And this lecture we're going to go and have a look on the high security level and we'll see why it's
an injectable.
So let's go ahead first and said the security level too high.
Now I'm going to go back to my skill injection and let's make sure that the page works first.
I'm just going to put number one like we always did.
And as you can see now the page works.
Now let's try to inject it after the one after the ID parameter like we always did and I'm going to
put and one is equal to one so I'm putting a true statement.
And as you can see now the page doesn't really work.
So let's try to put a single quote here to close it like we did with the low level.
And again this injection doesn't work either even though we're given a true statement that shouldn't
interfere with the current request.
We usually don't look at the code when we're trying to hack but as I said this is an injectable.
So let's have a look at the code and we're going to compare it with the code used for the medium security
level and we'll see what the difference is between the two codes so that we can learn how to secure
our websites.
So I'm going to search and change the security level to medium here just so that we can compare the
two codes and I'm going to go back to the skill injection and I'm going to view the source as well.
And God put them beside each other.
So in here in the medium security level you can see that the idea is being read in here and installed
in the ID variable.
And then there is an app function called my Eskew the real escape.
So what this function does it all go through every character in the ID variable and it'll look for special
characters such as single quotes and double quotes and remove them.
Therefore any quotation marks used or injected in the ID variable will actually be removed at this line
because of the use of my obscure the real escape strain.
Now the thing is once we go down to the skills statement you'll see that we actually don't need to use
any quotes to inject code into the statements our statement is select first name last name from users
where a user ID is equal to ID.
So we actually don't need to close any quotes.
We don't need to inject quotes in the ID variable.
All we have to do is just put any idea like we did in the last video so we can put just number one and
then inject code straight away after the number one.
So when we use this code right here we're basically we we didn't use the quotes in the media.
So we are literally just giving the ID as number one.
And then we're saying Union select column name whatever from information schema tables.
So the code has just been injected straight away after the ID and then the database will read it and
executed.
No need to use quotes again because the code doesn't use any single code so the code just says user
ID is equal to ID.
Now comparing this with the code that we have for the high security level you'll see that it uses the
same function to skip special characters but it's implemented in the right way.
And that's by using single quotes in the Escurial statement around the idea therefore because the code
is keep in the quotes that we put and because they're using quotes in there any code that we try to
inject in here will actually be considered as if it's part of the ID.
So when we use this code right here so if we just use the code as it is without a quote then obviously
it will just be inserted instead of the ID variable between the two single quotes.
So it'll just be considered as the ID.
Whereas if we inject that code in here it'll actually be executed as part of the kill statement.
So let's have a look on what the askew statement will look like when we inject our code in both in the
media and in the high security level.
So I'm just going to bring down the techs here so we have the best statement for the medium here and
the skill statement for the high security level and we'll just try to inject and one is equal to 1 because
as we've seen if you can inject that then you can inject anything you want to really and get it executed
on the database.
OK.
So looking at the medium statement we're going to copy this code.
Now this code will actually go and pass through the my and real escape character.
So it will be removed from any single code that it has but it has nothing and the code will look like
one.
And one is equal to one.
So this statement is valid and wants equal to and will be injected.
Now looking at the high security level notice this use of the single quote which will mean that the
user ID is equal to one and one is equal to one.
So and one is equal to and will not be considered as part of the OR statement but it will be considered
as part of the user ID.
Now let's try to add the single quote and see what effect would that have on the screen or statements.
I'm actually going to get rid of this statement because we managed to inject it and we're only going
to focus on the highs in the statements used in the high security level.
So we're using a single quote here to close it and we're going to copy this.
Now this will actually pass through the screen and will escape strength.
So the single quote that we're using here will actually be removed.
And this line will become one and one is equal to one so it's going to be equal or exactly the same
as the line we used before.
Now one wants this is substituted in here again.
The one and one is equal to and will be considered as part of the Z of the user ID and it won't be considered
as part of the escarole statement.
From this we can see that the use of the my s q r the real escape strength is not enough.
It has to be used with the single quotes right here and combined with that function then this specific
as kill statement becomes an injectable.
Now in future lectures we're actually going to discuss a better way to build web applications so that
they can't be injected with SKM statements.
But if you needed a quick solution then you can go for this until you have time and you can change the
implementation of your website so that it can't be injected.