Instructor: Okay, so now we know that we can put
any code we want, in here,
and it's going to be executed on the system.
So, let's have another look now on the statement.
So the statement says, select * from accounts,
where user name is equal to the username that we put here,
and password is equal to the password that we put there.
Let's see if we can use that, to log in without using
a password, without even knowing the password.
And I'm gonna be doing that with the admin.
So, the admin, the username is going to be admin.
And I don't know what the password is for the admin.
So what I'm going to do, I'm just gonna put anything,
so nothing really, any random password,
And, in the code, well I should run here.
So were doing, and 1 = 1 and, or stuff,
So, what I'm gonna do is, I'm gonna do or,
instead of and.
And I'm gonna say 1 = 1.
So, what our code is going to be, once I run this,
once I inject this,
this is going to go in here,
like we are doing before.
So, our code is going to look like this,
so it's going to be.
Select * from accounts,
where our username is equal to admin.
And password is equal to AAA.
Now this is wrong.
Or, 1 = 1,
which is right.
So, any time you have an or, if the or condition is
right, everything is right.
That's the way or statement works.
So, select * from accounts.
We're user is equal to admin, okay,
username is equal to admin.
And password is equal to AAA, that's wrong.
Or 1 = 1, okay, I'll accept that.
And then, it's actually gonna execute it,
and let us log into the admin without even knowing
the password for the admin.
So let's try to inject this now.
And as you can see, I was able to log in, as admin,
and monkey is the signature for the admin.
Now, bypass and log in's can be done in so many ways,
depending on the code that's written on the page.
And depending on the way you wanna do it,
and how you're imagining the code.
And a lot of the cases, when you put the single quote here,
you won't see this message.
Sometimes you do see it,
which makes your job so much easier.
If you don't, then you kinda need to guess
what it looks like.
So I'm gonna show you other example of bypassing.
Instead of injecting the code like this,
the admin parameter is actually injectable as well,
as you've seen when I put this single quote,
the admin parameter is injectable, exactly the same way
as the password.
So we can inject code in the username as well.
And what I going to do now, so let's have a look on this,
and I'm just gonna reset it to the way it would usually
look like.
So, we'd have and the username and the password,
out of the fields that you whatever you put in here,
are gonna be substituted and the username and the password.
So, let's try to inject something in the username,
and what I'm going to say is, I'm gonna say,
username is equal to admin,
and then I'm gonna close the quote myself,
and then I'm gonna add a comment.
So, my statement, when I run the statement,
it's going to look like this, and I'm actually just gonna
copy it here.
And, when I inject one, when I put this code in here,
in my name.
It's going to inject that in there,
so this is what the code is gonna look like.
It's gonna select start from accounts,
where username is equal to admin.
I closed the quote myself here, using this right there.
And, then I'm adding a comment, so basically,
all of this is not even gonna be executed,
so the code is gonna be this,
it's gonna be select * from accounts,
where username is equal to admin.
And it's gonna let me log in without entering even
anything in the password,
So, let's do this.
I'm gonna put my username as admin,
and I close the quote and add a comment.
And then you can put any password you want to.
I'm just gonna put #1,
then I'm gonna log in.
And as you can see, I managed to log in as admin.
So again, in this is black box testing,
so you don't really see the code.
In many cases you wanna be playing around with it,
and see how it works with you.
But, the main thing is you wanna test if the
SQL injection exists, and you'd use that using the method
we showed you in the previous video.
So try a single quote, try the and statement,
try true and statements, so 1 = 1,
and then a false and statement, so 1 = 0,
or 2 = 0, and if they work as expected,
then you're target has an SQL injection,
and you can start playing around with it.