Before setting up our lab and start doing sequel injection ourselves and seeing the results and so on
we need to understand in a very simplified way what is sequel injection and what is the weakness.
So let's take a
burnable website with SQL injection and let's try to explain what the secret injection.
So there is many web that you know they are have been created for tested for testing.
But I'm going to choose one from IBM.
It's called untrue.
You should definitely this will not be the ones that you're gonna do test on it but you'll get the ultra
mutual you'll get the
definition or you'll get to to understand the sequel injection from you.
So ultra mutual it's an online banking.
Of course a fake bank but it'll show you the cons..
So this is a website an online Web site.
Like any websites that we are using and definitely is the reason log in page where you can type your
username and password.
And user name and password your username and password are safe in a database.
This is very important that any web application will be
connected to a database.
It's a back end server where they verify what you are writing down.
So if you are writing a user name and password there.
So for me if I write user name like this one user name and password for instance the same and I click
Logan definitely he will go to the back end database.
Right.
And he will check do you have a user under the name of artist and possible ballot.
And if it's there he will let me in.
And if not he will give me a log entry.
So definitely there is a for database connected to the Web site at the backend server and this database
are verifying whatever you are writing beside.
If you put some information if you are putting your profile your information this would be saved in
database as well.
That was the point here in secret injection.
What if instead of writing down a user name and password what if I tried to talk to the database at
the back and using certain language from those feel right.
I mean definitely whatever I'm writing here it will be verified using a sequel comment and to the back
end database and it will be according to the result if the user name and password are there or not that
will be you will allow me to log on.
OK.
What if I write something like that apostrophe or 1 1 1 minus minus.
OK now this in database mean as database language.
Apostrophe mean ignore whatever has been written before inside your code and please check this result
is one equal one and hyphen hyphen mean or minus minus mean ignore what is in your program after that.
So you just verify if one equals one which is a true.
Let me.
So if I take that copy and put it in a user name and password beast and type plug in we were able to
log in as an admin account.
Now I don't ask you to be a sequel expert and to know how to write sequel language because the tools
that you can use are are going to do that on behalf of you.
But I just in this phase need you to understand what is the weakness.
So where do you think is weakness the weakness is that whoever created this Web site and web application
he should validate the input.
Right.
I mean whatever you are writing here it need to be validated.
And if you are writing a sequel coming to talk to the database and the database will reply back by let
you in or not.
He should not allow that.
He should not allow user to talk to the database.
So what happened is that the programmer did not validate the input into the user name and password.
Right.
And he didn't make sure that what is written here is username and password and not a sequel common.
My second point is that there is some sort of sequel injection is not just used to bypass authentication.
Yes one of the reason is to bypass authentication.
But the concept here.
If I am able to talk to the database that exists on the server right on the bank server and the database
did reply back to me.
Because once you know they let me in.
It means they accept the statement I wrote in so they reply back to me.
According to that I can do much more than sets and bypassing the database replying and obeying to what
I'm asking them asking it.
So here I can write a sequel statement that for instance will will
dump all the data all the bank client accounts for instance or bank transaction or all the balance of
the customer or you know if I just need to if I just know how to write the sequel.
But even if I don't know I can use a tool that we're going to use during this section called sequel
man.
It's an amazing tool in carrying Linux that will do everything on behalf of you.
All you have to do your role is just to give him an infected word website.
Sequel injection and we're gonna see how to identify as a site infected infected sequel injection gives
a sequel injection website to the
the program and he will take care of everything.
He will start communicating with the database get used that have his name the database tables the database
column information user password everything.
You just need to know which Web site is infected to database and gives us your end to this program.
It's a quite amazing program.
So this is the idea of sequel that is that you are talking to the database and instead of writing username
and password.
Now what if the page didn't have a user name or post.
You can talk from who you are and so you can put his subsequent statement and see the reply back from
the database.
But still we will not have to do that manually.
There is also on other programs that we can use and can in Linux that will scans that there is a website
and let you know if it's affected the secret injection or not.
So most probably will do nothing just you know copying the Commons that's it.
Okay now before setting up our lab and start practicing I hope you understand the concept and if not
please let me know.
I'll send you an additional resources on to explain the secret injection in an simplified way.
But anyway before starting I just need also to give you an idea about the structure of database.
This is important actually because if you don't have experience database you know maybe some of the
comments will not be that clear for the database consist of the following Number one it consists of
tables.
So each database has many tables so for instance we have a bank database.
It may have a client table it may have a customer table.
It may have Employee table account table and so on and each table has column with information so I may
have the first name from the customer.
This is a column that include all customer first name user name all username password all the password
and so on.
So this is a structure.
So when you log into this database you need to understand how many tables reasons inside the database.
Then you need to identify which is the critical table.
I mean if there is a table under the name of user definitely this would be important because it includes
the user name and password.
While if there is a table under the name of logs Yeah it could be important but not that much.
Why should I don't know this table and check all the logs.
You're not I mean.
So it's important to first get to know how many that is.
Then the structure of each database and then to get the important table and then to dump the information
from the tip.
This will be our plan so what we'll do next.
First we're gonna set up a lab to test because I needed to test as much as we can.
Then second we gonna take a full scenario assumes that you got you are in a Web site and you need to
know if it's affected to sequel injection or not.
And then if it's affected I need to know how to manipulate the second injection to dump all information
inside the database and then finally how can I use this information if I was able to get the username
and password.
Can I log in as an admin to the sites and remove the pages and put.
Can I log in.
As a power user I'm gonna see after getting that information how it can be used.
So first let's set up our lab.