Now, if you remember in the previous lesson, we exploited as fuel injection vulnerability in a search
box.
And the search function.
Basically compares the user's input into a database by using a like statement by.
So then we created ask you all queries that can work well with the like statement.
So now we're going to do almost the same thing, but this time.
With something different, let me show you, so go to be web, choose escarole injection, post, select.
So on this page, you select a movie.
And the information about movies will show in the table below.
And to see the FDP request enable Foxe proxy.
And select a movie.
And it is a post request.
And the movie ideas sent to the server.
All right, so nothing else needs to be in the request, just send the request to the repeater tool
and forward it.
And look at that, see the information about the movie is in the table here.
Then forward an intercept of.
Now, before we go any further, let's have a look at the code.
So function is here to call security checks according to security levels.
OK, we already displayed the functions, so scroll down to see the scroll query and here's a query.
So it has two parts.
Now, the second part is where user input comes in.
So it takes an exact numeric value.
And then she likes everything about this record.
So we need to write appropriate queries to work with this query.
And then the remaining code will display the output, but now.
Here's a problem, only the first record can be displayed, so in pulling data, we need to be concerned
with this, OK, only the first record can be displayed.
Remember that?
OK, so go back open repeater.
Check the Maine request again.
And it shows the data.
So put a single quote.
And look, we have a syntax error.
So then put another single quote.
And there's the same syntax error, another one.
Syntax error again.
All right, so I'm going to add a different payload.
And this time it works, so I think this movie must be the first record.
So now I'll discover the column numbers.
Or to buy one.
The movie name has changed.
That also proves the vulnerability.
Three columns.
No, five columns.
No.
Seven.
No, nine columns.
No, but we do get an error, eight columns.
No, in an area again, so the number of this column in the select statement is seven.
Of course, I already know it, but let's have a look at the way that we detected it, so I followed
it this way.
OK, so now write this to discover which columns are displayed.
So except one, all are displayed.
Escarole injection is identified.
So we should pull actual data and metadata about the server.
So first let's pull version, user and current database.
We are the route user and use the Web database.
And the version is 5.0 dot nine six, and we can also look up vulnerability's for this version, but
it's not and what we're doing right now.
And by the way, you can always change his number to know it'll also work.
OK, so get the database names.
In this query only gets the first record.
So we need to change it.
So if you add a limit clause like that, you can pull all the database names in turn.
And this will get the information schema.
So next one is BWP.
Then to.
Then three.
You can also try this one.
All right, so now we have all the database names, so then we can get the table names.
And it will display only the first one as well.
And we can use a limit clause just like that to specify all the tables.
Or this payload to group them.
All tables are in one row now, so they get the tables of the BW database, use this.
Five table names are here.
And then we need to call them names.
And this restriction looks familiar, the just the first record, so adding the limit clause, we can
pull the columns.
Yeah, but it's not very efficient, is it, especially when you manually exploit the application,
so you use this to get the columns of the movies table.
This one's better.
So now we know the information about the database and tables so we can pull the actual data.
And this payload can work.
But we need to get over a one line problem, how are we going to do that?
Well, the limit clause can help us again.
But I know this way is kind of boring and slow, but.
Let's just stop for a second.
It's not an exercise anymore, let's think of it as a very important table.
So it's worth the step by step approach.
Of course, you can also write a crazy query like this.
All right, so anyway, all data is grouped into one line.
And due to being able to read and write files from and to the system.
I think you can go ahead and run this payload.
And then this payload will send the result to a file.
And don't worry about the warning, it works.
And with his new payload, you can view that file.
OK, so now it's time to increase our level of medium.
So I'm going to just change this here to one, but this time the query below won't work.
So the problem here is single quotes, the application sanitizes the input.
So that means we need get rid of them.
But instead of just writing strings in a single quote, I'm going to use the Charra function with ASCII
values, so let's see how that works.
Just like that in the columns.
They are all here.
And the magic file.
And you know this so good and the rest is here for you to discover.