OK, so let's increase the security level to the high security, which is fairly secure.
So sometimes it can be bypassed, sometimes it's it can't be bypassed.
And in this lecture, I'm actually just going to highlight something for you.
So let's try and use the same exploit that we were using before.
So if we copy this and we're going to turn on our interceptor and just I'm going to put a normal username
and password for this now.
And then we're going to intercept it here and modify it like we did in the previous video.
OK, now we're going to forwarded.
And as you can see, it's telling us there is a bad username and password, so obviously this is more
secure.
And actually in this particular case, in this page, this it is not injectable anymore.
With this security level, it doesn't implement the best security practice.
But for this specific case, it's secure enough.
So I'm going to have we're going to have a quick look at it.
But it's not the best way to secure your website.
So we're going to talk about the security part at the end of the section and we're going to talk about
the best way to secure yourself against Ezekial injections.
But for now, this is noteworthy to see because it's a quick implementation.
And if you know what you're doing, you can fix your problem quickly.
Say, for example, if you had a problem and you don't have enough time to change the implementation
to the most secure way, which we're going to talk about later, then you can just do it this way quickly
just so that you are secure enough until you can implement it and change the code to be more secure.
So what they're doing in this page now, this doesn't always secure you 100 percent again, but it is
in this particular case, it is secure.
So this is the code for the login.
And right here we have the case, one, which is the arrogant or the security level one.
And here we have the code for security level five.
So you can compare the two codes.
The main the main difference is this select statement, so I'm going to delete everything and I'm just
going to keep these to select statements so we can compare them.
OK, so you can see here in the not very secure statement, we select staff from accounts where the
username is dollar username and password is other password.
So basically, whatever you put in the.
Text boxes for the username and password is being directly used in here.
Now there was Clydeside filtration and we were able to bypass that using the proxy.
So whatever we input in the proxy was being substituted in here.
So we could have we could modify the code by setting the username is equal to.
Or one is equal to one, and then we added a comment.
So basically what happened in this statement right here instead of the username that was substituted?
So whatever the whatever we put in here was substituted and this value was injected.
So this was changed to a quotation and then.
Or one equals one comment and all of this was basically ignored, everything that comes after this was
ignored, which made our statement work.
So as you can see here, we closed the quote that was already inserted and then we added all one is
equal to one, which is a true statement.
We put the username is admin.
Actually, that's what we did.
So.
This would be admon as well here.
So basically, it's selecting anything where usernames equal to admin and it doesn't care about the
password, which was given us access to the admin account.
Now, we could have injected also in the password saying or one is equal to one.
Again, it gives us a true statement.
And this was getting executed.
In this particular case, here in the secure one.
What they're doing is they're doing a function which is called the real escape string, and what this
does is it basically removes characters such as the new line character, the break character and the
quotation.
So a single code or a double code.
So it scans it scans the input we put right here and it removes any quotations that we put.
So if we put the single code right here or when we were put in the double code, it was removing it.
So when you removes it, it basically renders everything inside it as a strength.
Another problem with this now, I said this is only secure in this particular case because they're also
adding a quotation right here before and after the input.
So if there was no quotation, then our inject injection, what we need to inject will not need to contain
a quotation and that we will be able to bypass this function.
But because they're using they're actually hard coded quotations in here, right here and right there
at the end, at the start and at the end of the input.
And then they're also escaping any quotation.
So if the input contains any quotations, they're removing it.
Then whatever we inject, whatever text you put in there will be considered as a string.
So it'll only be considered as normal text and it will never be considered as code.
Therefore, it will never be executed on the server only in this case.
So let's just have examples, so we have our admin here.
So this is the injection that we're always using.
So we're going to put this.
So this is our username here.
So basically what's happened is this is coming up to the code and then the code is going to scan this
and it will notice that there is a quotation right here.
And because there's a quotation, it's going to remove it at this particular function will remove it.
So after the function is applied, the this will disappear and also the function will disappear.
So this is what's going to look like to the code, to the computer.
This is what's going to see.
And it'll basically just be a normal spraying, which is contained within two quotes as well, so we
need to remove the dots here.
And notice that they already hardcoded these two quotes, so because of that, our injection will never
work.
Now, if they didn't include these codes, if they didn't hardcoded them here, if they didn't exist,
even though they used the function, this injection will work.
But because they use the quotes, whatever that's going to come when inside the courts will be considered
as strange and because they're checking that our input should not contain quotes on the server side,
then whatever we put will be stripped out from the quotes and it will never be considered as code.
Again, this isn't the best way to secure your website, I'll explain the best way at the last lecture
of this section, but this is a good way to temporarily secure your website if you didn't have time
to implement the proper procedure.