So now we got an infected Web site sequel injection and I also got the infected link using one of the
web application.
Now we're going to move to an amazing tool called sequel man sequel map will save you the time to do
the sequel statement set to explain at the beginning of the section manually.
So what we're gonna do is first to see how sequel map war so sequel map minus minus H or help will show
you all the comments that you can use.
Okay.
Now I don't want you to memorize syntax or comment or anything.
I copy all the comments that you may need in this folder.
So just go and let me also minimize that.
And as I was saying I did create a folder by the name of sequel injection where there is a file called
sequel map.
This virtual machine will be shared with the court's resources as a dropbox link.
And I did write down all the comments that you may need.
All you have to change would be the you are and the infected your.
So let's see how to use it and what can I get.
So you need to understand do not just copy and paste because this is important.
So in my case what is affected website this is the affected website.
Right.
So I'm gonna take a copy and I'm going to open the terminal.
Let me clear the screen
and we're gonna type sequel map
minus you which stand for you are n and then you put the U R N this will be the start of any common
and second map my sequel map minus you and your N and whatever you want it will be added by the end
of the line.
So for instance let me just.
Can we increase that a little bit more.
Sorry
space and we can type hyphen hyphen D the S and CBS will get you all the database we'll try to talk
to the database inside the swap application to get you all the database information from here.
And as you can see usually if you do that for the first time you'll get a couple of questions.
Anything that you get just click on yes and it's telling you that he found the following database breaks
all of them are my sequel version 5 first and those are the database name.
Now this is actually unbelievable because he didn't just get through the database in this web application.
I mean if you get back to the website the OS website.
Okay.
And before choosing this so as Pope said this was the main page.
Once we opens a IP as you can see there is one cool web.
Good.
There is one get bored shut.
There is many Web site which was the WP a break right.
But what happened is when I use this sequel map and minus DFS or database system he got me all the database
on the server not just the break but all of them are here.
You'll find the good get bool breaks.
This is a database.
There is a database under this name which is a sequel 5.
OK.
So you start to get the database name.
This is the first step to do.
I was able to get the database name and database type.
Excellent.
The second comment which will be this one to get all the user name
database user name key so we can just take a copy here so you can see the same comment except I added
uh after the comment uh I'm sorry
yeah.
Minus minus GBM s equal my second which is a type of secret because you need to identify as a minus
minus user.
So this is the only part I added and this part has been added to get you the user name.
So I'm just gonna move this G.P.S. and put this part based
minus minus.
And he got me some user valid user to the database through different database I mean this is user for
the Brexit database and so.
But let's stick it in the logic way.
I mean do you remember.
Let me show you the database structure.
So we spoke about the database direction and database consist of tables and columns.
So what I'm going to do right now I was able to get the database names is that his name is breaks right.
I need to know the table inside and check which is more critical or more valuable table.
OK.
Which one may have critical information.
So what are we going to do going back here.
I'm going to use this comment which is.
This one so I'm gonna use the same your.
But I'm glad minus the breaks I'm in from the database breaks because he find many database on I'm gonna
tell him No I'm just interesting in the breaks database I want to see all the table so I'm going to
click on copy and getting back here let me first clear the screen
and get the same comment and you can remove the user I'm just going to add this part so now I'm putting
Xu r n then the type of database then I'm gonna add minus capital D breaks which is a I am specifying
which database he should search.
Show me all the table and click on enter and as you can see he only find one tables called user must
properties this is very important tables that will have all the user name and password.
Right.
So but in realistically you're going to find many tables you need to check which one may have the user
name and password sometimes is under the name of emails a credential you know whatever is in it but
you'll be able to figure out the second step is to see the column of this user this table called User
What columns they have inside Do they have user name and password email address phone number I need
to know what column is inside.
So we're going to use this comment which is I'm glad now.
So it will be a minus the BRICS same and minus t table I'm asking Could you check the table and then
hyphen hyphen column so I'm telling him could you show me the column inside the table called user and
from where did I get the user from it it showed me that there is a table called user from the database
called BRICS so let me take this part and add it to the sequel as a sequel map.
So here you go and we're going to move this part at
beast now usually whenever he does that for the first time it will ask you a question and you keep answering
yes right.
But because I did it before for testing.
You know it's it's skipping the question.
So as you can see the table has emailed for all user host industry land name but I'm interesting in
names and password.
I want to see all user name and password and email because I'm is one of them to log in to the account.
So here is what I should do I should ask him could you check inside the BRICS inside's user inside the
column.
I want you to get me all the name and password and e-mail and continues minus minus them.
So copy and getting back the same common.
Let me remove the last part.
And let's see based
and as you can see start asking me question anything click on capital yes get the yes except one only
step you may skip Yeah.
Here you go and define for user since I was user admin and this is his email and password admin Tom
he also encrypt it because the possible fight is encrypted he decrypt them.
So let's try Tom and Tom.
I mean you know there is an account on the database on the name of Tom on top.
So let's go to the website.
You go and let's go to the get break.
Let's see if this is a valid user name and password and uh let's uh logon.
Let me go to the log in page and log in 1 and then type 1 and the password
and I was able to log in successfully.
So this is how sequel injection in a very easy way can get you the credential sometimes you can get
an admin account that will allow you to log into the page and remove some of the page and and change
and do a lot of modification.
It's quite easy to use and very very common.
An ability the secret injection.
So now let's try another example.