OK now I'd like to show you an escrow injection and then the different file and different page and I'll
show you a few different things that you can do to exploit that vulnerability.
So the first thing I'm going to go to the log in page which is your user info.
So the first I went to the logon page from there this time I went to the user info page.
So this fit this page will show you the information about the user provided you give the username and
password.
So I'm going to do it and I'm going to put my password on two three four five six and it'll show my
D-cells username and password then my signature is a.
So the statement that's been executed here is similar to what was being executed when you log in.
So selecting start from accounts where username is what you put in the user field and password is what
you put in the password field.
So what we're going to do now is we're going to see a different way of exploiting this kind of vulnerability
in the previous video.
We were doing it using a post text text box.
So whatever you put in the text box was being posted using a POST method to the web application.
Now these vulnerabilities can exist.
To get and what I mean by get is when you do get one something isn't as good.
You will see it here and you're out.
So if you look at the R L here you see it's being sent as the usernames and passwords one two three
four five six.
So let me just copy this your L here.
And we'll start playing with it from the R L and instead of doing it on the web page I just want to
show you a different example cause in many places there might not even be text boxes for example that
could be something like in news and news ph.
So we can see here for example in this example it's indexed ph.
And in Europe interesting you might see something like you use that BHB.
And for example ideas you call Too-Too and then you can try to inject stuff in there.
So we're having an example here where we're going to be injecting things into the user in any field
which is this field and we're going to be injecting stuff in here.
So any time when you're doing your practice any time you see parameters like this you should try to
inject them any time you see something that Ph.D. and then you have a parameter equal something they
always try to inject stuff in there and see if it works for you.
So we also see a way of discovering the injection and that was used in the quotation mark and using
the.
And so we do a false on and a true and and one is equal to one and then and one is equal to two.
And if the server is executing what we want then we're going to know that there is an Asgill injection.
I'm going to show you another way of discovering these exploits and it's using the order by as the name
suggests the order by statement is used to order the results that we get on the screen based on a specific
column.
So our injection is going to be like this so I'm going to do over there a one so this if if the injection
exists this should work because in each select statement there should be at least one column is being
selected.
Therefore when we say order by one we're saying I want to order the results based on the first column.
Therefore this should always be acceptable by the database and return a true or something that we expect.
We also need to add the comment in here and execute this code so it's exactly like before.
So when we're doing this basically this is where you are and what's going to happen on the database
or this is the code that's been executed on the database.
It's going to look like this.
So it's going to be select staff from my class who are usernames equal to Zayde and note how this is
close in the code.
And we're going to do an order by one and there should be this code here for the and and this this comment
comment will tell the escarole interpreter that to ignore anything that comes in after it.
So all of this is going to be ignored.
So I'm copying this
so you can actually paste this injection for Zayde order by one into the name right here and that's
going to work.
But I again I just want to show you a different way of doing it by injecting it through the browser.
Another thing that I want you to note is when you inject yourself into the browser the browser the code
should be encoded.
So for example this sign usually when you put it on you or else it should be written as a percentage
23 spaces for example gets converted to percentage 20 and percentage 23 is the comment that we're using.
So I copy that and replace my common sign with.
Now you can google hash ETP encoder and you'll see online there is online tools that will just convert
this for you.
For me now I know that the high side can be converted to percentage 23.
So that's why I'm using it there.
And I'm going to hit enter and as you can see now we're seeing something that's acceptable
nothin wrong.
And then it's showing me the information about Zayde 1 2 3 4 5 6 and something with signature.
So it is ignoring the password.
So the injection worked and it's ordering by one so it's not doing anything wrong.
Let's try to make this number one.
A very large number so put in 10000 or 100000 out.
So what we're seeing right now is I want you to order the results that will be returned by the current
select statement based on column 100000.
Now chances are there aren't 100000 columns used in this select statement and therefore this should
return an error.
So when I execute this you'll see that there is an error and the error is in the order close and tell
us that there is an unknown column for 100000.
And this is great cause now we know that the database is executing what we want so when we told that
to order the results based on the first column it showed us results.
So it followed what we told it.
And then when we told it to order the results based on a column that does not exist it gave us an error.
So it's obviously vulnerable to scale injections.