In this lesson, we will see how they can hack into our target website using ESKIL injection.
So in my virtual environment I am using callisthenics as my client machine and I'm going to access Web
server directly using IP address.
OK, I'm not using being a server in between.
And this is my Web server and web server is MLO Tabun.
So Middies Floatable using a web server called Apogee and database name Myersville.
Right.
So what is Eskil OK, or Eskil injection, so an injection is a very popular vulnerability, right?
And Eskil is a structured query language which help a website to interact with its database.
As you know, most of the websites use databases to store their data data like username, password or
other critical information, etc. And so the data is stored in databases in the form of tables, which
consist of rows and columns.
OK, so Eskil is the language which help a Web application to interact with data in order to read data,
abdeh data or delete data, etc..
Now here is the Middlesborough table, which is a web server.
So first of all, let's find out its IP address.
It is standard zero 2.5.
Now let's switch to client machine, which is Scali, OK?
And now I'm not going to hack into any website.
Instead, I first want you to show how database look like.
So my Ezekial hyphen U hyphen you stand for user.
User name is route.
Now my web server, which is most notable, is not using any password and then the IP of the web server.
See now I am in the MySQL of 10 or 2.5.
The first command we use is data bases.
OK, so show databases and then hit enter and here you even see all of the databases right now.
We will use this one.
So let's use w e OK.
And hit enter.
It says database changed.
Now they show tables, as I told you, that they stored in the form of tables.
So here are two tables.
First is Guestbook and other users.
So let's see information about users.
So select star from.
Users could enter and see this when you get access to a database of a website.
So this is the user really first name, last name and this is the user name, which is admin.
OK, and then there is password.
OK, and this is the Eurail to access or to get a login page.
OK.
No, actually, it's a deputy, right, so we go to the login page of debatably, and then if we try
this as a user name and this is the password, we will be able to get access into that website.
Right.
So let's exit for now and let me open a browser.
That's the Firefox.
And if you type in that order 2.5, you will be able to see all of the Web applications that are posted
on me.
OK, now you can open any of them.
So this is.
OK, it's using BHP and here you can enter username and password.
As we have extracted earlier, right, let's go back and if you want to access to a database, you can
also go to BHB, my elamine.
OK, so these are some of the reconfigured websites in exploitable, OK, so that the penetration testers
can perform their penetration testing techniques on all of these websites like.