Now let's try to filter the tables to the tables that are only in our database and DWI.
So we're going to use the word clothes the same way that we are we were using it before.
So we're going to say where table schema equals the UI and then enter and we get an error.
And again the error is complaining about the quotes.
So the website probably uses some sort of security that does not allow us to put quotation marks and
then you are out and we try to bypass that use in percentage 27 before.
And as you see we couldn't bypass that we couldn't it was still detected.
So we need to think of a way to write the database name and put it after the equal without putting the
quote marks right here.
So it is a DVD without the quote marks and we can't really do that by writing the database name as text.
So what we're going to do now we're going to use verbs.
And we're going to use the decoder part of it to convert the text DVD-Video to hex.
Now the decoder is really useful and burp.
Now remember when I was saying that the code for the code is 20 percentage 27 and the code for the hash
tag is percentage 23.
Now you can just type it in here and then go to as and make haste.
You are outside and you'll see that the code for the hash tag is percentage 23.
You can get code for any text you want really.
For example if you put the code you get a percentage 27.
Now what we want to do is we want to convert the text in here so that we don't have to write it between
quotes.
So we actually have to convert it to digits.
And what we're going to do is we're going to convert the text of DVD A to hacks using the decoder part
of burp.
So I'm going to go here.
Type DVD there when you say a the database name and we're going to encode it as hex and we're going
to use this as after the equal March.
So we're going to use it and instead of typing DVD-Video I say I'm going to remove this and I'm going
to type it in zero x.
Now everything written in hex has to start with zero X..
So I type in zero access the start to tell the database that whatever that's going to come after these
two characters is going to be next.
Therefore I don't need to use quotation marks for it.
And then I'm going to put the code that I got which is 6 4 7 6 7 7 6 1 and that's it.
So we converted the database name to hex.
I'm going to copy this exploit pasted in here
hit enter.
I forgot to remove the single quote from the start because this is the medium level.
We don't need the code.
Here we go.
It's working and we got the tables that's only related to our current database which is DVD.
And the tables are against work and users.
Now every time you need to use our work laws you need to use it the same way that we did it now by converting
the name that comes in after the word to hex and zero x without the quotes.
And that way you'll be able to execute to select the columns used in the this statement right here.
Just make sure you remove the single quote and it's going to work for you.
Now because the tables Select Table statement worked and this statement will work because they're pretty
much the same statement.
The only difference is that this one selects users and the other one selects based on the database name
so in this lecture we see how we can bypass some difficulties we can see with Eskdale injections.
And we did that by converting the text to heggs and by playing around with the injection parameter.
So try anisette it.
Other quote remove a quote maybe try to encrypt it use percentage 27 or stuff like that basically just
play around with the parameters until you get it to work.