Hello everybody and welcome back.
And let us continue basically from here what we want to do is first of all we want to find out the name
of the database included in this server now in order for us to do that.
We use this command.
So let us just add to for the user I.D. apostrophe and then once again union select and then what we
want to do is basically add two functions that will give us the name of the database and the name of
the users linked to the database.
So database.
And then two parentheses which is the syntax for the functions in the code then comma users.
And then again two parentheses and at the end we add hash tag and then add the apostrophe.
So let us just run this
UPS function DVR users does not exist.
So let's see what's up with that.
Let me just say it like this function DVR users doesn't exist.
So let me just check point does it give that it should exist.
Or maybe it is the user
Yeah.
It was a user so it's not the it's not the users and in parentheses it is user and then parentheses.
So as we can see B got the name of the database with this function and the name of the database is DV
w e and the name of the user that is corresponding to the database is DV a at local host now that we
got the name.
We want to go further on and let us run our next comment which we will type right here.
So too as an I.D. and then we type here again.
Union select then follow up with me right here.
So S C H E M A underscore name and then comma to from information underscore Shima dot she Marta I believe
that is how it is pronounced and then we at the end specify the common once again.
Now let me just run this and then I will explain what did I run.
As we can see right here the information underscores Shima has basically all configuration and information
for the my actual database.
So the DV w h should be the database for this application.
Now this might be a little bit hard for you at the moment especially if you do not have any previous
Eskil knowledge or knowledge about US fuel injection.
This is basically some of the advanced part for this.
So it might take you off for you a few times to re watch this and search on the Internet a few things
in order to understand this fully but that's OK.
We'll continue right here.
So you will have the material to practice once you learn all of this.
Now let's just continue.
So we ran this command right here and we can see that the DV w ay is the database for this server for
this application.
Now the information the.
Pardon me.
Now we should send the query for tables in order to find out what tables are the the in the d w a database
and we can do that with this command.
So we start off with the idea once again and then union me union select then we want to select table
underscore name coma.
Uh two from information underscore Shima Dodd tables where table Shima equals uh apostrophe D.
Double D VA w eight which is our database and then we specify the hash tag for the comment.
And we ended with the apostrophe.
We use the hashtag as a comment so it should ignore the rest of the code that comes after the hashtag.
So as we can see right here we got two tables one with is guestbook and the other one is users.
Now uh you as an attacker will most likely be interested in these table called users as it possibly
could have some passwords and user names or any other valuable information in it.
So after we discovered the tables we want to basically discover the columns in those tables and we will
target this table right here which is the user stable.
Now we want to find out what columns are there in the table.
So we type here to apostrophe union select and also by the way this union select.
You can also type in smaller letters.
It doesn't have to be capital so it doesn't.
You can type everything in small letters.
I just type it in capital in order to differentiate the obscure comments from the tables and columns
and all of that.
So I will continue with the capital letters.
So unions select now what we want is to select column name we also want to serve the column type from
information underscore Shima dot columns.
Now in the previous one we selected the from the information underscore schema that tables and now we
want to select from information underscore Shimada columns where table underscore Shima let me see oh
I didn't type it well.
So Shima equals apostrophe D.
The WPA and table underscore name equals users.
And of course we end with our hash tag and then apostrophe now what we specified in this command we
basically said well table Shima equals apostrophe DP w e that's we that's us selecting the database
and table name equals users that are selecting the table that we want together columns from.
So if we run this right here you will see we get a bunch of these columns in the table users.
So this is our command right here and we can see we selected the database DV w a table name users and
we were looking for the column name and column type the column name will be this thing.
So user I.D. First Name Last Name user pass Avatar and column type would be the bar chart and then the
number in the parentheses.
Now out of all of this we are most likely going to be interested in the password one as we can see for
the password there is specified the 32 characters as a max for that particular input and now that we
got that we basically want to gather all of this information so and print them out on the screen you
do not want to print out just password since you won't be knowing to hold that password belongs what
we want to do we want to basically print out the first name last name and then the user and password
for that first name and last name so we know who that user name and that password belongs to and for
that we will use a special command called Comcast which will basically as it sells Comcast with things
for us since we only can output two things with this application which is the first name and the surname.
So we want to be able to print all of the information in these two outputs.
So what we will do we will print the user I.D. first name and last name in the first name input.
Well I mean in the first name output and we will print out the username and password under the surname
output now.
Let me see what I mean by that.
So we'll type our blessed comment with this.
So too for the I.D. then the apostrophe and then what we want to do is union select and now we want
to count cat first thing we want to count get would be the user I.D. So user I.D. as we see it right
here it is a column in the user's table.
So we want to split it with the dash.
So we know where it ends.
So we split it with Dash and we add first name to it which is the second column in the user's table.
We can see it right here and then we split that by the empty space.
So just type move and just open up a path free and then empty space and then another apostrophe
and then comma.
And last thing we want to print under the First output which is the last name.
So this is our first one let me just maybe it's easier for you.
You can't really see the command right here so let me just type it in leaf pet and then I will copy
it to the to the website.
So let's just open leaf pad once again so you can see the whole command since this command is could
be possibly a little bit hard to understand.
We just lowered this so I can also open the Firefox.
I do not need this.
I need this.
So let's start off with the command once again.
So we started off as every command which is to as a user a D and an apostrophe and then union select.
And as I said we want to serve to concrete a few information so that we can output all of them.
We open parentheses user I.D..
I believe it's that that is the first column as we can see right here.
User I.D. then we want to type comma and then open apostrophe and then dash closed apostrophe and then
another comma and then first name which is the second column I believe.
Let us check out.
Yes it is the first underscore name.
Then we want to basically what we want to do is at the end space so that we can also type the last name
after it.
And then last name last underscore name and close parentheses.
So let's see if it is really last name.
Here it is last name.
So after that we want to Kat the user name and password as well.
So we type your comma and then com Kat and we want to Cat in the second output the user.
So let me see.
It is called the user.
It is right here.
And the password.
Now we will split these two with the two dots.
So apostrophe to dots and an apostrophe and then comma password.
Let me see if it is password it should be.
Yes it is.
So we will print out the password and we want to select from where are we selecting all this information.
So from TV w a dot user I believe that's how it is called.
So I will just type that right here or maybe it is users.
Let me just check out if it says anything.
Right here.
Yes.
Table is called users.
And then we add the hash tag.
So it should ignore everything else from this comment from the rest of the code.
So now that we selected all of this let us try out this command.
It shouldn't give us any error unless I mistyped something.
So we copy this We pasted right here and then we submit.
And as you can see our output gave us all of the users their user name their passwords their first name
their last name and the user I.D. as we can see in the first output which is the first name we got the
user I.D. which is which we concatenate these three things.
Maybe he's a bad example let's go to the Gordon.
So user I.D. for Gordon needs to then we added the dash.
Then we added first name then empty space.
Then last name for the first output which is under the first name as we can see this right here corresponds
to this
and in the surname section we added the user name and password which for Gordon Brown the user name
would be Gordon B.
And then separated.
We have the password right here.
Now you might be asking these passwords look a little bit weird that is because these are not really
passwords.
These are the cash versions of the passwords.
So if you tried to example again with this password it won't work.
This is the password that is encrypted with some algorithm I will show you how to decrypt it in a few
seconds.
So let's just check out some of the other users first.
So we have another user under the idea 3 which is called Hack and last name me.
Once again this right here corresponds to this right here and the user for that account the user name
for that account is Pablo and the cached version of his password is this we can see that in total we
have six users right here and we got all of their passwords.
Now we got to the end of the columns we got all of their usernames we got all the passwords all of the
information yet we still can file again since Cynthia.
These are hashed version of their passwords.
Now the most easiest way to find out which to which type of encryption are they're hashed is to copy
the hash itself.
So let us just copy the first hash you just copied and just paste it in google and if it is in if it
is a known hash it will print out what type of hash it is.
Now since I already know this is the empty five hash and there are a bunch of empty five hash websites
too that are used to decrypt the hash itself as we can see the hash and the five is admin.
So the password for the admin account is admin as we already know.
But let us try to also decrypt all of these other passwords.
So now that we know that the hash type is empty five all of the other passwords we will also be the
hash type and the five.
So let us just type into Google simply and the five descriptor and here we can just go on to the first
link for example it doesn't even matter
last year ended five hashes.
So state let me just see.
Where do we tap it.
Or let me just to go to this one free and first and if I have encryption wait I do not want to encrypt.
I want to decrypt and define encryption we want to and we want and define decryption.
Here it is.
But I want to one step back.
I believe this is the same website today.
So we go to the empty five on line three and five decryption.
And here we just type here.
You're basically just based here your hash password and it will decrypt it if it is in the database.
So let us go with the first one even though we already decrypted the first one and we said it was admin.
Let us just check that once again.
So we copy we pasted right here.
So copy paste decrypt
and it gives us somebody.
So let us just select all images with the course.
I don't know why this popped up popped up right here but we can verify it.
Hopefully it doesn't go on with thousands of these screens.
OK I believe it is over.
And here we can see that it found the password for this hash which is admin now let us try another password
from different users so let's go with the Gordon's password.
We copy Gordon's hash for hash the value of that password and we type it right here so based decrypt
and once again we get this confirmation.
And I also don't know why this asks but it doesn't really matter.
Let's just click OK and let's see what Gordon's passwords and Gordon's password is.
ABC 1 2 3.
Now you can also decrypt everyone's password right here.
And if you're wondering how this works you can just read it right here it says and define the 128 bit
encryption algorithm which generates a hexadecimal hash of 32 characters regardless of the input world
size.
Now how these Web sites works.
It basically has a huge database of hash passwords and there has to.
And they're decrypted passwords as we can see there over a thousand billion passwords in this database.
And most likely all of these hashed version has version of passwords pardon me will be in that database
and you can check that.
So let's just go on with all of these hashed versions.
We can just type it right here.
Paste it decrypted and it will store France or it'll just select the store front and let us decrypt
the password.
So for the hacked me account the password is Charlie no.
Let us not go over all of these passwords since it always asks me for some either to select cards from
the pictures or store fronts.
It doesn't even matter so I won't be bothering with the rest of the passwords.
You can check them out if you want to.
Just to check what the passwords for these accounts are.
I believe they're all in this database right here.
Since it is a huge database and that's about it.
So we successfully exploited the fuel injection we manually exploited which is the advanced part from
this.
So there are a bunch of tools that automate this process but it is good to know how this process works.
And it is good to do it manually a few times in order for you to understand it and then later on you
can use other tools if you want to in order to automate this process.
Now I'll just show you in the next video what is the blind SQL injection which is a lot harder than
this one since we get the output right here but in the blind one we will not get output and it is most
likely the case that you will always encounter.
So I will show you how that works.
We won't cover the entire blind as code injection city that will take a lot of time but we will cover
the part I will show you how you can start with it.
So that was it for this lecture and I hope I see you in the next one.
My.