Now is seen how to extract data using unskilled injection you can increase the security to level one
but you can exploit this exactly the same way that you exploited level zero.
And if you increased the security level to five it's actually very secure it's going to be as secure
as the web log in that we've seen in the log in bypass or uses the my Eskew I'll escape real escapes
strength combined with single quotes and double quotes.
So it's pretty much on injectable.
What I want to show you in this lecture is a trickier a skill injection and I'm going to show you that
in the VW instead of Matilda.
So I'm going to close this
and we're here on DVD anyway and I'm just going to go down to the security level and I'll make sure
that that's set too low.
Now I'm actually interested in the medium level but I'm going to show you how to exploit this in the
low level just so that the information flows properly.
So I'm going to go to the skill injection.
I'm just going to put number one in here.
Now as you can see we get to vanish valid page giving us the first name and the surname of the user
ID that we give given.
Now I can inject this in the post in the box or here and then you're out and I'm going to inject it
into the R L and I'm going to put a single quote here.
And as you can see we get an error telling us that there is an error in the statement which means that
there is an ACL injection here we can verify it by adding a true statement saying and one is equal to
1 which should give me.
I actually forgot to add my comment here.
So we're just going to add the comment so the true statements would actually give me a normal valid
web page like we see here.
So it's given us the first name and the second name properly.
Now if I say one is equal to zero which is an invalid should give me an invalid page.
And here we go again in an invalid page with which means that the ID parameter here is ingestible and
the page is doing what we're asking him to do.
We can also verify this using the order by one and then we can say are there by a very large number
and it should give us an invalid page.
And here we go that dummy is this web page is definitely vulnerable to us kill injections.
Now I'm going to try to determine the number of columns and then up with three.
And this is TELL mass on an unknown column.
Let's try to put two on the page is valid.
So that means we have two columns in this page so we can build our union select statement.
Now you can see I'm actually I actually have them built already and I'm able to select everything.
But I just want to show it to you again.
So I'm just going to have the union select statement with you actually here so I'm just going to say
you and then select one to and we can see that we can display stuff and one in into.
So I'm going to select the database in one
and we can see that my database name is DPW.
So I can go ahead and try to select all the tables using my information scheme other tables so the query
is going to be very similar to the query we're on here with DVDA when you say and the only difference
is that the table schema is going to be set to DPW instead of Austan so I'm going to paste that here.
And as you can see I can get my tables which is guestbook and users.
Now we can go ahead and try to select and find the columns for each of these tables using the same statement
that we use in the previous lecture.
I'm not going to run it now because I've already run it.
And if the if the table statements right then the columns table is going to run.
So I've already found that there is a user username and password column in the Users table and I'm just
going to run this statement to select the username and password just to show you what's going to happen.
And as you can see we can select the usernames and passwords for all the users that we have in the Users
table.
Now I'm actually not interested into any of this because we've done all of that before with Mattel day.
Well I want to show you is how to run these statements with the medium security level.
So I just wanted to do this to show you how it works on the low.
And now I'm going to go ahead and change the security level to medium.
And now I can go to.
Q injection OK.
And we're going to try to discover it the same way that we did before.
So I'm going to go with number one first to see a valid page and this is about that page.
Now I'm going to try to put a single quote after the one as you can see now we're getting an error about
this error is different.
It's actually complaining about the existence of the single quote.
So let's try to put an end to what I do and is equal to one like we did before.
And close it with our comment and this should actually show us a valid page as you can see now it's
not showing us about page.
It's actually still giving us an invalid page even though we said one is equal to one which it shouldn't
affect our statement or our query.
So let's try to put the hash ETP code for the quote.
Instead of using a quote so I'm going to put percentage 27 and see if that will bypass any security
maybe they're using and again I'm still getting the same or same problem still complaining about the
quote.
So let's try and play more with this.
Now as I said explosion skill injections can vary from website to website depending on the way it's
implemented.
So there is a lot of trial and error in this.
So let's try and remove the quote and see if that'll actually fix our problem and make it injectable
great.
Now this has given us a valid phage.
Now let's try to change it and say one is equal to two and see what happens.
And yet this has given us an invalid page.
So the website is responding to what we are saying.
The only difference now is that we're not using the quote We're just injecting it straight away after
the ID after the number OK.
So let's go ahead and try to build our union select.
So I'm going to type in union select one to on Yep that looks like we can write stuff in number one
and number two.
So let's try to select a table name
from information schema tables like we always do just to get all the tables that we need.
And here we go.
We're getting all the tables just like we got them before.