Hello, everyone, and welcome to this video.
So in this video, we are going to identify masculinization on to a life target.
So you're the life target is Huttle or need dot com dot piggy and we will see if we are able to identify
Ezekial injection into it.
So, as we know for identification of Escuela based vulnerabilities, we need to identify your injection
point onto a target.
So as you can see, under the you are right now, we do not have any indication point or any parameters
you need that we can see anything on to the application right now where we can input something or write
something.
So let's navigate onto the Web application right now and try to identify if we are able to get any parameter
onto the Web application.
So you can see under the left hand side it has key amenities.
So I'm going to go on one of them to see if I'm able to identify any parameters and test it so that
if it becomes available to Escorial indication so that we can move further.
So I'm going to click on Guestroom and you can see once I click on this into the you are allowed to
parameters appear.
The first parameter is Udy equals to one and the second parameter is Idy equals to one.
Now I do not know out of both of which parameter is one level.
So I'm going to identify the inflection point one by one.
So for the first parameter, I'm going to put a single code just to check if it gives me an error or
the application load successfully as it is.
And Higgins', when I gave a single code, the application did not change its behavior.
So let's try it on.
It equals to one.
Once I give the parameter, you can see the application behaves differently.
The application has changed it state.
The main reason over here is we are not able to see any MySQL based error.
The developer has suppressed the error.
It is one of the most common techniques that developer uses to suppress the errors so the users are
not able to see those errors onto their browsers.
All right.
So now we have identified the variable inflection point and that was idy equals to now we are going
to use a map to explore it further and get sensitive information from its database.
Sort of an ESKIL map.
You need to type Biton Eskil map out by hyphen you and then double code.
You need to give your target of a buttress.
As you can see over here now, how a school map is going to know that a bit of the injection point or
parameter is vulnerable.
So we need to tell that to a scale map.
For that, you need to add a custom induction marker, which is a start.
On any of the parameters that you think is available or you have identified to be vulnerable when the
application is changing its state, as you can see, I have successfully added inflection point, which
is it equals to one.
And I added a start over there.
Now, I will just simply enter and you can see a message that has been given by a school map, which
is custom indication.
Markers are found in the option.
How often you do want to process it?
You can see I have ridden capital, right?
Which means yes.
And it has identified that the resuming back in DBMS is my equal testing connection to the target.
You are and you can see the back end.
DBMS is my Escorial Web application.
Technology is Apache and my school is greater than equal to five point zero point twelve.
So we have identified a lot of information regarding the web application technology and the backend
DBMS.
Now you can also use a flag which is banner to the banner grabbing.
So banner grabbing is one of the technique in which we identify about our target that what it is using.
So when you will do banner grabbing, you will get the same output.
OK, one more thing to notice over here is that whenever you are running a school map onto any target,
all the data that you can see under your command prompt or under your terminal is automatically getting
logged and saved under our head, hidden directly, which is not a school map, as you can see over
here inside the output folder and with the target name.
So for now, the target name is hold on it, dot com, dot picture perfect.
Moving ahead, I'm going to add hyphen hyphen banner to the banner grabbing.
Remember, if you do not add hyphen, hyphen, banner also it is by default going to identify and the
banner grabbing for you.
But you should know this.
Oops.
We wrote three hyphen, hyphen, hyphen or three dashes.
You just need to add two dashes and hit enter.
Now you can see it.
Asked again for customer induction.
Mark of phone.
Do you want to process it.
So you have to add hyphen y capital y which means yes again.
And it has identified the same details for you.
Now guys, I do not want to add this hyphen y every time, whenever I'm scanning, I want scroll map
to process all my request and take the decisions automatically as.
Yes.
So for that you need to add hyphen hyphen.
Bache So hyphenation match means we are telling a scale map to take the decisions automatically and
do not ask the user for any prompt.
And you can see we are able to identify the details about the server, which is exactly the same.
Now, moving ahead, we want to identify now something sensitive from the Web application, right.
Which is the database for that I'm going to add hyphen hyphen DHBs, which means database.
And it ended and it just a few time.
It has identified in total of available to database, as you can see, fetching database names, available
databases to first is the information schema and the second one is ornate on it.
Now out of these boot database, ordinate ordinate looks more interesting because it is likely to be
more related to our target of application.
So for now, we are going to go inside the ornate, ornate database and identify if we get anything
sensitive into it.
Remember, information schema is the schema of the target database and you may not get anything sensitive
into that database.
So going into the on it on a database, we will now try to identify and fetch the tables that exist
in the database.
So for that you need to type hyphen D, which stands for database and the database name.
As we want the tables that exist, we are going to type hyphen, hyphen tables and it enter.
As you can see, we are able to retrieve in total of five tables.
The first one is Galardi to about Lieto, Ed Littlepage and Leito user.
Remember guys, we added hyphen hyphen Bache.
That is the reason it is not asking us to confirm anything or no prompt is a.
It is taking all the decisions automatically perfect.
Now let's go and do one off the table so it looks like this little user table is interesting.
And I would like to go into this table so far that we need to give the table with hyphen P flag, which
is little.
Others could use it.
And as we want all the columns right now.
So we are going to add hyphen, hyphen columns and hit enter.
And you can see we have successfully identified that in the lead to user database or I'm sorry, into
the Arnet only database lieto user table.
We have identified in total five columns, which is email, full name, ID, password and username.
Now I want to see the data which is into this five columns.
So for that I'm going to dump the database by typing the command, which is hyphen, hyphen, dump.
And you can see we are able to get the successful retrieval of data and you can see there is a total
of one entry.
And you can see this is the email address which lies on Hotmail dot com.
This is a user name.
It is admin, full name is administrator, and the password is also admin.
Bingo.
We are able to identify the credentials of the admin, which is username and password admin.
And you can also see that the details have been successfully saved into one of the file, which is little
user, not CSFI automatically.
That is the best thing about this Google map.
That is that it continuously logs everything.
And whenever you want to go back, you can just go to the folders and you are able to identify about
your target.
Now, one more thing that I would like to mention to every one of you is whenever you are testing for
SQL injection in any of applications, you should not dump any sensitive information or database or
tables or columns from that target, because that may be violation of policies against that background
program.
And you may end up in some trouble, although you have identified a very critical vulnerability, it
may end up that you may not get anything for this hard work or identification of a very good one liability
into the target.
So in case you identify that any of the application is one level to Escorial, just identification of
the database name is more than sufficient to prove the criticality and the severity of the vulnerability
to the bug bounty program.
So you should just make a video or a screenshot PEOC showing the database name and they will automatically
understand and triage your vulnerability at a member.
If identified as killed in action based vulnerability, then it is considered to be a critical and a
high vulnerability.
So it should go for a B when or to bug at least on any bug bounty program or any pain testing tool that
you are going to do.
So I hope you guys understood how you can use Eskil Map for exploitation of our applications and how
you can also dump and download the sensitive information from the database for any underlying website.
I hope you guys understood.
In case you have any issues in performing the exact steps, you can always post your questions into
the Q&A section, and I would always help you.
Thank you.