Hello everybody and welcome back to the next sartorial in penetration testing.
Now right now we will start off by covering some of the basics of school and the basics of Eskil injection.
So first of all for those of you who don't know we d ask you all injection.
We basically make an interaction with the database itself.
Now the database is mostly used to store information for example user name and usernames and passwords
can be stored in database.
And once you type them in a form the server queries the database and compares password you typed in
with the password stored in the database.
And if they match it will allow you to log in.
So the example would be for example for any logging form that you encounter whether it is on the Instagram
Twitter or any social media account.
But it will do is once you type it in it will make a query to the ask you out database and it will compare
it first of all it will probably cache your password and compare the hash password with the hash password
stored in the database.
And if they match you will be able to log in.
So the problem here happens if the person who created that website didn't filter the user input well
enough and didn't forbid some of the characters used to query the database.
Now it can allow it can potentially allow the user to send as quote queries and gather a bunch of the
information that he shouldn't really gather.
It can also allow the user to delete the entire database if he wanted to now before we begin let me
just open leaf right here and explain a little bit more what escrow is and how you query the database
first of all the database is just a bunch of tables that are connected with the same system and that
are also connected between each other.
Now table what I mean by tables is basically table is a list that contains information for the same
type of elements for example table of users.
So you have a Facebook dot com for example and it probably has a database with a bunch of tables of
users and the dos.
The tables are basically consisted of rows and columns.
So for example you could have the new row of user than below row called password for user than below
row of the some of the other information for users a mobile phone email or basically any other information
you want.
It doesn't have to be anything linked with the user itself.
It could be for example you visit an online shop and it sells I know flowers for example and you could
have a table of different types of flowers right there and different types of information for those
flowers.
And once you search the online shop it queries for those for that database no how do we query a database.
How do we actually interact with the database itself.
Now there are there is in the Austrian language.
It is not that hard to learn but in the astral injection it might seem a little tricky to get used to
it.
But once you learn some of the basic commands it is not that hard to continue learning it.
Now some of the top commands would be create select update insert delete drop.
Now these comments are used to query these database and they basically do as they say create will create
database.
Select will select a specific for example table in the database or specific column or row it doesn't
matter.
Update will basically update the database insert will insert a new element to the database or to the
table itself and delete will delete a certain part of the database for example you want to delete a
user he decided to for example close the account and you want to delete it from the database you will
do it with D delete comment and drop basically delete the entire database itself.
It can be very dangerous if the site is vulnerable to the actual injection.
So for example let's say the Facebook portable to the actual injection and you just type the drop and
the name of the database.
You basically delete the entire database of users and passwords which would prevent it which would become
a really big problem.
But luckily Facebook is not vulnerable to the actual injection and most of the bigger web sites are
an honorable to the Eskom injection.
But some of the less known websites could be so.
Also one more thing the comments delete and drop are not ridiculed that much by the attackers since
loss of information is not the preferred method of the attack itself since attacker in most cases wants
to gather information and not delete them.
Now put yourself in the shoes of the attacker valuable to the attacker is the passwords and user names
that he could gather for that account then deleting every account if he deleted every account he would
just make a big problem.
But if you gather all usernames and passwords he could basically log in as anybody to that website and
that could prevent a huge problem.
If that website was for example PayPal you could send a bunch of money to himself and he would probably
get caught after some time but that isn't the point right here.
Now the command out of all of these that you will use always is the select command.
So this command is used to query the database.
So for example you want to you find out the SPL ejection injection you want to select the table with
the passwords you will do that with this comment.
Now the the basic the will query will look something like this so select and then some kind of elements
that elements from Table table where condition on connotation.
So this is the basic query for the actual database we select some elements from some table where and
then a certain condition.
Now the type of that and the for the example for this command would be something like this let's say
select Name Description
price prompt products where price is less than fine ninety nine for example.
Now this is the basic query database for a website that would possibly be some kind of the online shop.
So we select the name of the product that we are searching for.
The description of that name and the price of that name from all of the products where price is less
than five ninety nine.
And then once the user selects that somewhere the server prints out back all of the responses that are
below 599 and that have name description and price for them.
So
it doesn't have to be a single thing that we specified right here.
We can specify two things.
So for example you could just type select for column A.
So we want to circle a from table X where column some other column E equals employee
and Column F basically equals one hundred now.
As you can see you can also use these logical conditions which basically allows us to set two things
right here.
So we select column A from table X will column equals employee and Column F equals one hundred.
So this is how the basic Kasriel query looks like.
Now you might find it a little bit tricky but you should be able to understand it if you don't.
However just search on the Internet some of the SVR basics and you will get used to it real fast.
It is one of the easier languages but its syntax can be a little bit weird as we can see right here.
This select from and where is typed in I typed it in capital letters.
You don't have to if you don't want to.
I just wanted to type it in the capital so I can show you the different parts of it.
So this column is the part of the database these table X is part of the database.
The column is also part of database.
That's why I typed it in the letters and the Select form and where and.
And basically conditions that we use to query the database now.
Now to show you some of the basics of the SDL I just want to let us just continue in the next lecture
with the exploitation and the attack of the Esko injection on the our OS political machine.
So this was about it for this lecture as I said.
If you want to just check out on the Internet about the scale bar and I will see you in the next video.
Well we will be attacking our first target.
So I hope I see you there and take a.