I hope you remember what we did in the blindest fuel injection lessons.
We saw how to perform a boolean and time based blind escarole injection XPoint.
And, of course, manually exploiting such a vulnerability is a time consuming event.
And it's also just very hard to go step by step.
So we can use Escorial map to get over these obstacles.
So first, I'm going to start with bullion based one.
And so there's a search box here, I think you know what's happening, just enable Foxe proxy.
Then type something in and search.
Now go to berp.
And the request questions here, so before forwarding, copy it to a file.
And I'm going to use the same file and save.
Then let the request go.
OK, open your terminal, then type Escorial, map R and request the file path.
He title.
Age and test Colin 28 08 to 09.
And run.
Now, it's funny because we're looking for a boolean based escarole injection.
But we discover a time-based one.
Yeah, so you can skip testing the others.
OK, so, yeah, the exploit is with an integer value.
OK, again.
And this can always happen to you.
OK, now, directly, I'm going to point to the bullion based injection.
B is for Boolean based.
It executes, but nothing is found.
So maybe providing the DBMS can help.
But nothing is found.
Oh, no, I'm getting nervous.
OK, so I'm going to add two more parameters.
Level five, there were five those.
The default value is one where a limited number of tests or request are performed and vice versa.
Level five will test were Beausoleil for a much larger number of payloads and boundaries.
So all at all, the harder it is to detect Enescu oil injection, the higher the level must be set and
risk three.
And there are three risk values.
The default value is one which is innocuous for the majority of escarole injection points.
Risk value, too, adds to the default level, the test for heavy query time based rescue, well, injections
and in value three ads also or based escarole injection tests.
Super.
All right, so finally we discover the boolean based blind injection.
No, no, don't test any other, just look at the result is MAP discovers a hard injection type for
us.
OK, so bring in the banner data for me.
And sure enough, it brings the better information for the operating system, web application and server.
So now think how hard it was for us to get one character of the version information.
OK, so get the current database.
OK.
Something went wrong because the escarole map runs in a single thread mode, some data retrieval problems
can happen.
But I'm going to show you that thread a few seconds later, so before adding threads, I'll add these
parameters.
Prefix will add what I write before as Google Maps, payload and suffix will add what I write after
the Escorial Maps payload.
Then I can refresh the school map session to start exploiting from the beginning.
Now, have a look at the payload, it puts everything in place.
So now get the current user.
OK, and add read 10 to retrieve data fast.
Now, I I couldn't see what happened, did you?
It was very fast, so we can use the threads parameter for bigger ResultSet.
Yeah, let's see, for example, this one and make the thread 10.
Look at how fast it is.
So no and no, I don't want to crack hashas now.
OK, so I think we're done with the Bulleen based Bascule injection, so let's have a look to see if
there's another one.
OK, so we go to Firefox's.
Open an appropriate page from the menu.
And I need a request file, so.
Type something in and search.
Open berp.
And the request is here, so copy this to a file and say, OK, so go to the terminal again.
And then run.
And it will get a time based blind rescue injection.
OK, so we know this is not a surprise.
We can also point with a technique parameter like that.
OK, so get the better information.
Oh, yes, please do optimise.
OK, so I'm going to stop it here because even Escorial map has its boundaries.
So as we've done, Escorial map should also wait and time based escarole injections.
So now you may think, well, adding threads to the parameter can solve it.
Well, good thought, but I am so very sorry it doesn't work for time-based escarole injections.
And as you can see, Ezekial Map is very clever, it completes the previous data retrieval process.
OK, so I just I just can't wait that much, so finally we come to the end of the school injection part
of this course, I hope you enjoy that.