Hello everybody and welcome back.
And in this video I will show you how to download a specific tool which you can use in order to automate
the process of external injection.
Now in the previous video we saw how to do it manually.
And we did contains function and we were able to gather the usernames and passwords of different accounts
on that Web site in the x amount database.
Now that was the manual process of attacking that web.
But since you do not want to do it every time you can just download a simple tool and it from automate
the entire process for you.
Now I will not cover that all since using tools is much easier than actually doing the manual attack
so you can just check out some of the options that the tool gives you and you can use it.
And I will just show you how you can install it.
So in order to get this tool since it is not a principle in the clinics what you want to do is run basic
two commands one of them is apt get install Python three minus Pip.
Now I already have this installed so this will not install anything for me but for you it will start
installing the Python 3 Pip which you will use a lot not only for this tool you will use to download
all of the other tools that we will use for now on.
Well not all of them but some of them.
So if you just type here the if you just type enter.
Let me just see.
Oh yeah.
So it it is not installed.
It is installed this press your enter.
And as we can see I already have it right here.
Download it you can download it yourself.
And once you do that what you want to do is in easy download the program itself.
Now I already have the program downloaded as well but I will show you the command in order to do that
which is step three and then install X cat once you type this command presenter and it should start
downloading the comment for you.
And since I already have it install it says right here the requirement already satisfied.
Now once you finish this and once you have all the required satisfied and have three installed you can
just basically run X cat and see the available options that you have for that.
And then you can also try to run the manual and the automated attack on the website that we already
attacked in the previous lecture but that's about it for the example injection.
We will not cover it in great detail such as a map and cross-eyed pretenses.
It is not that important for us at the moment and in the next video we will cover the cross-eyed scripting
attacks and I will show you the part.
The the power of these scripting languages on a certain Web site so let's before we end this.
Let me just tell you how you can prevent all of these attacks if you for example wanted to create your
own website or something like that.
You could easily prevent these attacks by filtering the user input so the user input whether it is in
the search bar or for example typing in the username and password or basically anywhere where you allow
the user of that Web site to type something you should always filter for potentially dangerous characters
or any characters that could involve or that could possibly be interpreted as a part of code.
So especially the dangerous characters such as the apostrophe or double quotes or something like that
as we saw it can make a lot of problem especially in the SGI injection and as well in the eczema injection
as we saw in the previous video.
You want to filter out the big and small parentheses as well so not just the quote marks you want to
filter out all of these characters.
You also want to filter out some of the special characters such as question mark karma or something
like that a percentage sign and all of that.
And also what you want to filter out is the common characters.
So the common characters as we saw in the actual injection is the hash tag but it doesn't have to be
the hash tag the common characters are also in the SPL are two slashes like this.
This can also be interpreted as a comment which means that everything come after the these two slashes
will not be read as a part of code will not be read at all.
And for those of you who who learn C you know that this is also the two slashes are all also the interpretation
for comment.
Indeed.
See language as well.
Another type of comment can be the double dash.
So just type your dash dash or minus minus.
It is also our version of comment in the actual language as well.
So in the previous videos where we cover desk you all and type the hash at the end you could have typed
any of these three.
I just chose hash as it is only one character.
It makes it easier.
And basically what you want to do is filter out all of these special characters in order for user to
not be able to communicate with the code on the server and that's about it for these lectures x amount
Industrial Injection in the next one I will show you the cross-eyed scripting attack and we will finish
the event penetration testing there.
So I hope I see you in the next lecture and take out my.