OK so let's increase the security level to the high security which is fairly secure so sometimes it
can be bypassed sometimes it can be bypassed.
And in this lecture I'm actually just going to highlight something for you.
So let's try and use the same exploit that we were using before.
So if we copy this and we're going to turn on our interceptor and just I'm going to put a normal username
and password for this now
and then we're going to intercept it here and modify it like we did in the previous video.
OK now we're going to for that.
And as you can see it's telling us there is a bad username and password so obviously this is more secure.
And actually in this particular case in this page this is not injectable anymore with this security
level.
It doesn't implement the best security practice but for this specific case it's secure enough.
So I'm going to have a.
We're going to have a quick look at it but it's not the best way to secure your website so we're going
to talk about the security part at the end of the section.
And we're going to talk about the best way to secure yourself against a secure injections.
But for now this is noteworthy to see because it's a quick implementation and if you know what you're
doing you can fix your problem quickly say for example if you had a problem and you don't have enough
time to change the implementation to the most secure way which we're going to talk about later then
you can just do it this way quickly just so that you could you are secure enough until you can implement
it and change the code to be more secure.
So what they're doing in this page now.
This doesn't always secure you 100 percent again but it is in this particular case it is secure.
So this is the code for the logon and right here we have the case one which is the arrogant or the Security
number one.
And here we have the code for security level five.
So you can compare the two codes.
The main the main difference is this select statement.
So I'm going to delete everything and I'm just going to keep these two select statements so we can compare
them.
OK so you can see here in the not very secure statement we select start from accounts where the user
name is dollar user name and the password is dollar password.
So basically whatever you put in the text boxes for the username and password is being directly used
in here.
Now there was client site filtration and we were able to bypass that using the proxy.
So whatever we input in the proxy was being substituted in here.
So we could have we could modify the code by setting the user name is equal to or one is equal to one
and then we added a comment.
So basically what happened in this statement right here instead of the username that was substituted.
So whatever the whatever we put in here was substituted.
And this value was injected.
So this was changed to a quotation and then or one equals one comment and all of this was basically
ignored everything that comes after this was ignored which made our statement work.
So as you can see here reclosed the quote that was already inserted and then we added or what is equal
to one which is a true statement.
We put the user name is Ogmund Actually that's what we did so this would be admen as well here so basically
it's selecting anything where username is equal to admin and doesn't care about the password which was
given us access to the admin account.
Now we could have injected also in the password saying or one is equal to one.
Again it gives us a true statement.
And this was getting executed in this particular case here in the secure one.
What they're doing is they're doing a function which is called Real scape string.
And what this does it basically removes characters such as the newline character the break character
and the quotations or single code or double code so it scans.
It scans the input that we put right here and it removes any quotations that we put.
So we put the single code right here or when we were put in the double code and was removing that.
So when it moves it it basically renders everything inside it as a strength.
Another problem with this now.
I said this is only secure in this particular case because they're also in a quotation right here before
and after the input.
So if there was no quotation then our inject injection what we need to inject will not need to contain
a quotation and that we will be able to bypass this function but because they're using they're actually
hard in quotations in here right here and right there at the end at the start and at the end of the
input and then they're also escaping any causation.
So if the input contains any quotations they remove and then whatever we inject whatever text you put
in there will be considered as a strength.
So it will only be considered as normal text and it will never be considered as code therefore it will
never be executed on the server.
Only in this case.
So let's just have example so we have our ID here.
So this is the injection that we're always using So forget to put this.
So this is our user name here.
So basically what's happened is this is coming up to the code and then the code is going to scan this
and it will notice that there is a quotation right here.
And because there is a quotation it's going to remove it.
This particular function will remove it.
So after the function is applied the this will disappear.
And also the function will disappear.
So this is what it's going to look like to the code to the computer.
This is what's going to see.
It'll basically just be a normal strain which is contained within two quotes as well.
So we need to move the dots here.
And notice that they are already hard coded these two quotes.
So because of that our injection will never work.
Now if they didn't include these codes if they didn't hurt them here if they didn't exist even though
they used the function this injection would work.
But because they use the quote whatever that's going to come in inside the quotes will be considered
as streng.
And because they're checking that our input should not contain quotes on the server side then whatever
we pull it will be stripped out from the quote and it it'll never be considered as code.
Again this isn't the best way to secure your website.
I'll explain the best why.
At the last lecture of the section.
But this is a good way to temporarily secure your website.
If you didn't have time to implement the proper procedure.