Hello everybody and welcome back.
And right now we finish the kill injection part which could have been for you a little bit hard to understand.
And I always encourage you to read more about it.
That will make you understand it a little bit better and also you can watch other tutorials online on
how to perform the actual injection with as your map or manually the more tutorials the watch the better
you will get.
And so on but right now we want to cover another attack which is the X injection.
So let's first talk about it.
Well some applications may do their searches in X amount of X amount database which is which basically
allows us to perform the X AML injection.
And when user sends the X e-mail format information that application should read so users basically
as an input send the X amount format information and the application of the web server basically reads
that.
And if we type it as a code or Yeah well as a code it might interpret it as part of the code if it is
not filter correctly it is the same principle as in the previous two attacks which is the command injection
and ACL injection.
So basically all of these attacks are just badly written.
Website code or badly filter user input
so in order for you to understand it better you need to know the basic external structure.
It basically looks similar to the HDMI now it has no root no child node element and I believe it also
has those two those two arrows that are at the beginning and at the end of every comment.
So it is very uh it looks a lot like the it's the amount code.
So let us actually play.
Let us see the practical use of this attack.
So what we want to do.
Go once again on to the little machine always planned once again on to the IP address.
So let me just go back one or two or three times.
So once you are here you want to go to the b w AP which is right here.
I don't believe we meant here in the previous videos but this is the first time so just click right
here and it will open up something that looks like this.
So now what we want to do now we want to first of all we want to log in as it says right here enter
your credentials and be back so you can just log in right here or if you want to.
You can also train your brute forcing attack.
Just add to some user name list or pastoralist these two words and run your brute force attack in Hydra
or in purpose suit in order to practice a little bit but we won't be doing that right now since we did
it twice in previous videos.
So let me just log in right here with the specified user name and specify password set the security
level for now on mobile leave it on low since this is the uh tutorial video we want to show you from
the beginning how it looks like and once you log in don't save password once you log in right here you
want to search for the X path injection search.
So as we can see right here we have a bunch of the methods right here that we can use to practice our
attacks and what we want to search for is.
Let me just find it a one direction.
Suicide this kill injection.
We covered death loops skew our expert.
Here it is.
So x amount X path injection search.
Once you find that just click on it right here and click on Ask and you will see that we load a simple
page which basically searches movies by their gender.
So as we can see the action movies if you click here search it will print out six of these movies.
You can have some of the other options for example horror movies you click your search and we get two
mommies which is Resident Evil and the underworld and you can also check the science fiction and click
here on search and you basically get the same same output as the action movies.
So what we want to do you first thing you might notice is there isn't any user input right here.
There isn't any Spanish specific field right here that allows us to type something.
Well we don't really need it.
This search box right here which chooses between two or three types is actually our user input.
You do not type it but you do send your choice to the server.
So let us just intercept this packet real quick.
So we go onto our burps and we turn the intercept on and now what we want to do is go on to our page
and search for the action movies for example.
So just click here on search our page reloads since we are intercepting it and if we go right here to
the to the a packet that we received in the intercept we can see that the interlink there is a specified
gender which says action and the action which says search.
So this to our correspondent to the uh to this right here and this right here.
And let's see what happens if we for example change this packet before we forwarded to the server.
So let's try to inject EC action and then once again inject apostrophe after that.
Let's see how the server will handle this packet.
So we have basically sending action and then the apostrophe so we form this and let's see what server
basically gave us.
And sure enough it gave us the invalid expression which means we successfully found the vulnerability
morning simple example Element X path involving the expression in this file right here on line one hundred
and fifty eight morning simple and another morning evaluation failed in the same file online one hundred
fifty eight no more ways more found so we can see that we that had this summer actually read this as
a part of quote.
Now let's check something else as well so let me just search for the action.
Wait till we have the intercept on once again let's turn it off.
Let's go to the page itself.
So we are back to the same thing now.
What we want to do is exploit and possibly find some usernames and passwords.
If there are any what we want to check next is whether this application will interpret the part of this
important right here as well as the whole world.
So once we send action it prints out the action movies but let's try that again by sending only a part
of that word.
So let us just turn our intercept on and search once again.
So now that it is stuck we go to our brb suit and why is it so slow.
Here it is and let us delete a part of this world the world.
Pardon me word so delete I own and leave act.
And let's see if the server will recognize this as a part of the port action.
So if we turn off the intercept we can see that we got the same output as if we search for the action
now with anyone with a little bit knowledge of the X and Mel will know basically that since it gives
the same result as the action world we know that it uses a function which is called contains now contains
basically does the same thing as it says.
For example it searches for all of the results that contain even a part of the port.
So for example act is contained in action.
That's why it gave us the same output now that we know that it uses that function which is contained.
Once again we can do something very very funny as you will see right here it is.
It could be a little bit hard to understand but basically we will try to select once again to something
similar as the previous we do in the astral injection when we said 1 equals 1.
We will try to type here something like contains one one which will print out all of the results in
the main the database.
Let me just show you also.
We turned on our intercept and if we search right here what we want to go to is Birchwood.
So let me just go back to it will not other applications we want to click right here and let us delete
action first.
So we delete action and what we want to tap right here is the apostrophe.
Then the closed right parentheses then the closed bigger right parentheses then slash is find it slash
star and then two slashes and then once again star.
Then we type the left open bigger parentheses and then with a peer contains and then open left smaller
parentheses apostrophe one.
The possibly comma open apostrophe Artemis so comma open apostrophe 1.
So you will see that if we form this packet so I'm not really sure why it doesn't give us the formal
option here it is is just a little bit slow.
What is this.
We do not want this.
So let us forward this packet and let's see what output we got from this server.
No movies were found.
Well oh wait wait a second.
Let me just try this once again.
I think I know what's the problem.
The problem could be that I deleted the
deleted the action.
So let's just do that once again.
So search we go to the perps and
uh my state is a little bit slow so we type the same thing once again.
So just type something that you typed previously.
So let us just do the.
It starts with apostrophe then the open right parentheses open bigger right parenthesis than what we
do is slash start to slashes and we just move my mouse two slices start and then we want to open the
left parentheses open contains contains open small smaller light left parentheses uh apostrophe one
apostrophe Carmack open one open apostrophe one and that's about it.
So let me just see if this will work if we send that no more reserve were found not really sure why
it says this let's just try something else.
I think I know what the problem is.
OK I realize the problem was that I was missing a character so let us do that once again.
So intercept on search it is stuck.
So we go to the perps it and we type the in diGenova we type the same thing but follow up with me right
now.
We need to add a little bit of something else so let us just start off with the uh apostrophe then open
left parentheses.
Pardon me.
Open right parentheses.
OK open right.
Bigger parentheses.
Uh Slash.
And then the star sign.
And then we want to use the pipeline which is the upper line.
And then we continue with the same so two slashes and then the star sides again.
And then we open the left the beaker parentheses contains which is the function and then we open apostrophe
or open left parentheses.
Smaller ones apostrophe one apostrophe comma open apostrophe 1.
So let me just copy this so I can show you how it looks.
If you can't see it.
So I will just copy it open leaf pad
and let me pasted right here you should see it a little bit better.
See if I can count and launch this.
So this is the command that we are using right here.
So what we did in the previously we basically forgot this Piper command.
This Piper sign right here.
So let us just follow this packet and see what happens.
So I know this pops up forward and let's go to the page right now.
And as you can see we got a bunch of the options that are in three movies as we can see.
Neo Trinity and then randomly there.
There is a movie and then we have some of the numbers right here.
Basically what these are.
This is the the.
This is the user name.
This is the password for that for this user name as well as this.
Alice love zombies as well as these poor and Asgard.
So we basically successfully exploited the X amount database with that one command and we can see the
usernames and passwords of different people right here.
And it gave us in the list as if these f as if these were movies.
So that's how you manually exploit the example with the X-Men injection.
Now let's do the same now.
I will not do.
Let me show you how you can automate this process with a tool but I will should show you this in the
next lecture.
And then after that we will start the cross site scripting attacks.
So I hope I see you in the next lecture and taker by.