Hello guys again, let's summarize what
we have learned in this course. So
this is a summary we have done quite many
different attacks. You learned
quite a lot about automated SQL injection
detection and exploitation.
And let's say thank you to SQL map
the tool that can be used for automated
SQL injection detection and
exploitation. This is what I wanted to
show you in this course how to use this tool
to automatically detect and exploit SQL
injection vulnerabilities. So let
me now briefly wrap up.
What do you have actually learned step
by step through this course.
You first learned about the basics of
SQL map and
you learned how to test get parameters
for SQL injection.
And in terms of exploitation, we started
with fetching the database Banner with
- Banner switch, right or option.
This was our
starting point really the basics then
we jumped the exploitation.
And instead of fetching the database banner.
I wanted to show you how you can
do something much more powerful, like dumping database
table and Trace and I presented in the
demo how you can do it very easily with dash dash
dump switch and indeed you
have seen that I was able to fetch
the passwords from the database and it
was really fast and amazing.
Then we dig into exploitation even
more and I presented to you
how you can go from SQL injection to remote
code execution. This is the most
powerful attack because it
allows you to escalate from SQL injection
to the most powerful attack that is
possible remote code execution because the remote could
execution allows you to do arbitrary. Well
arbitrary code execution on the vulnerable machine and
it basically means that you are the master of this machine you can
do whatever you want.
And you learn about OS shell
right and switch how you
can use the switch to automatically install a back
door and have shell access to the
vulnerable machine very very powerful. And
here you you so the
Amazing Power actually of SQL map
because you can do it automatically. I'm
really excited about it because you really
can save a lot of time with with this tool.
When you want to do this kind of escalation from SQL injection
to remote code execution.
Then I told you about post-parameters.
Well, we are sending a lot of data via post
parameters. We've got different forms and stuff like
that. So you learned also how to
test post parameters.
And we'll get and post parameters. This
is actually where a bunch of our data is
being transmitted, right?
So you also learn this and in addition
to this I presented to you how you can send the
maximum number of payloads with SQL
map. So I focus on on detection
how to master the detection how to increase
the likelihood of finding SQL injections
with SQL map. You learn about
this risk and level switches, right?
And at the end I presented by
passing web application firewalls. So
you learned about the so-called tamper scripts
and how you can use the scripts to mutate
your request even more in order
to bypass web application firewalls that are
supposed to protect the web applications. But we
ethical hackers need to bypass web
application firewalls in order to be successful in
terms of SQL injection detection and
exploitation. And yeah, this
is it.
I hope you like the content of this course.
And you will make the most of this knowledge. Now,
you've got a lot of knowledge that you
just need to take and apply.
And I wish you good luck with
your journey.
And your own and automated SQL
injection detection and exploitation. I
hope this course has been informative for
you. You will make the most of this course. Thank you very much,
and I hope to see you in one
of my upcoming security courses.
Thank you, and have a nice day.