And this lecture I'd like to show you an example of how to discover an exploit and a blind askew injection.
Now a blind Escurial injection is one that doesn't display any errors to you.
So we've seen in our previous examples let me just go to a skill injection and if I just put a single
quote here
you'll see that it actually displays an error for me which tells me that this page is vulnerable and
I can exploit this page with a skill injection and a blindest cure injection However it will not show
any errors for us.
So right here in the blind this all if I put a quote and execute it.
You see that it's not going to show me any errors at all.
This doesn't mean that the web page isn't vulnerable.
It just means that the Web site might not be displaying errors and this page might have applied as kill
injection and real life scenarios.
I always approach the pages and try to discover exploit them as nine Asgill injections so I never actually
look for errors and I never depend on just putting a single quote The way I test for the existence of
muscular injections is that I tried to inject a true and a false statement and then see if the if the
page behaves according to the statements that I'm given.
So if I give it a true statement it should give me a valid page.
If I give a false statement it will give me an invalid page.
What I mean by an invalid page is a page that doesn't look like what I expect.
So it doesn't have to show an error.
This will come more clear now.
In the example I'm just going to put one out to see a valid page.
So literally I'm just put in a normal user ID and we can see that it's given us a valid page so it's
given us the first name and the surname.
And this is what the default what a valid page looks like in this web application.
So the first thing I'm going to try to do is try to give it a true statement a statement that returns
true and this is going to be
ones equal to 1.
So this is obviously true.
And when I inject this if the page is vulnerable it should still show me the valid page song and I'm
going to inject it here and one is equal to one.
I forgot to put my comment here.
I'm just going to put the comment percentage 20:3
Now as you can see the page is showing me a valid page again showing the first name and the surname
so it's executed while I'm still in it at all that one is equal to on one is equal to and is a true
statement.
It's not going to affect the execution of the page.
Now I'm going to do is I'm going to try to inject a false statement so I'm going to try to break the
page even though I'm given one which is a valid ID.
So my false statement is going to be and one is equal to zero.
So that's going to be false and I'm going to go away and injected now and as you can see the page doesn't
show the default varlets page even though I'm given number one so you don't see any errors like we've
seen with the normal Asgill injections.
But you can see that the page isn't valid.
It's not just plain what it should display.
Even that will give in the ID equals one.
So when we give a true statement it's given a valid page when we give a false statement.
It's given an invalid page.
We can also verify this using the Order By.
So I'm going to put one and then I'm going to ask it to order by one show order by only one column which
basically is a true statement.
It's always true.
So this is going to be my true statement and I'm going to execute it here.
And as you can see now it's displaying the valid page that we've seen with the and one is equal to one.
So we can also change this to a false statement to give us an invalid page and we're going to ask it
to order by a very large number.
So I'm just going to put 1 000 zero.
So this is going to be my fourth statement.
And if the page is injectable then it should show me an invalid page or a page that I don't really expect.
And again we see a page that we don't expect which means that this website is vulnerable even though
it doesn't actually show us any error pages about the rescue effort.
Now that we're sure that this page is vulnerable we can actually exploit this vulnerability exactly
the same way that we exploit normal as kill injections.
So I can just do a union select one to as you can see I can display stuff in one and two and I'm going
to sit next table name
from informations Kiama tables
and I've actually misspelled schema here.
So the exploitation part is exactly the same whether it's a blind or a normal Asgill injection.
The only difference is the way you discover it and I recommend that you always approach your websites
and try to discover like this kill injections.
So I never rely on only use in a quote.
Always try to use the and one is equal to one one is equal to zero.
And also use the order by to try and discover this dipole vulnerabilities because if you rely on the
quotes you'll be missing a lot of mind scale injections.
There are just as useful as normal Asgill injections.