And this lecture I'd like to cover a case that I face in pretty much 50 percent of the websites that
I do penetration testing on.
So let me first just run and exploit the ones I've already seen so we're just going to run this statement
which will select the table name from information schema tables.
So this should list all the tables that exist within our page.
And I have my security set too low at the moment so I'm just going to paste that here.
Remove this extra one and hit enter
as you can see it gets exploited and it shows us the table name here instead of number one.
So we see all the table names that exist within this current database.
Now the case that I'd like to cover is when you actually run the statement so the website will be vulnerable.
And when you run the statement you will only see one result at a time and that's because the page is
programmed in a way to display only one result at a time.
To do this we're actually going to need to modify the code for the low security level for DPW I will
do that now and then we'll come back to exploit it.
So I'm actually just going to modify the code for DVD-Video.
This is not part of the exploitation.
This is just to make this exploit a little bit trickier.
So I've missed Meta's floatable now and I'm going to open the low security level of the SQL Injection
file.
So I'm going to use sudo because the file has root permissions and I'm going to use Nonno as the text
editor.
So this is the program that I will use to modify the file and the file is stored in var w w w w o a
vulnerability is a skill injection source and then lo ph.
So again I'm just going to go through this come and see what we're doing is we're saying we're saying
sudo to run the file in root privileges.
Now what is the program that we're going to open the file with.
And then the file is stored in Varda readable WDW I Woolner abilities as Kulai source Lowder's ph.
I'm going to hit enter and asking me for the admin password now the root password is as admin.
Exactly like the username.
We have the source here for the file.
So I'm going to modify it here I'm actually going to modify this to you.
So what this loop does it actually loops through all the characters all the records that this askew
statement gets right here.
And then it displays them on screen.
So what we want is we want to modify it to only display words of the first result.
So I'm just going to comment this line two forward slashes other comment.
So basically this line will be ignored and I'll also comment this line because it closes the while loop.
So this line will be ignored as well.
Now you really need to care to worry about what this means if you're not a programmer.
It's not very important just come into these lines and we'll see what happens at the client site because
what we're what we're interested in this lecture is not the programming we're interested in to the penetration
testing.
So I'm just going to hit control X to save this.
I'm going to hit Y and enter and that'll quit and save the file.
So we're back here and I'm going to run exactly the same statement so I'm not going to modify it.
So I'm still saying unions select table name from information schema other tables.
I'm actually going to refresh the page.
And as you can see now this is not really working or is it working but it's only shown us the first
the first record that's been selected which is the American So this is not even useful.
So the first thing that I'm going to do is this is bringing us the record because the admin has the
ID of number one.
So what we're going to do now is we're actually just going to give it an invalid ID so I'm going to
give it an A minus one.
And as you can see now the statement works we're getting a table that exists in the information schema
tables but we're all together in one table at a time.
We're not getting the full list of the tables.
And this is because the page is programmed in a way that will only display one result.
And this happened to me a lot with a lot of times when I'm doing penetration testing.
So keep in mind that we can run any all statement that we want on the tape on the server so we can modify
our skill statement to iterate over all the records and display the content.
So what we're going to do is we're going to know obviously can use the word statement to only show database
tables within your current database but at the at the at the moment I want to show you how it how to
iterate over all the tables.
So what we're going to do instead is use the limit keyword to specify which record we want to display.
With the current statement this way we'll be able to iterate over the records one by one and display
all of them.
So the statement is going to be unioned select table name from information schema or tables and we're
going to say I want to limit the limit keyword takes two values.
The first value is the location of the record that we want to start displaying records from.
So where we want to start displaying records so I want to start displaying records from the first record.
So I'm going to put zero because the record numbers start at 0 and the second value that the limit keyword
takes is the number of records that we want to display on screen starting at the value that we specified
in here.
Now we know that this page right here can only show me one record at a time.
So the second value to the limit keyword can only be one.
In this case.
So basically what we're saying is we want to select the table name from the information schema tables.
I only wanted to display one record starting from record 0.
So if I copy this and paste it here
you'll see I'll get the first table right now and then if I want to go to the second table all I have
to do is modify this so like I said this value the first value in here means I want to start at record
0.
So if I want to start at record 1 I'm just going to put one and then I can copy this and paste it up
in here again.
As you can see we got the next table.
Now again if I want to get the table after this all I have to do is modify this and set it to 2.
And that means that I want to start this play in from record to and I only want to start to display
one record.
Again if I hit enter as you can see I'm getting the next table.
I can keep doing this to iterate over all the records manually.
Now we can also enhance the statement by using the workloads.
So before the limit we can say I want to select a table name from information schema tables where table
schema is equal to DV w a.
Now if we paste this in here as you can see this has shown me the users and again I can iterate over
the tables by changing the number here so this is display in the record at offset 1.
I can set this to 0 to display the first record.
And as you can see the first table or the first record is guestbook and that's it.
So just a quick a nice letter to show you how to bypass this problem.
If you face it in pages that would only display one value or one record for you at a time.