Now you know how you can use a injection in order to hack a website, but the whole process is manually,
so you have to take part in the whole process.
Right.
But now in this video, we will see how we can automate the process and we will use a tool called Escorial
Map.
So what is a skill and how it actually works?
So we will start with what is Eskild map first.
So as MAP is a software that helps us to detect and exploit vulnerabilities in database.
Also, it will help us to inject some malicious code into that database and it is open source software.
So let's see how it works.
First of all, let's open the browser and let's switch to Mattilda.
So we have to enter the IP address of a Web server.
And then open day.
Now, here we have to switch to this step, which says injection extract data and user info.
OK, now here, enter any user name or password.
OK, because we don't know the password, so I have entered the wrong password now.
Copy this.
You ordered.
And close the browser.
And here they Eskil Map Hifa new novel I am using hyphen you for this, you have to type and I can help.
OK, and here are so many options you can use with a scale map, right?
So I am using Hifa new so that I can enter the euro or the target.
You all right?
So there are so many options.
We will use some of them.
But first, let's continue with.
Eskil map, I found you and then based on the wall, OK, and close this in double quotes.
Now I have added the wilkos so that a school map will read each spatial character like Dot Hyphen is
equal to etc..
Right.
And Ed.
And now let's wait for the process to complete.
So it's a long process, so I have to pause the video.
Now it's asking some questions like, do you want to skip the test payloads?
OK, so you can press why here.
And again, you can press.
Right.
And now let's wait for the process to complete.
Finally, the process has been completed and here is the output.
It says the back end database management system is my Ezekial, which is correct.
Now, operating system, Barzani's Lennix, Window BHB, BHP and is this and Web server, which is Apache
is running on 2.0 that it wasn't right and MySQL was and is five.
Now, all of the information provided here is absolutely correct.
Right now.
It says fetch data, log to text file under this.
So anytime if you want to see this output again, you can switch to this directory.
OK, this is the part where this data has been stored right now.
Let's see what more we can do using Eskild map and let's explore the database.
And now.
OK, so repeat the combined last command and then type hyphenation current hyphen DBI stands for database.
So we're asking a ESKIL that which is the current database here is zero, which is default.
And now you can see that the current database name is already then.
OK, so.
Let's repeat the command and this time, as we know the database name, so we use a hyphen and then
the name of the database and then.
Hyphen, hyphen columns.
OK, so now we will asking a school map to show all of the available columns under arrest, then database.
So here is a list of all of the columns.
Right.
So we will use, let's say, this one username and password.
OK.
Both of these.
So let's try them and let's remove columns, type hyphen, capital S..
And then name of the column, let's say password, comma, username or user name.
OK, and then hyphenation tables hit enter.
And now we're asking a school map to show all of the available papers under these two columns.
So zero.
Done now here are all of the available tables, right?
So repeat the last command.
And they t and then the name of the table, which is accounts, OK, and then hyphenation don't.
Now, let's wait for the output.
So here are all the available usernames and passwords, right?
So this way you can use a map to automate the process of injecting ESKIL injections and exploring the
database right now.
This only works on the websites which are still vulnerable.