Hello everyone and welcome back to the low penetration testing.
Now in the previous videos we covered some of the less common attacks including the session fixation
hijacking obsession and the basically the brute force tech as well.
Now the first tech will work in any case.
You can always try it.
It's not 100 percent possibility that you will get into someone's account but it will always work.
Now here is where the real attacks start.
And by real I mean the most common attacks which is the attacks based on injection.
So we'll be covering some of the exploitations based on injections such as the actual injection dyno
scale injection the X amount injection and the command injection.
Now after all that we will also cover the cross site scripting attack.
Those are some of the attacks that you will actually encounter on the Internet on the Web sites.
Most commonly I believe that you will encounter the FTL injection attack which is the attack on the
database.
But before we we again with these attacks let me just walk in first.
So let's test one two three four
now.
The idea behind these attacks based on injection is the interactive that applications that require the
user input.
Now they're all very similar since the mobility is actually the code itself of the Web site where you
have the user input not filtered well enough so if we have a user input where for example on some Web
site where we search the online shop for some of the tools we need.
Basically if you type there the part of the code it might actually interpret the website might actually
interpret that user input as a part of their code.
If it's not filtering enough now by filter they mean it is excluding some of the uh characters used
in for example ask your queries in JavaScript code and so on and so on.
Now we will start off with the command dejection and we will need also to start our let me just find
it.
Oh WASP word to machine.
So if you have it started already.
Good.
Let me just start mine.
While that is doing.
Let me just check one thing and that thing is if we are connected to the Internet we should be.
Yeah that one that find the one that five.
Good.
So let's start off with some pretty basic injection types.
The first one as I said that we will be doing will be the command injection.
Now the command ejection let's say for example.
This example will practically cover in the next lecture.
But let's say you have a website that is used for anyone to ping their own machines.
So you have a website you put Putin in the user input your IP address and deep web site will perform.
Being the end then the IP address or the domain name.
So as we can see these command paying Google dot com is executed by the operating system on this machine.
Now if you have a website that performs this same exact command the command is also executing on the
operating system of that service machine which means that our user input which was the IP address of
the machine we wanted to ping on that certain Web site was processed into the into the command of the
server in its own terminal.
Now that can be dangerous if for example the the input which was the IP address isn't good enough and
we can type basically any command and executed in the server's terminal the next attack would be the
actual injection or the noise kill injection.
That is basically the attack on the database itself.
Now it is also happening when the user is not filtering enough.
It basically allows us to query the database and possibly find something very useful such as bunch of
usernames and passwords.
It also could potentially allow us to delete the entire database if we wanted to also the next thing
would be the X amount injection which basically is attacking the X amount itself and also at the end
we will cover the cross site scripting attack which is basically the attack where recover or recover
injecting javascript code into a web page so let me just check if our machine is on it.
I will log in and then I will continue into the next tutorial where well will start off with the command
ejection.
So that's about it for this story I just give you a brief view of the injection attacks and we'll cover
each one of them in details in the next pictures.
So I hope I see you there and take care.
Bye.