1 00:00:01,570 --> 00:00:06,230 I hope you remember what we did in the blindest fuel injection lessons. 2 00:00:08,030 --> 00:00:13,010 We saw how to perform a boolean and time based blind escarole injection XPoint. 3 00:00:13,940 --> 00:00:19,940 And, of course, manually exploiting such a vulnerability is a time consuming event. 4 00:00:21,800 --> 00:00:24,390 And it's also just very hard to go step by step. 5 00:00:25,860 --> 00:00:29,280 So we can use Escorial map to get over these obstacles. 6 00:00:30,630 --> 00:00:34,770 So first, I'm going to start with bullion based one. 7 00:00:36,570 --> 00:00:43,950 And so there's a search box here, I think you know what's happening, just enable Foxe proxy. 8 00:00:45,420 --> 00:00:47,370 Then type something in and search. 9 00:00:49,130 --> 00:00:49,970 Now go to berp. 10 00:00:51,690 --> 00:00:57,270 And the request questions here, so before forwarding, copy it to a file. 11 00:00:58,990 --> 00:01:01,540 And I'm going to use the same file and save. 12 00:01:02,560 --> 00:01:04,300 Then let the request go. 13 00:01:06,190 --> 00:01:12,550 OK, open your terminal, then type Escorial, map R and request the file path. 14 00:01:15,820 --> 00:01:16,720 He title. 15 00:01:17,850 --> 00:01:23,670 Age and test Colin 28 08 to 09. 16 00:01:24,460 --> 00:01:25,240 And run. 17 00:01:31,240 --> 00:01:36,640 Now, it's funny because we're looking for a boolean based escarole injection. 18 00:01:37,880 --> 00:01:40,280 But we discover a time-based one. 19 00:01:41,930 --> 00:01:43,940 Yeah, so you can skip testing the others. 20 00:01:45,360 --> 00:01:49,890 OK, so, yeah, the exploit is with an integer value. 21 00:01:52,660 --> 00:01:53,830 OK, again. 22 00:01:55,500 --> 00:01:57,290 And this can always happen to you. 23 00:01:58,480 --> 00:02:03,430 OK, now, directly, I'm going to point to the bullion based injection. 24 00:02:06,660 --> 00:02:08,010 B is for Boolean based. 25 00:02:09,610 --> 00:02:12,430 It executes, but nothing is found. 26 00:02:13,960 --> 00:02:16,840 So maybe providing the DBMS can help. 27 00:02:19,720 --> 00:02:20,710 But nothing is found. 28 00:02:21,910 --> 00:02:23,840 Oh, no, I'm getting nervous. 29 00:02:25,870 --> 00:02:29,410 OK, so I'm going to add two more parameters. 30 00:02:30,100 --> 00:02:33,820 Level five, there were five those. 31 00:02:34,760 --> 00:02:44,290 The default value is one where a limited number of tests or request are performed and vice versa. 32 00:02:44,290 --> 00:02:50,430 Level five will test were Beausoleil for a much larger number of payloads and boundaries. 33 00:02:51,640 --> 00:02:59,680 So all at all, the harder it is to detect Enescu oil injection, the higher the level must be set and 34 00:03:00,070 --> 00:03:00,970 risk three. 35 00:03:03,220 --> 00:03:05,170 And there are three risk values. 36 00:03:06,490 --> 00:03:11,440 The default value is one which is innocuous for the majority of escarole injection points. 37 00:03:12,950 --> 00:03:20,120 Risk value, too, adds to the default level, the test for heavy query time based rescue, well, injections 38 00:03:20,780 --> 00:03:25,940 and in value three ads also or based escarole injection tests. 39 00:03:27,940 --> 00:03:29,110 Super. 40 00:03:30,330 --> 00:03:34,860 All right, so finally we discover the boolean based blind injection. 41 00:03:35,810 --> 00:03:42,860 No, no, don't test any other, just look at the result is MAP discovers a hard injection type for 42 00:03:42,860 --> 00:03:43,070 us. 43 00:03:44,130 --> 00:03:47,720 OK, so bring in the banner data for me. 44 00:03:52,920 --> 00:03:58,740 And sure enough, it brings the better information for the operating system, web application and server. 45 00:04:01,230 --> 00:04:06,840 So now think how hard it was for us to get one character of the version information. 46 00:04:08,570 --> 00:04:10,160 OK, so get the current database. 47 00:04:14,880 --> 00:04:15,310 OK. 48 00:04:15,460 --> 00:04:25,020 Something went wrong because the escarole map runs in a single thread mode, some data retrieval problems 49 00:04:25,020 --> 00:04:25,590 can happen. 50 00:04:27,150 --> 00:04:34,050 But I'm going to show you that thread a few seconds later, so before adding threads, I'll add these 51 00:04:34,050 --> 00:04:34,860 parameters. 52 00:04:35,970 --> 00:04:45,180 Prefix will add what I write before as Google Maps, payload and suffix will add what I write after 53 00:04:45,180 --> 00:04:46,950 the Escorial Maps payload. 54 00:04:48,390 --> 00:04:53,670 Then I can refresh the school map session to start exploiting from the beginning. 55 00:04:59,490 --> 00:05:03,350 Now, have a look at the payload, it puts everything in place. 56 00:05:06,870 --> 00:05:08,400 So now get the current user. 57 00:05:12,230 --> 00:05:17,300 OK, and add read 10 to retrieve data fast. 58 00:05:21,220 --> 00:05:24,290 Now, I I couldn't see what happened, did you? 59 00:05:24,340 --> 00:05:30,130 It was very fast, so we can use the threads parameter for bigger ResultSet. 60 00:05:31,040 --> 00:05:36,020 Yeah, let's see, for example, this one and make the thread 10. 61 00:05:38,800 --> 00:05:39,730 Look at how fast it is. 62 00:05:45,800 --> 00:05:48,800 So no and no, I don't want to crack hashas now. 63 00:05:50,520 --> 00:05:57,090 OK, so I think we're done with the Bulleen based Bascule injection, so let's have a look to see if 64 00:05:57,090 --> 00:05:57,750 there's another one. 65 00:05:58,360 --> 00:06:00,120 OK, so we go to Firefox's. 66 00:06:01,270 --> 00:06:03,370 Open an appropriate page from the menu. 67 00:06:06,100 --> 00:06:09,340 And I need a request file, so. 68 00:06:11,260 --> 00:06:12,550 Type something in and search. 69 00:06:15,160 --> 00:06:15,850 Open berp. 70 00:06:16,700 --> 00:06:25,040 And the request is here, so copy this to a file and say, OK, so go to the terminal again. 71 00:06:26,410 --> 00:06:27,070 And then run. 72 00:06:31,770 --> 00:06:35,940 And it will get a time based blind rescue injection. 73 00:06:37,410 --> 00:06:39,480 OK, so we know this is not a surprise. 74 00:06:42,050 --> 00:06:45,530 We can also point with a technique parameter like that. 75 00:06:49,830 --> 00:06:51,540 OK, so get the better information. 76 00:06:57,460 --> 00:06:59,500 Oh, yes, please do optimise. 77 00:07:06,290 --> 00:07:12,410 OK, so I'm going to stop it here because even Escorial map has its boundaries. 78 00:07:14,200 --> 00:07:20,170 So as we've done, Escorial map should also wait and time based escarole injections. 79 00:07:22,500 --> 00:07:26,090 So now you may think, well, adding threads to the parameter can solve it. 80 00:07:27,720 --> 00:07:34,560 Well, good thought, but I am so very sorry it doesn't work for time-based escarole injections. 81 00:07:37,420 --> 00:07:46,480 And as you can see, Ezekial Map is very clever, it completes the previous data retrieval process. 82 00:07:48,450 --> 00:07:55,800 OK, so I just I just can't wait that much, so finally we come to the end of the school injection part 83 00:07:55,800 --> 00:07:59,070 of this course, I hope you enjoy that.