Hey, guys, we're going back to another episode on How to Hack, and today we're looking at an important
question, which is, should we store credit card information into any e-commerce site?
And that's a really important question, because a lot of times it brings about a lot of convenience.
So every time you want to buy a product online from any e-commerce site, all you got to do is enter
credit card information, your shipping address and click on to purchase now.
And of course, this one small little button which states safe credit card information for all future
purchases.
And it brings a lot it brings about a lot of conveniences.
So that's for sure.
And it also brings a lot of security challenges because how old is companies storing your data?
How they storing your credit card information, how already storing them, not using strong encryption,
or are they just simply storing them in plain text?
So the reality is that we would not know we would not know how storing those data as a result of that,
it can make it very easy for hackers.
So as long as they find one loophole on the Web site, on the mobile app or on any of the Web services,
it has been enabled onto the application server that will allow hackers to bypass certain security mechanisms
and pull all of those personally identifiable information, credit card details and so on.
And this is very dangerous because the moment hacker managed to just find one loophole, they will immediately
be able to gain access into all this data.
And right now, it's more and more companies are digitizing, enabling more and more of the services
online.
It means that a lot of them are enabling this shopping cart feature, this payment gateway and safe
credit card information option.
So we've offered to do let us get started with today's tutorial.
Oh, yes.
A big disclaimer.
Hacking is illegal.
So ensure that you have written consent or permission from the site owner before you run any of this
hacking techniques or the best part of it is just to try it on your own home, that network.
OK, so we've offered to do let us get started on today's tutorial.
So right here, real web go running.
So SWEPCO is a vulnerable Web application system for us to be able to run on hacking techniques on and
to do right here.
We'll looking on a Web site which is on the Web services so you can go ahead and click on a Web services
and you can click on our Web Services SQL injection.
All right.
So, again, structured query language, which is a way for us to work with databases to abdeh the tables
into records and so on.
So right here we have a particular function.
So enter your account number and once you click go, you'll be able to retrieve your data.
So just like how you would be on an e-commerce site, on any e-commerce site where you have your saved
credit card details, the moment you enter into your profile page, do a pull up those credit card records
and you'll be able to see your details.
So right here when you go, they would have a credit card number.
All right.
So you have multiple credit cards.
They are using perhaps Visa, MasterCard and so on.
Any of those and you would have your names and so on.
So what may be happening is that when you try to run a sequel injection directly onto the input form,
you may not succeed.
Why?
Because they could be sanitizing the input.
You'll be checking the fuse.
They will look at payloads during a lull.
Right.
And do a lot less so they would have those payloads and so on.
So it makes it very challenging for you to possibly run sequel injection on.
Right.
So you could be using SQL map, you could using Berp Suite to run all those attacks on.
So in this case, if I was to go ahead and enter, say, or one equal one.
All right.
And let's see what's the result.
We'll get going it go all right in account.
No, no results match.
Please try again.
So this started kind of error messages you get the moment you try to do some possible SQL injection
on it.
So what could be happening behind the scene is that the application system, as we send those data over
your sanitising to input your check and you're validating against a list.
So what we can look at instead is under SDL Web services.
So over here I can go in and clicked on it.
So over here.
All right.
I can look at the information and we can utilise.
So we have to get credit card requests.
So what we can do is utilize some UI, very simple object access protocol, user interface.
So it simplifies the whole way that we could actually pull data out from this particular Web service.
So what it can do here is to click onto the top left corner right creates a new project.
So I'm going to click on it.
So once I am here, all I got to do is copy, all right, the Eurail are under your eye and pacing under
the initial SDL, right.
So once you have it, go ahead and click, OK?
And it will prompt us for a basic authentication.
So whenever you're going to the web, good for the first time, it will prompt you for the username
as well as the password to log into web going to run your hacking techniques on.
So go ahead and enter guest and guest click.
OK, and we were in and now use magnifier so it is easier for you to see.
So on the left site we can see the projects.
So we have these particular Web service and we have to get credit card and I can go ahead and double
click on to request one.
So we'll get a pop up in supply and right here we are going to send this particular request over into
the Web service to look at a result that may be coming back from, OK, so remember to select off,
right?
So no authorization.
Click at new authorization and basing authorization, click OK, and enter username and password that
we entered earlier where we were trying to set up new Web service.
All right.
So go ahead, enter guest guest or connection to Web service.
So once you have it right, we have here the particular ID.
So this is a string get credit card.
So what we can do here is to specify the account number.
So in this case, one, two, one.
So go ahead and go the top left corner of the request using dialog box click submit request to specify
and point.
All right.
So go ahead and ensure that you got it right.
You are able to.
All right.
So let me change here from localhost to one or two one six eight one two one six eight zero one one
eight.
So this is the IP address of the Web server I'm targeting.
So in this case, I'll go ahead and go to the left site and click some requests.
And on the right side we get to return.
So we've got to get credit card return.
So we've got a couple of credit cards right here.
So what can we do to retrieve all possible credit cards that are inside the database system?
So what we can do now is to use SQL injection so I can enter or one equal one.
So for one equal one is that it is always true.
So if it is always true, it would be for the credit card details that are currently stored in the database.
So I'll go ahead and click submit requests.
And right here.
Yeah, you got it.
We see all of these details immediately.
Right.
So which is why it is critical for us not to save our sensitive data on personal data or even a credit
card information into any of this e-commerce site.
Else what the hackers could do is that they could bypass some of this possible security mechanisms or
they could be new services.
They're enable.
And those services may be not protected yet by Web application firewall, whereby they do not have the
business logic controls, yet they do not have the security mechanisms to be embedded as your coding
Eldo services.
So once again, I hope you've learned something valuable in today's tutorial and even many questions
before you leave a comment below.
And my best to answer any of your questions and will like subscribe to the channel so that you can be
kept abreast of the latest cybersecurity.
Thank you so much once again for watching.