Instructor: Okay, now I'd like to show you
an SQL injection and in a different file
and in different page
and I'll show you a few different things
that you can do to exploit the vulnerability.
So the first thing I'm going to go to the login page
which is in here.
User Info.
So the first time we went to the Login page from there,
this time we went to the User Info page.
So this page will show you the information
about the user provided you give the username and password.
So I'm gonna do zaid
and I'm gonna put my password, 123456.
And it'll show my details, username and password
and my signature as aa.
So the statement that's being executed here
is similar to what was being executed
when you log in.
So selecting star from accounts
where username is what you put in the user field
and password is what you put in the password field.
So what we're going to do now
is we're going to see a different way
of exploiting this kind of vulnerability.
In the previous video,
we were doing it using a POST text box.
So whatever you put in the text box
was being posted using a POST method to the web application.
Now, these vulnerabilities can exist into GET.
And what I mean by Get,
is when you do a Get when something is sent as GET,
you will see it here in the URL.
So if you look at the URL here,
you see it's being sent as the username zaid
and password 123456.
So let me just copy this URL here.
And we'll start playing with it
from the URL instead of doing it on the web page.
I just wanna show you a different example
'cause in many places,
there might not even be text boxes,
for example, it could be something like news
and news.php, so we can see here, for example,
in this example, it's index.php.
And in your pen testing,
you might see something like news.php
and for example, id is equal to two
and then you can try to inject stuff in there.
So we're having an example here
where we're gonna be injecting things
into the username field which is this field
and we're gonna be injecting stuff in here.
So any time when you're doing your pen test,
any time you see parameters like this,
you should try to inject them.
Anytime you see something .php
and then you have a parameter equals something,
then always try to inject stuff in there
and see if it works for you.
So we've also seen a way of discovering the injection
and that was using the quotation mark
and using the and.
So we do a false and a true and
and one is equal to one
and then and one is equal to two
and if the server is executing what we want,
then we're gonna know that there's an SQL injection.
I'm gonna show you another way
of discovering these exploits
and it's using the order by.
As the name suggests,
the order by statement is used
to order the results that we get on the screen based
on a specific column.
So our injection's going to be like this.
So I'm gonna do order by one.
So this, if the injection exists,
this should work
because in each select statement,
there should be at least one column is being selected.
Therefore when we say order by one,
we're saying I want to order the results based
on the first column,
therefore, this should always be acceptable
by the database.
And return a true or something that we expect.
We also need to add the comment in here
and execute this code.
So it's exactly like before.
So when we're doing this,
basically this is our URL
and what's gonna happen on the database,
so this is the code that's being executed
on the database, it's going to look like this.
So it's gonna be select star from accounts
where username is equal to zaid
and note how this is closing the quote
and we're gonna do an order by one
and there shouldn't be this code for the and,
and this comment will tell the SQL interpreter
to ignore anything that comes in after it
so all of this is going to be ignored.
So I'm copying this.
So you can actually paste this injection
for zaid order by one
into the name right here and that's gonna work
but again, I just wanna show you a different way
of doing it by injecting it through the browser.
Another thing that I want you to note
is when you're injecting stuff
into the browser, the browser, the code should be encoded.
So for example, this sign usually,
when you put it on the URL,
it should be written as %23.
Spaces, for example, get converted to %20
and %23 is the comment that we're using.
So I'm gonna copy that and replace my comment sign with it.
Now, you can google HTTP Encoder
and you'll see online there's online tools
that'll just convert this for you.
For me now I know that the hashtag
can be converted to %20.
So that's why I'm using it there.
And I'm gonna hit Enter.
And as you can see now,
we're seeing something that's acceptable.
Nothing wrong and then it's showing me the information
about zaid 123456 and showing me the signature.
So it is ignoring the password,
so the injection worked
and it's ordering by one
so it's not showing me anything wrong.
Let's try to make this number one a very large number,
so I'll put in 10,000 or 100,000 now.
So what we're saying right now
is I want you to order the results
that will be returned by the current select statement
based on column 100,000.
Now chances are there aren't 100,000 columns used
in this select statement
and therefore this should return an error.
So when I execute this,
you'll see that there is an error.
And the error is in the order close.
And still there is an Unknown column for 100,000
and this is great 'cause now we know
that the database is executing what we want.
So when we told it to order the results based
on the first column, it showed us results.
So it followed what we told it
and then when we told it
to order the results based on a column
that does not exist, it gave us an error.
So it's obviously vulnerable to SQL injections.