Esco up also allows you to get different types of shows on the target server so you can actually try
to get an O Us Show used in the actual argument.
So all you have to do is just run a skill up and put your ad and then ask for an oyster shell know in
my case we've seen that we can't actually upload files to the server.
So not asking me what do I want.
What was the language that's used on the server.
It's using BHB and you can see that the file is cannot be uploaded it's given a for or for error.
Because my website my target doesn't allow my ascii on user to upload stuff.
If this works you'll actually get an oyster shell and you'll be able to run OS commands on the target
computer and other.
The cool thing is you can ask for an ASCII L-CIO.
And what this will give you it will allow you to run any S-curve statement straight away as if you're
on in it through my Escorial.
So we were able to do that before and you're using the new union select well.
And this you'll you'll actually be right and proper as all queries and they will look it's much easier
to write much easier to read so you'll actually be able to run more powerful attacks.
For example we can just select the user by saying current user
or we can just say user We can also get our current database by asking for that database.
You can look up Eskdale syntax and then run and yes kill command you want.
For example if we wanted to select all of the tables like we were doing before we can just do a select
table name
from information schema that tables
where table schema
equal to us then
and I probably made a mistake here I forgot to then.
So I'm just going to be in here.
Enter
they actually underscore here.
Sorry about that.
And as you can see now we're getting all of the tables related to the database called.
I was then again and here we can run any scale statement that you want is just a nicer and easier way
to execute your queries.