So until now, we have exploited some escarole injection vulnerabilities, but the main queries are
all built with select statements.
So we add our payloads after select statement now, this time we're going to, hmm, maybe just do something
different.
And we're going to perform an actual injection over insert statements.
So let's go to be WAP and then ask you all injections toward blog.
You may remember this page.
It has, well, almost the same view as stored excess.
But the back end code is completely different.
It was kind of like a commenting page.
So here you can enter something and it will be displayed below.
OK.
So open terminal.
Type vem Escuela, I underscore seven BHP.
And the security check is performed based on whatever the security levels are checked.
Scroll down below and in this line, the user's input is checked.
Then the insert statement comes.
And it uses the user input and the session user name to insert to block tables.
And below, there is a select statement to display the entries in that table.
And it selects all the records to display.
So first, it shows the owner of the entry and it shows the entry itself.
And the rest is now very important.
So go to be Web.
Well, no, no, actually, go to Chrom.
So if you're not already, just log in to Miamian.
Open Enescu, a window.
So I'm going to paste the code here and clear it.
All right, so this is pure SQL query and our input data will come into between these first single quotes.
OK, and when you put in a single quote, as we did previously.
See how it won't cause an error, it will insert the single quote.
Into the table.
But if you add this payload.
It will just execute the query.
Then insert A and B in the movies table.
And the remaining part will be executed as comment.
OK, so covid that payload if you want.
And go to Firefox.
Pasted in here, an ad entry.
So you see, there's no problem.
So the last line proves the insert process.
OK, then paste this one.
This shows the sub select queries also causing no problems.
And now we can enumerate the database itself.
So now, right, this payload.
And here are the values of the version, the database and the user.
And the payload we provide selects the data from the database.
And then the original query inserts that data into the movie stable.
The second original select statement brings the records into the movies table.
So, OK, let's go with databases on the server.
As you see, we can only view one database.
The information of this one database, so the problem is in the insert statement.
So because we use some select statement and insert so the insert statement can only insert one line.
So that's why we cannot see all the data together.
And we can use a limit clause.
And this is information for BW.
But you can do this for the other ones in this way as well.
However, if you group the names, there's no problem.
So you see all the names are here.
Now, right, this payload to get the table names.
You know, we get an error.
And it is indeed a syntax error.
OK, so now it's done so with its payload, we can one by one read each table, but I have nothing to
do with the system tables now.
So I need boabs tables.
And here they are.
So now we can get the call names with this payload.
And we need to go one by one.
And once again, I only need my targetable.
So pace this one.
And then these are the columns of the users table.
And now we can pull the actual data.
OK, so you can use this payload to bring the information from the user's table.
But you do need to go one by one again here.
And now I of course, I don't want to finish this lesson without my magic file.
So use this payload to load the password file.
And yeah, I'm sorry, we cannot view all of the content at this time because he is yet another restriction.
So normally we inject into every parameter, but the result of the sub select statement is inserted
in the owner column and then the size of this column is about 100 characters.
So that means that we're only able to read this much data.
But you get my meaning.