Now to try and discover escarole injections you need to browse through your target and try to break
each page.
So whenever you see a text box or a parameter on this forum for example page those BHB then something
is equal to something try to inject stuff here so try to use a single code try to use an island or the
ORDER BY statement to break the page and make it look different.
So I'm going to show you here an example.
And I'm going to go way into the log in page first right here.
And it's asking me to log in now if I actually registered with my own name so he can just go in here
and register.
I have a user name called zayd and a password with 1 2 3 4 5 6.
So first let's just I'm going to log in just to show you so my username zayd and my password is 1 2
3 4 5 6.
And now I'm logged in as they do my signature was a note that really just like the test.
So I'm going to log out and we're back at the log in page right here.
We have the page so you can try to inject in that poll we'll get into that later.
So at the moment we have an example of injecting into text boxes so you can try to inject into the name
and into the password.
So I'm going to put my name as zayd and I'm going to put a single quote.
So I'm putting this line into my password.
So let's see if we can break it.
And as you can see now there is an error in display to us and it doesn't look like a normal error.
It looks like it's a database error.
And usually you'd be very lucky if you get an error like this.
Now usually there won't be as informative as this.
Sometimes you'll just see that the page is not acting as it's expected as you expected.
Sometimes it'll just be a page that is not does not look as it should.
For example if it's a news page maybe it'll have the article missing or if it's a blog it'll have one
of the posts missing or different kinds of posts.
So you need to keep an eye on what's changing and this example we were actually getting a really nice
error Asinus which while it is and is telling us that there is an error in the statement that the error
in near the quotation marks that we added and it also tells us the statement that we execute this is
really good for learning because now we can see was the statement that the system is trying to run and
the system is trying to do a select start so I was trying to select everything from accounts where the
user name is equal to zayd and the password is equal to a single code.
And now that the system the web application is already out in quotes around the name so when I said
zayd and other data between two quotes and the single code that I added between another two code so
that's why we had three quotes right here.
So from this we can it's like 70 percent of the Target Web site has on a scale injection we're still
not sure if it can execute what we wanted to do.
So can I actually inject code and get it to be executed.
Let's see if we can do that.
So the user name is going to be.
They can.
And what I'm going to do with the password I'm going to put my password.
So I'm going to put one two three four five six and then unclosing it.
So I'll tell you why I'm closing it because the current statement of the system is it's select start
from
Zayd
is equal to and is going to open a single quote by itself.
So let's call this as passwords so we're treating this as a variable and it takes in whatever I put
in here whatever I'm going to put in this box and it's going to be inserted instead of the password
which is a variable.
So I'm just giving you an idea so you need to be able to imagine this happening.
So I second whatever I put in there is going to put it between two single codes and it's going to be
inserted in there and executed on the system.
So what I'm doing is I'm going to put one two three four five six and I'm going to quote myself.
So what I'm going to do right now the code is going to be like this.
So it's going to like this.
And password is equal to that and I have two quotes right now.
OK.
And then what I'm going to do is I'm going to say and
one is equal to one.
So one is equal to on.
And I'm just run and see if it's going to execute what I want it to do.
So my statement right now is that's going to be select start from I can't where username is equal to
Z and passersby call to 1 2 3 4 5 6.
And note I'm going to be inserting this myself.
And one is equal to one.
One problem that the system is going to complain about is that we have an extra quote here because I'm
going to be uncertain this myself in the text box.
So it's going to be complaining about this it's going to say this.
This is an open code and never has been closed.
So what I'm gonna do is I'm going to add the comment.
And when you either comment basically everything that comes in after the comment will not be executed.
I'm going to use the harsh as the comment.
So anything that comes in after the hash the system is going to ignore.
So I'm going to inject now is going to be this one is equal to on this.
So as I said usually what you have here you have slushed or password or depending on what the program
called for just imagining this.
And I'm going to be inserting this inside.
So when you do that and you insert it inside this is what the code is going to look like so it's going
to look like the right username the right password I want is equal to 1 which is true.
And then it's not going to it's going to ignore this quote right here.
So if we pass this we should be able to log in.
It should allow me to log in and perfect we were able to log in and username.
So far we haven't done anything but this kind of shows us that is it running our code.
Let's try a different thing now let's try to add a false statement.
So we did we did one equal one and that was correct and it executed what we wanted.
Let's try one equals two.
And this is false.
So I have the right password and I have the right username but I did and one is equal to two.
And this should be wrong because it's false one is not equal to two and I'm using it.
And so everything has to be true.
So it should give me an error even though I'm going to put the right username and I'm going to put the
right password so I'm put in one two three four five six and one is equal to two.
So it's going to be like oh this is wrong.
And as you can see it's giving me an authentication error username and password even though I'm given
the right the right password and the right username.
So this confirms that this website is actually injecting anything we want in the password so we can
use the password field to inject as cool code.
And it's always going to be on this forum so we're going to put a password and you're going to post
your code here.
So I'm just going to put it in capital code here because we're going to put a password close the code
and then put the code that we want to execute on the system right here and it's going to be executed
on the target system.