All right, so we detected and exploited different types of rescue, oil injection and the previous
lessons.
And we performed manual detection and exploitation.
It really is important to get the idea behind an actual injection and I think we've, you know, covered
it enough.
So now I would like to introduce you to a wonderful tool.
In the next three videos, we're going to cover the Keywell map.
But first, I want to start with some basic options, so I'm going to use this as Gorell injection page.
And you can open it from the menu.
It's a simple search over the TDP get method.
You can type in something search and the typed input is in the early, you can see.
OK, so copy this, you, Earl.
Then open your terminal.
Now, ask you, a map is a built in and free open source tool and Kouy and I think it's going to solve
many problems.
While you go along escarole injecting.
So with one age, you can see basic options.
And we're going to cover most of them, but the usage is quite simple.
I think the developers did a very good job here.
So it simplifies the detection as well as the exploitation.
But wait, there's more.
With double age, you can view even more options.
And more advanced scenarios, you can use them here.
So let's just stop right here and run it, so type in Escorial, map you and paste the URL here between
the double quotes.
So this is a target, you, Earl?
Then Pete Hidell to specify the target parameter to test.
And type double that cookie to add cookies.
Now, you may need a session value or something in a cookie so you can provide it with this parameter.
So go to Firefox now and open developer tools and go to the network tab refresh page.
And click on a request and copy the value of the cookie header.
Paste here.
Then you can randomize the user agent with random agent.
And the age parameter will add a special HTTP header to the request sent by escarole map.
So I don't know if you can see it, but this is Andy.
Because.
You may want to follow Escorial map requests in a log file or any security device.
So I'm going to add this header.
And with a DBMS parameter.
You can point directly to the database management system of the back end.
And also, you can specify the operating system with the OS parameter as well.
Then F for fingerprinting the database.
B, for better information of DBMS.
And then add current user and current database.
And check to see if the current user is a database administrator.
OK, so now we've completed the Escorial map query, so I know it looks like a long one, but it's very
clear.
OK, hit enter.
So it detects an injection and now if you accept it, will try another type of escarole injection payload.
So, look, it finds several others, the title parameter is vulnerable, and if you want other parameters
to test, you can always ask why.
But you know, we don't need the others now and then.
Let's see how it finalizes the execution.
And now you can see the results here on the screen.
And there happens to be a copy in this file.
So let me show you.
It's under rudimentary in a hidden folder.
So I'll open the log file.
And here is a complete information about our finding.
See the payloads.
And the discovered information.
OK, so go back to the terminal.
Now, I'm going to run this one.
Users is my parameter for getting database user.
And the password parameter for passwords of the database users.
You can also get their privileges and rules also.
So I think the parameters are clear.
It gathers users, then passwords, and then it can even crack the hashes for you.
So accept it by hitting enter.
Choose one.
And No.
Then we'll try to crack the hashes with its own dictionary file.
OK, the execution is finalized.
So go ahead and open a log file.
And here's the output of this second query.
The payloads and the users are here, passwords and the hashes are here, then the privileges show up.
Scrolling down and here are the database users rolls.
OK, so go back to terminal.
And now let's use this query.
It will get all the databases with DVRs and enumerate all the information about them with a schema.
It will bring in everything about the database's.
And of course, the output is very long.
And you can analyze it later.
But this time, just delete the schema parameter.
That's the one that causes the long input.
So here are the database names in the server.
So now we can choose one of them with a deep parameter.
And it lists the tables in.
OK, so now we can choose a table with the T parameter and see the columns.
And these are the columns of the users table.
Great.
So now we have the information about the database, the table and the columns so we can pull the actual
data.
So just use this C parameter and type the name of the column.
Then simply dump.
And it runs quickly, so here's the result.
And we kind of lead here.
You can dump the whole table also.
It'll detect the hashes again, so choose one and crack them.
And thankfully, it cracked the harshest.
And yeah, so here is the result, Perfecta Mondo.
OK, now use this query, the Ezekial Shell parameter will open and ask you all shell for you to run
will statements.
So this is very cool.
You can run a escarole query here.
So like, I'd log in from B Web users.
No, something's wrong here.
That's it there.
I got to add a comma, so it's a really cool feature.
OK, so go back.
Now, use this query.
And you map provides reading and writing files, if possible, so you can read the magic file just like
that.
And now you can accept this to let Escarole map confirm the download.
And the file is in this folder.
Go ahead and check.
OK, so now we can upload a file.
But not an also innocent file.
So I prepared a simple shell.
And with the help of these two parameters, I can upload to a destination on the server.
And again, it wants to confirm.
A file is not uploaded.
You know, I think we don't have the right permission to do that to the directory, so let's just change
it to this one.
We can confirm again.
And I think that uploads the file, so we'll add the command parameter like that.
OK, so now we have a Web show.
And we can run Linux commands.
So go to terminal.
Now, instead of using the Web shell, you can use this query.
Will do almost the same thing that we did.
It will upload a shell file to the server.
OK, choose four and a writable directory.
Type No.
She used to to provide the right of a folder and type dub dub, dub, slash B rap slash documents.
And yes.
And here is the result of that command.
Now, of course, four different operating system commands, you'll need to do all these things again.
So actually, escarole map as another parameter for this.
So use this query and change it here to OS Shell, so choose for and know.
She to to provide the right of a holder and type slash dub dub dub slash B Web slash document.
OK, so we get the operating system show.
Now you can take the operating system commands.
And it looks like it's a Linux server, so I'm going to be typing these ones.
OK, so this is the basic usage of escudo map, and it has been a kind of a long lesson, but.
In the next lessons we are going to dive more into, let's call them advanced scenarios.