OK so now we know that we can put any code we want in here and it's going to be executed on the system.
So let's have another look now at the statement so the statement says select start from accounts where
username is equal to the user name that we put here and passwords equal to the password that we put
there.
Let's see if we can use that to log in without using a password without even knowing the password.
And I'm going to be doing that with the admin.
So the admin username is going to be admin
and I don't know what the password is for the admin.
So I'm going to do I'm just going to put anything.
So nothing really any any random password and any code where I should run here we were doing.
And one is equal to one and or stuff.
So what I'm going to do is I'm going to do or instead of and then I'm going to say one is equal to one.
So what our code is going to be when I say run this once I inject this this is going to go in here like
we were doing before so our code is going to look like this.
So it's going to be Celeste's are from accounts we're using them as equal to men.
And the password is equal to A.
Now this is wrong.
Or one is equal to 1 which is right.
So anytime you have an R if the OR condition is right everything is right.
That's the way our statement works.
So select start from accounts are using a physical to men.
OK user name is equal to men and passwords equal to A.
That's wrong.
All one is equal to one.
OK I'll accept that.
And then it's actually going to execute it and let us log into the Azman without even knowing the password
for the other.
So let's try to inject this now.
And as you can see I was able to log in as admin and Monkey is the signature for the admin.
Now bypassing logons can be done in so many ways depending on the code that's written on the page and
dependent on the way you want to do it and how you're imagining the code and all of the cases when you
put the single code here you want see this message.
Sometimes you do see it which makes your job so much easier if you don't then you kind of need to guess
what it looks like.
So I'm going to show you another example of bypassing instead of injecting the code like this.
The admin parameter is actually injectable as well as you see when I put the single quote the privater
is injectable exactly the same way as the password so we can inject code in the user name as well.
And what I'm going to do now so let's have a look on this and I'm just going to resell it to the way
it would usually look like.
So you'd have the username and password are the fields that you whatever you put in here are going to
be substituted and the username and password.
So let's try to inject something in the username and what I'm going to say is I'm going to say user
name as you call to admin and then I'm going to close the quote myself and then I'm going to add a comment.
So my statement when I read this statement is going to look like this and I'm actually just going to
copy it here.
And when I inject when I put this code in here and then in my name it's going to inject that in there.
So this is what the code is going to look like it's going to select start from accounts where a username
is equal to Aardman.
I close the code myself here using this right there and then I've added a comment.
So basically all of this is not even going to be executed.
So the code is going to be this it's going to be Selecta are from accounts where user name is equal
to admin and skill let me luggin without even entering anything in the password.
So let's do this.
I'm going to put my user name as admin and I close the quote and add a comment and then you can put
any password you want.
I'm just going up with number one and I'm going to log in and as you can see I managed to log in as
admin.
So again this is black box testing.
So you don't really see the code in many cases you want to be playing around with it and see how it
works with you.
But the main thing is you want to test if the Escurial injection exists and you'd use that to in the
method we showed you in the previous video.
So try a single quote try the on statement try half true on statement so once you've got one and then
a false on statement so one is equal to zero or two is equal to zero.
And if they work as expected then your target has on a scale injection and can start playing around
with it.