this, there is a law in place so you can just log in to the settlement
and covid is password.
So you need to memorize all the elements of this achievement.
You see, this is a in which is the end of this toolbar.
And if you log in and they welcome it and there is a flag, it's going to cover this and just pasted
in here.
So, as you can see, simple database has been exposed and from the database we have got this past year
and we have corrected those issues with correction, and then we log in to this council as the admin
so you can see even a small file exposer will create many problems.
Even now you can see are the users here.
He can delete the rest of the article, reset the puzzle.
So simple database file or any simple change to data exposer is very dangerous and you need to protect
this or those files.
So I hope you have understood this to ensure that it can be exposed by any matter.
But what we want to do is you need to look for these important assets are important data.