Hello, guys, how are you? I hope that you like
the course so far and you will even more like
it after this module because
this module is really cool. As I told you it
in the introduction. This module
will show you how you can go from
SQL injection to even the more powerful
attack. Now the so-called remote code
execution. So we gonna
start with SQL injection and we're gonna end
with complete control over
the the vulnerable system. So that's gonna
be an ultimate fun for us, right?
so, okay, where have we ended in the
last module and I believe you have remember so
still the same place like
item details.php question mark
ID equals sign 13
And you learned how to use - dump.
But this now time to how launch this
even more powerful attack and let me go to some
details of this powerful attack because it sounds
really cool. But you need to understand how it actually works. So here
is the sequence of steps and now I'm
gonna give you a high level overview because we
don't have to go into the details this
tool again SQL map will do
it automatically, right? So we're
gonna start with SQL injection and
you already know that SQL injection has been detected in
our testing web application. And what
we gonna do this time as
a result of SQL injection is install
a back door. This is
really cool because when I'm able
to install it back door
Then I can actually do a Next Step which is
remote code execution when you are able to install a
back door. Well, you are the master of the system,
right? And for for some of you who are really
curious about the what's gonna happen underneath right?
Because the SQL map is going to do it for you. I will
give you some kind of more technical description. So
what you can do what you can do as a attacker in
case of SQL injection attack is you can
save a file right? It's
possible the consequence of SQL injection
attack can be saving a file and
now imagine that you are going to save a file
and this file is for example dot PHP
file right that PHP file it
actually means that whatever you're gonna put there will be
executed on the server side, right?
And this is actually our back door. So you're gonna
save a file. We for example extension dot
PHP. This is just an example.
And this is how our back door.
And the viad is backdoor or thanks to this back
door. We can just do remote code execution. So
this is basically how it is.
So I hope it is a it is clear. And again
SQL map will do
everything for you.
But how to ask SQL map to install a
back door in case of SQL injection detection successful,
of course SQL injection detection.
Here is the command. So now the
only difference is that instead of
using - dump we are
using dash dash OS -
shell that's it. That's the only difference
so still the very same example, but we
want to have more and more powerful attack.
This is actually the most powerful attack because when you've got
shell access then the game is over, right? This
is it
And SQL map will do the all
job.
for you
So let's now jump to
the demo and let me show you how it
works how this backdoor is gonna be installed on
the vulnerable machine and how
I can do remote shell commands
gonna be fun demo. And yeah, let's
jump to them right now.