Hello, everyone, and welcome to this video.
So in this video, we are going to see one of the ESKIL injection on a Dutch government website which
has a responsible disclosure policy.
All right.
So first, let's see the target.
And this is a life target, which is Albatros Kamdar, N.L., which is a Netherlands based Web application.
All right.
So into this Web application, let's go to one of the functionality to retrieve a parameter or ID before
that.
Let's quickly start our website as well, because we are going to use it maybe to spidered application
and to identify more endpoints through the application.
So remember, guys, always a spidering.
Your application gives you more increased scope of effort that can be used and that can be barometer's,
which helps you definitely in identification of more and more injection points and identification of
a vulnerability.
So as you can see, I have got this end point, which is a get request.
And I have added this to my scope.
As you can see over here now, I will just wait for Bob for identification of a more and more you also,
as I'm under the Bobzilla community edition, this is the latest edition of 20/20.
And there is a restriction of a lot of features.
But still, this version runs a passive crawler which will crawl to you all for me automatically and
which will be visible to you over here, as you can see.
Now, I will just simply double click patterns because I want to see the parameter based asset or you
are and I'm going to try on one of the other.
So let's say we pick up this, which is get detailed at BHP.
Questionmark it equals to then perfect.
So let's say, for instance, make it to 20 and we are able to get a response.
Now let's click on Render and let's see what do we get over here.
And you can see there is a page which gets rendered with the image on Idy equals to twenty.
Let's identify if this is vulnerable and let's give a single code and hit send.
Now let's wait for the response and I can see it is still loading.
Let's give one more error and you could see we got error actually, OK.
So if you missed it, let's do it again and let's wait for the error to pop up and we will confirm that
there is a vulnerability of SQL injection.
Perfect.
As you can see, we have got error, which is my Escuela Nimruz expects parameter one to be my escalator's
boolean given.
All right.
So we have error, which means we have identified our injection point and this target is vulnerable
to escarole injection.
Perfect.
Now let's copy the order of this target and fire up Escorial map, which is going to help us in automating
the exploitation for this application.
So let me just quickly go into the folder of high school math and start Partan Eskil mapped out by Hyphen
U.
Stands for the target you all, but you need to give it give in double code.
And I'm going to add the custom inflection point where ID equals to with the help of start and right
hyphen hyphen Bache hyphen hyphen Bhanot.
Which means I want to run all the task or request or take the decisions by a school math and bano means
that I want to do Baner grabbing and identify the technology and the database version.
You just need to hit enter and it will start the scanning and exploitation on that specific target.
It will do some of the test to identify and do bana grab onto that specific target and let some.
And let's see what is the output of this, so let's wait and see if we get something.
And you can see we have already got a message here, which is you are a barometer.
When is my Escorial greater than equal to 5.0 or Atavist, which means there is an error based on ability.
And we know that we give a single good at it equal to 20 and we got the error.
And this is actually the same thing that Eskil map is telling us.
Perfect.
So I will just skip this a little bit.
So let's go to where it identifies something sensitive from the server.
And you can see it has identified that target you are appears to have 17 columns into the query.
All right, let's wait for this.
And yeah, it has successfully completed.
And you can see the Web server operating system is Linux.
The Web application technology is Ingenix or Plesac.
And you can see the back and DBMS is MySQL greater than equal to five point zero.
Perfect.
So we have identified a lot of information about the target from here and now it's time to exploit it
and get more sensitive information, which is.
The database names so know we have one of the payload, which is bullion based blind, and you can see
or hear, so I'm just going to copy this into my browser and see what we get.
And you can see.
Let's understand the bailout quickly, but you can see that it is and and a true condition, which is
six to one nine equals to six to one name.
And when I load this, you can see the application is behaving properly.
But when I make this condition is false, the application does not give anything.
As you can see, there is a change in the behavior.
When I make it to the equals, which has seen it again, loads the application so we can see that the
payload is working over there.
Similarly, we have more other queries.
Now we are going to exploit the database.
That is, we want to know the names of the database.
And for that we know that we need to type hyphen, hyphen DHBs.
So I will just type that and hit enter.
And you can see we have identified in total of two databases, are there.
The first one is Alberto and the second one is information schema.
So I'm much more interested in the first database.
So I'm going to write Hyphen Capitally and the name of the database, and we want all the tables from
it.
Now, as you can see, it have started fetching the tables for the database Albatros, and you can see
it has retrieved the first one, which is image description, link table project backup, new site projects,
projects, back up, all side projects modified from old site and text, etc..
Now we have the database as well as we have the name of the tables.
So let's do one thing and let's go into one off the table.
So let's see the interesting one which looks like is projects and see what are the columns into this
table, which is products.
So for that you need to type hyphen D the table and hyphenation columns and just hit enter.
Let's wait for this to complete and you will get the results in, which is a real map will identify
the number of columns into the target.
And you can see it has started fetching the columns for projects and you can see it is Idy title is
Project Publish Description Ordering.
Perfect.
So we have also identified the columns now and you can see it is still retrieving more and more.
Now.
While I was reporting this rocket to the organization or to the Dutch government, I did not try to
dump the data.
So in this proof of concept, I'm not going to dump any data from the target for application.
And I'm just going to send a screenshot of the database names and the table names, which is more than
sufficient for the target organization to prove the vulnerability exist into their Web application.
Remember, I have already expressed that you should not dump any sensitive data information from the
target application, identification of database names or even names is more than enough to prove this
one liability.
So I hope you guys understand how you can do this.
Thank you.