In this lecture and the next few lectures, we're going to be talking about a popular type of vulnerability's
called Ezekial Injections.
Before we start talking about how this occurs and how to exploit it, let's first learn what Ezekial
is.
Now, for if you're getting a test on a certain website, chances are this website is a little bit bigger
than smaller websites.
So it'll it's probably using a database.
Most websites other than very simple websites use databases and the databases are used to store data.
So there is there still are usernames, passwords, news articles, blog posts, pictures, anything
that anything that happens on the website literally is stored on a database.
And the Web application queries the database and then displays the data to you or to the users on screen.
When the users do something, it will either update, delete or modify the data that exists in the database.
This interaction between the Web application and the database happens using language called a screw
up.
So let me show you what I mean by a database.
This is just an example.
I'm not hacking anything.
I'm literally just going to log in to the database that is installed on our floatable machine and then
we're just going to see what's being stored on it.
So I'm not doing any hacking.
There is nothing here that nothing fancy just logging into my Ezekial.
And then I'm putting the user name is it?
And my missus floatable doesn't use a password for the root, which is really bad, but obviously it's
a vulnerable system.
So I'm just going to log in and I'm not hacking anything.
I'm not doing any escarole injections.
This is just the terminal for my Ezekial, which the Web application would use to interact with the
database.
So I'm just trying to show you what I mean by databases and what's saved in their.
So the first thing I'm going to do is I'm just going to type in show database's.
And that'll show us the databases that exist on our target's server, and we can see that we have the
information schema.
This is a default database that holds default information, information about all the other databases.
So this one gets gets installed by default when you install MySQL.
The rest have been installed for each Web application.
So we can see we have one for sticky wicket.
We have one for our top 10 and that's for this one little day.
We also have one called my school, we have one called Mehta's Floyd and one for D.V. W.R, which is
the one that we've been using the Web application.
So you can see for each Web application, we actually have a database and this database holds the information
that is used by that Web application.
Let me show you what's in there.
So I'm going to use.
The.
Ten database.
So this is the one that is.
Again, this is the one for Mittell Day for this Web application, and we can see the table, each database
has the table, tables and tables.
There is information.
So I'm going to say to our tables to see the tables that we have.
And you can see we have a table for accounts, so you can assume that this table has information about
the user names, passwords and information about the users.
We have a table for logs, so probably has the blog and puts the posts and the comments in there.
You can see captured data at credit cards, so there's a table that contains credit cards.
Now, this is huge for shopping websites.
They actually would have credit cards table and the information for the credit cards would be stored
there.
Basically, the database will store everything, all the data that is used on the website because they
don't get stored on files.
It's not efficient.
So let's have a look on the accounts.
And if I just say select, so this is exactly how the Web application would be retrieving information
from the database.
It will be selecting staff, updating or deleting.
So I'm doing a select statement here.
Again, this is not hacking and not doing anything, just selecting stuff.
And I'm going to select Star, which means everything from accounts.
Apostrophe, and as we can see, we can get we have the account ID, the username, the password, and
then the signature for the person.
And if that person is an admin now, these columns depend on the table.
So it's actually the person who designed the database, designs, the tables, the columns as well.
And then the data gets inserted by the Web application.
So we can see that we have a user called admin and their password is admin pass.
We can see we have a user called Adrienn and their password is some password, so.
This is just to show you what database's look like and just to get a feel on it, because in the future
videos, we're going to try to exploit these databases and have access similar to this.
So this I just logged in with the username and password.
Now, usually you wouldn't have access like this.
Only the Web admin would have that access.
And the future videos, we're going to try to run some attacks in order to gain access similar to this
so that we'll have full control over the database, so that we can read stuff and see if we can write
or modify things.