While testing, it is very important to look at all input fields.
And when you find an input field, you will try your payloads.
But you probably won't get escalator's.
Then you might think, well, then that means there's no escarole injection here.
So actually, yeah, it's possible because Web applications can send generic errors, right, so you
may get confused to see whether you're a valid excuse or not.
Let me show you something.
So now go to Caleigh and log in to be Web.
And we're going to look at another escarole injection type.
So from the menu, choose escarole injection blind boolean based.
And it's a simple search box.
Now, if you look for a movie and a database, you will get a positive result.
And if the movie's not in the database, then you'll get this negative message.
And if you try something to break the squirrel syntax or to cause an injection, OK, then you'll get
this generic error.
So this point.
What do we do, we've got nothing left, right.
OK, I mean, I turned to you know, I'm just kidding.
But in the real world, for instance, you will get a four or four page in this situation.
But you and me now, we're not going to give up, are we?
So what do we do?
Oh, let's go and open terminal and let's have a look at the code.
Now, we always see these checks, so scroll down.
And so here's the part that I want to show you, here is the Eskil query.
So see how it uses the title parameter coming from the user, then the query executes.
And if there is an execution error, it will print incorrect syntax error.
But then if there is no, it looks to the recordset, see whether it's empty or not.
So if it's not empty, this means that the movie exists, if it is empty, the movie doesn't exist in
the database.
OK, so let's go back to Firefox's.
Now we're going to blindly try our payloads to verify if there is an actual injection.
Now, I said blindly but logically.
Write this one to test.
And it breaks the syntax, but we don't know how.
So now try this one.
Now, I think it should work, but we do get a negative result.
So now try this one.
And once again, I think it works and we get a positive message.
So now change one to two and try.
It works, but a negative result of years.
OK, so we can understand if our payload executes or not.
And also, we can pull data by checking the execution result, whether it's positive or negative.
So now I'm going to add something here.
The first part of the payload before and is always true, right?
And my ask well, we'll check if the second part after and is true or not.
And then that way we can learn the length of the current database name.
Negative, the length is not one.
So change one, two, five positive, the length is five.
So now yours is.
And it will check the first character of the current database name.
It is not a.
It is the.
Is the second character W.
Yes.
Is a third character, A.
Yes.
Is the fourth character P.
Yes.
And is the fifth character P..
Yes.
So the database name is Beware.
I think you get the point, so we use boolean operators.
As well as some other functions to compare.
Now, of course, there are there are multiple ways of comparing this is just one of them.
But a checks of the ASCII value of the first character of the database name is greater than 64.
Positive result.
So the first character can be either lower case or upper case letter.
So I use this one.
So now we get the first character is a lowercase letter.
And we can make a boolean search to find the first character.
So is ASCII value greater than one oh nine no is ASCII value greater than one or two?
No.
And is ASCII value greater than 99, no.
And as ASCII value greater than 97, yes.
OK, is ASCII value 97?
Yes, so finally we get the ASCII value of the first character.
Now you can perform almost the same payloads to get other data from that database.
Of course, you might be tired and bored because this is really long, right, takes a long time, but
you're seeing how it works.
But think about the nature of the information, the quality of the information that you can get from
a real world database.
You need to be proud of yourself.
But me, I'm going to stop here.
But you can go ahead and try some of the other payloads and figure out what else you can do.
All right, cool.