Hello everybody and welcome back.
And right now I will show you the blind Eskil injection.
So you also have it under the Vulnerable.
That application directory so you just log in right here where we were in the previous tutorials and
just go onto the SPL injection.
Blind now you will see the same the same output or not the same output.
It is basically the same version as the visible Esko injection just right here.
If you type the apostrophe for example it won't print out the error which makes it blind so we do not
really know if it is vulnerable or not at all as we can see in the previous one.
Once we type the apostrophe and submitted it gave us the error in askew syntax
but if you take pride here you should take two and then two apostrophes you can see that it actually
gave the output for the second user which basically means that injecting is possible.
It didn't give us an error about syntax or anything it just gave us the output for the second user.
Now what does this mean.
It basically means if we type here the same command as we used in the previous one.
So if we for example use the user under the idea of one and then we type here and one equals one and
we submit that we will get the user under I.T. one but if we type one and one equals too late they forgot
the apostrophe it won't give us any output.
Now we can conclude from this that the correct statement will give us output.
Wow.
The wrong statement or not a true statement will not give us any output.
So we know that 1 equals 1.
And when we type that we notice that we do that we got the output for the user right under the idea
number one.
And when we type do you want equals 2.
We got nothing as the output which means that statement is not correct.
So we can conclude that we can only know if the answer is correct or not.
So all make all our queries that we are using from now on need to be constructed so that you receive
a yes or no answer Now what does that mean.
That means that the only way that we can for example do the first step which is discovering the name
of the database is by brute forcing every character.
Now if you type here since we already know the since we already know the name of our database we did
it in the previous popes Pardon me.
What am I doing right here.
Wait was it all the time on the on the normal Eskil let me just check it's right here.
So we get that right here.
And then if we try this one we get no output.
But what about this one.
We should get something
oh yes it's right here so you can see that the SVR.
Let me just go to the blind one.
You can see that the just tape once again and one equals two.
You can see the Astro query in the link itself.
That means that first of all this Haskell query sent with the get request.
And second of all we can see that the of the characters of our query are encoded for example.
This uh.
Percent 3 d is encoded
basically that is the only thing that's encoded.
But it doesn't matter what I was saying is that you basically need to brute force every character in
order to find out whether in order to find out for example the first step which is the name of the database.
And as I said if we type here and the database function which gives the name of the database as we saw
in the previous video and we type you DV w hey now we know that the database name really is DV W A.
So this will be a true statement and we will get the idea the user under the name under the I.D. one
since this is a true statement.
But if we type here a false statement statement.
So we use the same here but we misspell one letter so DV w w and click here on submit you will notice
that we actually don't get any output which means this is not a true statement.
So the first one will here since the VW is correct.
And the second one one print out anything.
So it's not the correct answer.
Now we can carry on with this.
Uh method in order to find out the first of things.
So what you would do is basically you would type here the same command right here and let's say you
don't know what the name of the database is you would basically type your letter so let's say it's the.
Oh let's say it's actually G.
And then you go to the Burchett you turn the intercept on and then you submit this you will see that
we send this we get the request and what you want to do is basically as we can see this is encoded and
our letter is g and here you would send this.
What you would do.
Let us just go and find that packet.
Here it is.
What you would do is you would send this packet to the intruder and then from here you would select
only the letter.
The first letter and you would compare the result by the diff by the difference in the answer of the
length.
Now what I said basically we did this similar kind of thing in the brute forcing attack where we actually
tried to see which response gets different length so the same method applies right here.
And once you discover which letter uh gives different length of a response you would know that that
letter is the first letter of the database name.
Now also what you will need first you would clear all of this then you would select on it a letter which
is here in the link and then you would brute force that letter with all of the letters from the alphabet
so you would have to create a password list which is basically on the ABC d e f g and supply it in the
payload section right here.
Well it works.
Wait let me open Birchwood in the payload section right here.
You would supply that list with all of those letters.
And then once it finishes you will see the different uh length of response for the correct letter now
once you find the first letter you will do that for the second letter and for the third letter and for
the fourth letter.
And finally you will find out that d w the DV W A is the correct.
Basically the correct name for the database and then you will proceed on with the tables and then the
columns and then the user and all of that stuff that we covered previously.
So that's why this would take a lot longer than the previous video.
So I will not be doing it.
Uh.
There's no really point in sitting here two hours just to do the same thing as in the previous video.
So basically it is the method where you brute force every letter and then you find out the correct name
the the principle then the commands are all the same as in the previous video.
So that's about it for the blind Esko injection we won't be really doing it since there is no time to
waste.
We need to cover more things such as the obscure old map.
Now what is the scale map.
So let me just close all of the things right.
I did not want to save it.
So let me just be here on X and click here no.
So what is your map is is it is basically the program or tool that comes pre installed in clinics and
it is used since it automates the process of vascular injections.
So all of the stuff that we did manually in the previous lesson and the lesson before that we can do
automatically by this tool.
That's why it's easy to use and you basically don't need to know anything about obscure language or
any type of queries in order to do this.
You only need to provide the link the level of a level of inspection the risk and some other options
and it'll run on its own.
So as I said it comes installed in the clinic so just type your astral map and it will print out your
available options or wait to print out there.
So in order to see our options.
Just type here.
Does this help.
And right now we see our available options.
So let us call up a little bit what we have here is the reposting level then the minus you for the URL
so you will always need to specify this then what we have is.
Google door checked or proxy so you can set proxy cookie codes cookie so you can basically even send
a cookie the data DNS.
So now you can check out all of these options.
We won't be covering in the details since we cover the harder part which is the manual count injection.
This is only one command so we will do it on our specific website.
We're not upset the specific page on our little machine or less.
So let me just open up Firefox.
Once again
so go on to your always put the machine on and through that 168 on that 6 I believe and go right here
on the Mall and however you spell this out.
I would say this multiple day to practice every day using connections.
Well that could be because I closed burps shit.
That's what happens when you think you don't need something and then you actually do need it once again.
So let's just open up shit real quick so quick here.
Okay.
Then we go here next.
Next month it opens up.
Let's wait for it.
So next next time we wait for this to open.
Now while this is opening let me just tell you that the astral map can be used both for astral injection
and bind Esko injection and it can also find table names and columns and it can extract usernames and
they're hashed passwords.
Also it can use different techniques of encoding to bypass some of the defenses such as filtering and
IBS and it also can work with these methods point framework which we didn't cover yet and we will cover
in the future tutorials but it is a good thing to know that it is possible to mix these two so let us
continue on to our vector machine.
So let us reload this page.
Where do you want to go right here.
I believe it is under the O ASP let me just try to find it.
User info could be a skill or maybe under the web services and then the rest.
Ask your objection.
User Account Management.
No it's not right here.
I don't know why I thought it was right here.
Just find it.
What about this name.
Username Password.
OK.
So it is this page right here.
And let's say since we know that this is vulnerable to the rescue since it is under the user info as
well we can just basically try anything right here so let's just go on.
Dee Dee Dee Dee Dee Dee Dee Dee Dee Dee.
And then your account details you can see that there is not an account under that username and password
of course but we got the link.
So we want to test this Web site for the of injection for example you would just copy the link then
you type here.
Ask your map minus you to specify the URL then apostrophe.
So open double apostrophe then the paste link closed apostrophe and then what we want to specify is
the input that we want to scan.
So let's say for this type of scan we want to scan the user name input.
So you're just type here minus p.
I believe it's minus B.
Let me just enlarge this and see it for myself so minus p minus p test parameters so testable parameters
we want to test the user name parameter.
So just type your user name and what we want to do.
Use it also the Shima.
So we did that in the previous video I explained what the information she mined all of that is the P
is the specified parameter that we scan.
So once you do that you can also add some of the other options right here if you want to for example
level of scan so level of test to perform default is one level of risk so you can set the risk to be
under 3 but I believe it will be more difficult than not difficult but more detectable then.
And here this these minus minus she might as you can see right here it says enumerate D.B. as Shima.
So if you let this to run it will take some time I believe.
I don't know if I finished it before so it will ask you some of the questions.
Make sure to read them under when they pop up so it says like.
It looks like the back and D.B. mess is my ask you all to want to skip test payload specific or other
DP and S's we want to say yes since I believe it really is the my ask you also for the remaining tests
do you want to include all test for my Haskell extended provide level 1 and risk 1 values we want to
click here.
Yes.
If you don't want you can specify the level and risk in the comment itself.
Basically you can let this run and it will automate the entire process of the Esko injection for you.
Once it finishes this basically I believe it will print out the tables and columns and all of that and
you can basically manually not manually but you can automatically with the single number choose an option
to check out what it found.
But I believe this process takes a little bit longer to finish so we wont be waiting for this to end.
We will cut the editorial right now and in the next sartorial will cover the X amount injection.
We will do it only in the one that oil since it is not that important as the actual injection and as
the cross site scripting attack that we will do after it.
So that's about it for this tutorial.
You can wait for this to finish if you want to see you.
What are the things that we will print out or what other questions it may ask you.
And until then I hope you're having a great day and I'll see you in the next lecture by.