Instructor: Now to try and discover SQL injections,
you need to browse through your target
and try to break each page.
So whenever you see a text box
or a parameter on this form for example,
page.php then somethings equal to something,
try to inject stuff here.
So try to use a single quote,
try to use an and, or the order by statement,
to break the page and make it look different.
So, I'm gonna show you here an example.
And I'm gonna go in to the login page first, right here.
And its asking me to log in now.
But I actually registered with my own name.
So you can just go in here and register.
I have a username called Zaid
and a password with one two three four five six.
So first, let's just...
I'm gonna log in just to show you, so.
My username is Zaid
and my password is one two three four five six.
And now I'm logged in as Zaid
and my signature was aa.
Its just nothing really, just like as a test.
So I'm gonna log out
and we're back at the login page.
Right here, we have the page
so you can try to inject in that.
But we will get into that later, so.
At the moment,
we're having an example of injecting into text boxes.
So you can try to inject into the name
and into the password.
So I'm gonna put my name as Zaid
and I'm gonna put a single quote.
So I'm putting this sign into my password.
So let's see if we can break it.
And as you can see now,
there's an error being displayed to us.
And it doesn't look like a normal error,
it looks like it's a database error.
And usually you will be very lucky
if you get an error like this.
Now usually the error won't be as informative as this.
Sometimes you'll just see that the page
is not acting as it's expected,
as you expect it.
Sometimes it'll just be a page
that does not look as it should.
For example, if it's a news page,
maybe it'll have the article missing
or if it's a blog, it'll have one of the posts missing
or different kind of posts.
So you need to keep an eye on what's changing.
In this example, we're actually getting a really nice error.
Its telling us which file it has,
and its telling us that there's an error in the statement.
And the error near the quotation mark that we added.
And it also tells us the statement that's being executed.
This is really good for learning.
Cause now we can see what's the statement,
that the system is trying to run.
And the systems trying to do a select *.
So it's trying to select everything from accounts,
where the username is equal to Zaid
and the password is equal to a single quote.
And note that the system
the web application is already
adding quotes around the name.
So when I said Zaid, it added Zaid between two quotes.
And it added the single quote
that I added between another two quotes.
So that's why we have three quotes right here.
So from this we can,
its like 70% of the target website,
has an SQL injection.
We're still not sure
if it can execute what we want it to do.
So can I actually inject code
and get It to be executed?
Let's see if we can do that.
So username is gonna be Zaid again.
And what I'm gonna do with the password,
I'm going to put my password.
So I'm gonna put one two three four five six
and then I'm closing it.
So I'll tell you why I'm closing it,
because the current statement through the system
is select * from,
to Zaid and,
is equal to.
And its gonna open a single quote by itself.
So lets call this S password.
So we're treating this a variable.
And it takes in whatever I put in here,
whatever I'm gonna put in this box.
And its gonna insert it instead of the S password,
which is a variable.
So I'm just giving you an idea,
so you need to be able to imagine this happening.
So its taking whatever I put in there,
and its gonna put it between two single quotes.
And its gonna be inserted in there,
and executed on the system.
So what I'm doing is,
I'm gonna put one two three four five six
and I'm gonna add the quote myself.
So what I'm gonna do right now,
the code is gonna be like this.
So its gonna select this,
and password is equal to that.
And I have two quotes right now, okay.
And then what I'm going to do is,
I'm gonna say and,
one is equal to one.
So one is equal to one.
And I'm just trying to see
if its going to execute what I want it to do.
So my statement right now is,
its gonna be Select * from accounts,
where username is equal to Zaid
and password is equal to one two three four five six.
And note, I'm gonna be inserting this myself,
and ones equal to one.
One problem that the system is gonna complain about,
is that we have an extra quote here,
because I'm gonna be inserting this myself in the text box.
So it's gonna be complaining about this,
it's gonna say this is an open code
and never be has been closed.
So what I'm gonna do is I'm gonna add the comment.
And when you add a comment,
basically everything that comes in after the comment
will not be executed.
I'm gonna use the hash as the comment.
So anything that comes in after the hash
the system is gonna ignore.
So I'm gonna inject now is gonna be this,
and one's equal to one and this,
so as I said, usually what you have here,
you have slashed your password,
or depending on what the program are called it,
for just imagining this.
And I'm gonna be inserting this inside.
So when you do that, and you insert it inside,
this is what the code is gonna look like.
So it's gonna look like the right username,
the right password,
and one is equal to one, which is true.
And then it's not gonna,
it's gonna ignore this quote right here.
So if we paste this,
we should be able to login.
It should allow me to login.
And perfect we were able to login and username is Zaid.
So far, we haven't done anything.
But this kind of shows us that is it running our code?
Let's try a different thing.
Now, let's try to add a false statement.
So we did we did one equal one,
and that was correct and it executed when we wanted.
Let's try one equals two.
And this is false.
So I have the right password.
And I have the right username,
and one is equal to two.
And this should be wrong 'cause it's false
one is not equal to two
and I'm using an and so everything has to be true.
So it should give me an error
even though I'm gonna put the right username,
and I'm gonna put the right password.
So I'm putting one two three four five six
and one's equal to two.
So it's gonna be like, oh, this is wrong.
And as you can see it's given me an authentication error,
bad username or password,
even though I'm given the right password
and the right username.
So this confirms that this website is actually injecting
anything we want in the password.
So we can use the password field to inject SQL code.
And it's always gonna be on this form.
So we're gonna put a password
and you're going to put your code here,
so I'm just gonna put it in capital code here.
Because we're gonna put a password, close the quote,
and then put the code that we want to execute
on the system right here,
and it's going to be executed on the target system.