And all of the lectures so far we were exploiting Asgill injections manually.
So we were injecting the code into the R L R into the text boxes and this video I'm going to show you
a tool called a secure map which allows you to do everything we learned so far and even more stuff.
This tool can be used against my skill databases which one that we were having the example on.
It can also be used against Microsoft Escorial Oracle and other database types.
The tool is very useful and is very handy in many cases.
Sometimes the injections aren't as nice as the one we see and sometimes you only get one output for
each record and you have to look through all the outputs so that you can automate that and just do everything
for you much easier and much simpler.
So let's first of all get the or else that we were using for the injection.
So I have that text file here that we were using and I have the URL that we were using before so is
the user informed APHC usernames admin password admin password.
You don't really need to know the username password.
So I'm actually just going to post anything here.
So just assume that we don't know the password so we're only inject injecting Escorial injections we
don't really need to know any of this stuff.
I'm going to do is copy this and then I'm going to run as cure up and I'm going to do you specify the
owl and I'll put my target and I'm going to make sure that I happens between two quotation marks so
that it doesn't ignore anything.
And any signs in the middle so we have some signs and characters in the middle that I wanted to all
be treated as one you're out.
So all I did is SKM up you my target and then hit enter and to automatically look through all the parameters
so it's going to look through the user info through the username and password to see if any of them
is injectable.
And then once it does that it's going to store it in its memory so it's good to know that this is injectable
and then we'll be able to further exploit the target so you can see now it's stink that our target could
be my screen or cross-dress as well as asking me if I if it should skip other tests and I'm going to
say yes because I know it's my Asgill and now it's asking me if it should do all the tests for both
databases and I'm gonna say yes assuming that I'm not sure which one it is.
I know it's my ASCII art but I'm just going to let it do its thing and will see if it can do it properly
or not.
So at the moment is checking if it's postgresql you UL and I'll miss you when it's gone.
No that's not and then it works and it's going to know that it's might as well just found out that the
user name seems to be injectable and sure enough would still Nazia that the parameter username is vulnerable
and we can inject it.
So it's asking me do I want to check the other parameters such as the password and all of them.
I can say yes and do it.
I'm going to say no because I don't mind if it just uses the username for the injection.
So it's all good.
Now as Mark knows that the target is injectable and it knows that it's going to use the username parameter
to inject stuff and I guess that it figured out that it's running Linux you want to and it's figured
out that it's used in BHB with Apache to point to point 8 and it's use in my s server as database server.
So let's rescue all my help and see what we can do now.
Now this tool is really big and allows you to do a lot of things.
So in this video you're just going to show you a quick look on the video and I recommend you spend more
time with it and try to see what else you can do with it.
OK.
So let's try to get the current user and are going to try to get the current database.
So we're going to use the same command that we used before and I'm just going to add to it.
D-B I'm asked to get the current databases
ODBC.
Sorry as you can see we got all the database that we have.
So we have the B W H we have information schema ammeters.
Lloyd my school was 10 which was the one that we were exploiting before.
A.G. We now if we do current user
you can see that we are root.
And if I do care and database
we will see that I was that is our current database.
So now let's try to get the tables for us.
So remember when we did select table name from information schema tables where table name work table
schema is equal to all was that we're going to do.
Again let me ask you a map to all of that for us.
And so the command is going to be we're going to ask you to get all the tables for us and we're going
to use the D option to specify the database and our database is going to be called out US 10.
And as you can see it got us all the tables that exist.
And remember it's the same we got accounts logs table and the credit cards as well.
And now we want to get the columns then we can use the same come out again and we're going to say Get
me the columns
where the table is cold accounts and the database is was 10 and right here we can see that we got the
columns.
So we have these admin password in the username and we can get the data using the dump option.
So the same command that were used before so will get in the from the table that's called accounts and
the database that is called our turn.
I want you to get me all the data.
And here we go we got all the data we have the admin password admin pass and we have Adrian and his
password is password and we got all the data right here.
So as I said the tool is very useful.
It can be used to make our life much easier.
It does everything automatically and it can do everything we did and can even do more stuff.