Now, let's try to filter the tables to the tables that are only in our database and DV W8, so we're
going to use the word close the same way that we were using it before.
So we're going to say where.
Table schema equals.
David and Ed.
And we got an error, and again, the error is complaining about the quotes, so the website probably
uses some sort of security that does not allow us to put quotation marks in the URL and we try to bypass
that using percentage twenty seven before.
And as you see, and we couldn't bypass that, we could it was still detected.
So we need to think of a way to write the database name and put it after the equal without putting the
quote marks right here.
So in this way with the quote marks and we can't really do that by writing the database name as text.
So what we're going to do now, we're going to use Burset and we're going to use the decoder part of
it to convert the text to Hex.
Now, the decoder is really useful and berp.
Now, remember when I was saying that the code for the quote is twenty percent, twenty seven and the
code for the hash tag is percentage twenty three.
Now I can just type it in here and then go to encoders and pick HTML.
You are sorry and you'll see that the code for the hash tag is percentage twenty three.
You can get a code for any text you want really.
For example, if you put a code you get a percentage.
Twenty seven.
Now, what we want to do is we want to convert the text in here so that we don't have to write it between
quotes, so we actually have to convert it to digits.
And we are going to do is we are going to convert the text of a two hex using the decoder part of berp.
So I'm going to go here.
And type D.V. w a.
Does the database name and we're going to.
Encoded as.
Heggs.
And we're going to use this as after the equal market, so we're going to use it instead of typing the
white.
So I'm going to remove this.
And I'm going to type in zero X now, everything written in Hex has to start with zero X, so I type
in zero X at the start to tell the database that whatever that's going to come after these two characters
is going to be hex.
Therefore, I don't need to use quotation marks for it.
And then I'm going to put the code that I got, which is six four seven six seven seven six one.
And that's it, so we converted the database name to Heynckes, I'm going to copy this exploit pasted
in here.
It enter.
And I forgot to remove the single quote from the start, because this is the medium level, we don't
need the quote.
And here we go, it's working.
We got the tables that's unrelated to our current database, which is DeVita, and the tables are guest
book and users.
Now, every time you need to use a word close, you need to use it the same way that we did it now by
converting the name that comes in after the word to Hex and use zero X without the quotes, and that's
why you'll be able to execute to select the columns using the this statement right here.
Just make sure you remove the single quote.
And it's going to work for you now because the tables, the select table statement worked and this statement
will work because they're pretty much the same statement.
The only difference is that this one selects users and the other one select based on the database name.
So in this lecture, we seen how we can bypass some difficulties we can see with ESKIL injections,
and we did that by converting the text to Heggs and by playing around with the injection parameter.
So try and set it adequate to remove a quote, maybe try to encrypt it, use percentage twenty seven
or stuff like that.
Basically just play around with the parameters until you get it to work.