Welcome back to another episode on How to Hack, so today we'll be discussing about school map, which
is an automated SQL injection to a platform that could actually help speed up the process for us to
actually gain access to the website and be able to pool the database information.
So, of course, over here we go to page sort of first thing want to go into is to enter man school
map to see what are the options available in a school map.
So again, this is a way for us to speed up the whole process of performing SQL injection in an automated
way.
So you have not a really check out a privacy school injection lecture and tutorial.
Please go check that first, because you have to have a basic understanding of how SQL injection work.
And from thereon you can actually begin how you want to automate it.
You can take off all the scripts that you could be using Python because you already understand about
how the manual injection works.
So this is the part where we're going into an advanced to and we've understanding the foundation of
it.
It will be challenging for us to go into the advanced tools.
So, again, a quick recap of our whole school Tabors work, so school tables are like your Excel sheet
rows and columns, so of course, on the left side we can see a unique key.
So, again, this is a unique value, so called customer ID and we have customer name.
We have the contact name, address, card postcode in country.
So again, this is how it is structured, structured almost like an Excel sheet.
But on the back end, of course, in many databases, they have millions or in fact some of them have
billions of records.
So those are the places that we can actually try to retrieve some of this information.
And of course, each of the role could be unique to the table.
And, of course, they could be joined together with other tables as well to be able to perform some
of the other analytics.
So here we go, some of the basic critical statements, so selecting is the retrieval of data, pulling
data out from the database, from the tables dropping is to deliver a table entirely.
Inserting is to key in values into the table.
And update is, of course, to change desisting value in search of a role.
So, again, this is the basic SQL statements that could actually help us be able to control and manage
many of these databases.
So when we were performing a school statement, for example, here we got select all from customers.
So here are this would actually pull out all the records from the table of customer.
And of course, we select we can select specifically on the columns that could actually pull out only
specific information while retrieving all of the roll.
So, again, different kind of statements can produce different kind of results.
So, of course, moving back into the basic concept, Bohol Web servers are working, so of course,
at a very front you have your client HTML where you have these tax forms that could actually allow you
to be able to Kiene data and the data is Santita Web application server and from the Web application
server.
This would allow us the ability to actually insert data and it will process information.
So over here on the web application and we can select from user what user name equals a game.
This is a check trying to check what kind of information are there.
And again, from here, you can see what we are trying to do.
So, of course, SQL injection is the whole idea of bypassing many of these mechanisms, they're working
and be able for us to actually pull in different kind of information, be able to get data or all of
the databases from the otherwise intended operation.
So, again, all these sort of ways that we can use SQL injection for so we can modify data, we can
insert data, we can drop tables, we can do a lot of all these things.
So another example here of SQL injection on the right site, we can actually see the singer could do
actually and a statement and from ending the statement we have they all true.
And then, of course, we have comments and we have and password.
So again, we are trying different kind of payloads to bypass the original intention after tax forms.
So this was bring us into school map, so again, school map very simply on the left site, it is,
of course, built on Paten and here we go, Deshu.
So Deshu is to specify your URL link.
After that, we're going after.
So from the server directly from here, we consider your link and from the early we just have to insert
the URL and will be able to begin injecting information into the site.
So it will be testing, for example, page page equal because there's a question mark that what you
actually capture those content from the text form that has a question mark.
So this allows us to actually pull data into the system very quickly.
So helping us be able to get those information.
So once again, over here, we have union tests, so again, they are doing all this different kind
of test on behalf so that we can speed up the whole process of penetration testing.
And again, is checking on all the vulnerable for you, so, of course, you're in this case, we only
specify one specific vulnerable for so we can specify more vulnerable Few's for the system to actually
check on.
So in this case, for example, we're going to a login page, so this login page, help us check the
account details.
So from the account details, all we get to do is actually key in, for example, Igor Page, equal
user dash in full and we have username and password.
So again, we would check all these forms for checking whether they are sanitized, whether we are able
to bypass the function of it and be able to inject certain commands.
So, of course, here we can see we are targeting information, so we are specifying more question marks.
The question mark, what actually a tests diffuse and see if the fuse could actually be injectable.
And of course, in this case, we're seeing that we actually have a lot more information regarding the
injectable Few's.
So in this case, you can see from here is says that, OK, Page does not seem to be injectable.
And of course, we seeing all this information and it helps us check what kind of Bekka database management
system is it using.
So in this case, we're seeing that it could be a possibly could be a mystical and is asking you whether
you housekeep specific payload so that you can speed up the process of verifying what kind of database
systems are there.
So, of course, over here, we can see that it says that username appears to be or boolean based Blyer.
So again, we're seeing that it is injectable and this is the part.
Once it is injectable, we can further our attempt to get more information, polling data, all doing
database dumping and so on.
So likewise over here from the resources get username is vulnerable, do you want to keep testing others?
And of course, your has the payload information that we can test out on.
So in this case, we can see the different kind of test that was being put into the system, the different
payloads.
So here we have a test and in a singer could or not, and then followed by the follow, we got our we
got time base line again, all this information helping us know what are the payload that was inserted
that could actually be push into the system and ultimately pulling information out later on.
So low here, once we are able to bypass the fuse, we can actually pull information like the database
is tight.
So over here we can see the number of available databases.
So we got DeVita Blooey Information schema at a stoplight, my school and so on.
So we are seeing all of the databases available that we can actually query more information in each
of those databases.
So from here, again, we are trying to enumerate the tables inside the databases, so again, remember,
again, databases, tables and information inside each of the tables.
So in this case, we are acquiring a particular database and then going into the table.
So you can see on the bottom left we can actually see all the tables available inside a particular database.
So once we get the information, we want to be able to actually retrieve the information and content
inside each of the table.
So this is the part where we are specifying Dashty to specify the table they're requiring, as well
as dash, dash, dump to dump all those information.
So in this case, we can actually see the username password.
So in this case, the password is not being hash.
There's no security mechanisms to actually protect it.
So immediately we can pull out all those information from the table.
So here we got school map so we can also have Interactive Squasher.
So again, the interactive sequel shall allow us to do a different kind of commands directly into the
database.
So, again, all this helping us be able to pull all different results.
So here, for example, we got a school statement.
So we did a select all from information on the score scheme, all the tables.
So once you have this interactive shell, we can begin thinking about all of the commands that you can
use, all of the items that you can use to actually speed up the process, accelerate the whole pace
of trying to find more information.
So if you now think about it, what are the techniques, can you use a long school map?
So again, all of this idea is about how can you advance some of these functions and features while
using school map to perform and accelerate the pace of your penetration testing?
So now let us go into the tutorial portion of this lecture sort of screen I have met Exploitable to
running so I can actually enter.
I have config.
So this will tell us the IP address of the web server obsessing.
So in this case is going to be one or two one six eight zero two one two.
So going to the right side, we can actually open up any web browser and we can go into the same IP
address that has been provided to us from anticipatable to so we can enter one or two one six eight
zero dot to one to hit enter in debt.
And of course we can actually zoom in and go to mutability.
So once we go into Mutilates, this is the part where we can actually look at some of the potential
vulnerable Few's that we can try to access into so we can go into Europe's top 10, we can go into injection
and we can say go into user information from extract data.
So click on that and we can see the information directly from here so we can copy the user link.
And of course, we can open up terminals.
So it's easier for you to see so we can zoom in a little more and we can enter men as map.
So this would actually give us the manual page of Ezekial Map.
So again, a very important command because it will actually help you understand what are the parameters
that you can enter and access into which can help you and celebrate a pace of understanding more about
how this platform function.
So we Kodesh V for Bossidy, we got Desch Desh version, we got direct connection.
You are your Elford S2.
So again, all these are key usages of scale map.
So in this case I enter you and actually enter the could and we can paste a clipboard of the user l
and of course a duplicate and hit enter on debt.
And this would immediately help us be able to do a direct attack against a page for you.
So of course in this case we can enter session ID.
Yes.
So you would declare the cookies for us.
So again, you may be checking now that is vulnerable to cross scripting, is vulnerable to file inclusion
attacks.
And of course, here it is testing the kind of database type.
And of course, you're is recommended to perform only basic union test.
If there is not one other technique follow.
Do you want to reduce the number of requests?
So, again, depending on the kind and the time that you have to perform tasks.
So in this case, we enter.
Yes, but in your own test lab, you could actually enter an end so that you can actually see what kind
of commands and Paillot is sending over into the system.
So we enter WI on that.
So of course over here we see that the parameter may not be injectable.
So in this case we may have to try other different kind of feel.
So of course in this case, for example, name and password, I can enter task task and click view account
details.
So from here this would actually open up a number of fields that we can actually try to inject into.
So from the earlier command that we use now, we are going to change it.
We're going to change and update a U or L that has been provided to us now so we can actually go ahead
and click view and actually paste this information on the edit.
Basically bought.
We have to double in, enter a debt and now it will continue checking whether the fuse are actually
injectable.
So in this case, immediately we get a result very quickly.
We got a backend database is my school and from here we can actually see all the information regarding
the system.
So in this case, it says that parameter username and of course, it says that this is the payload that
was used and this is the payload and managed to actually help us bypass the particular view.
So again, we Yossef error base and we also have time base bylined.
So again, all these are the payloads that we can use to try to find out more information about the
database and see whether we are able to bypass the security mechanics of it.
So over here, what we are going to do next is to, of course, be able to dump up information.
So, of course, there are a number of parameters that we can use, a number of options that we can
use.
And in this case, what we can do is actually go back into the lecture slide.
So in the very early part of the lecture, like we can see many, many different kind of techniques
that we can use as part of the attack.
So some of the key things that we want to find out is in terms of the databases, what databases are
there so we can use a dash dash DBS.
So this would actually tell us all the databases inside the system.
So go ahead and enter in debt and it will pull out all the records regarding the databases inside the
system.
So in this case, we got a number of seven databases, so we got a information schema, meta supply
and so on.
So again, all of these are databases residing inside the server, inside the computer.
So, of course, we can go ahead and change this dash capital D So this was specify the database that
we are going to query into.
So in our case, we were down to about ten and of course we can enter again, referring back to the
lecture sleights.
We can enter Desh table.
So this would tell us all the tables available in.
They cite this database so we can go ahead and enter in debt, so distractable table seen entering debt
and it will show us all the tables, insight Ops 10.
So here we got six tables.
So we got a couple blocks, tables, credit cards, pant's tools and all these different information.
So again, we can also now specify capital T and specify on accounts.
And again, we can enter the storm.
So this will actually pull all the records inside the accounts table, helping us find all this information,
insight this table, so this would dump everything.
And of course, we got 16 entries inside the table.
So we got the username, we got a password, we got a signature, and we got all this different information
very quickly helping us find all of the login details for us to access into the system.
So now that we got all the details, all I got to do is, for example, and to summarize of my summary
and we can view account details.
So, again, we are able to login.
We're able to see all the information.
And for example, if I click log in here because we already got a username and and a password, we can
also login as all those different uses directly by dumping out the databases.
So once again, I hope you learned something valuable in today's tutorial.
And remember the like share subscribe to the channel so that you can be kept abreast of the latest cyber
security tarryl.
And of course, you've got any questions.
Feel free to leave a comment below and I'll try my best to answer any of your question.
Thank you so much once again for watching.