Hey there.
Welcome back.
Before we go,
I want to show you how much impact this tool can have in the hands of a hacker.
The attacks in this demo are not usually in the red team engagement
since they can cause data loss for the client,
but I still want to show you how this is done since
the bad guys do that all the time.
First, from previous demos do you remember a table called accesslogs?
So yeah, let's take a look at it.
I'll use the same Get‑SQLQuery that I was using before,
but now the only difference is that I will be using the
Select all in the accesslogs table.
Take a look.
In this table we have the login attempts for every user.
As you can see here, I was trying to brute force the password for the user test.
So, I don't want to leave tracing here.
So what I can do is delete all the login attempts for the user test.
For that, I'll run the same Get‑SQLQuery command,
but instead of doing a Select in this table I'll use the command Delete
to delete every row that is related to user test.
So the command line will look like this Delete from
accesslogs where username = test.
Basically what I'm saying here is delete every row
where the username equals to test.
And when I press Enter you see that a connection was successful.
And then if you do the same Select all in this table we will see that now
all the rows that had the test user are now deleted.
And this is a really good way of covering your tracks.
Now, let me show you how to modify stored data using PowerUpSQL.
Since we are in the HR database let's say I want to
modify the salary of some employees.
So first, we have to find the table where the salaries are stored.
And the easiest way of doing that is using the exactly same
command we were using to find credit card data,
but now we'll change the keyword to salary.
And if you don't remember what this command does go back to our
previous demo and your understanding there.
But basically,
in here I'm searching across all the tables in the
database for columns with the word salary.
Then, it seems that the salaries are stored in this table called employeesalary.
So,
let's use the same command that we were using before to
do a quick Select all in this table.
I'll just change the table name to employeesalary.
Cool.
Take a look.
We have a list of the employees and their salaries.
Now, let's say I want to change this salary for Adam Robs.
So, I'll use the command Get‑SQLQuery,
but instead of using a Select clause I use the Update clause.
It will look like this Update, then the name of the database,
dot the schema, and then dot the table name.
Then we write SET and the field that we want to change.
In my case I'll put salary = 250000.
Then I have to specify for which employee I want to change the data.
So I put where employeeid = 130, which is the employee ID of Adam Robs.
And that's it.
We just have to execute it.
Perfect.
Now, let's do a Select all in the same table to double‑check the results.
And there you go, the salary was updated.
But if you want to really cause an impact on a company you can
delete the entire table from the database.
Again,
if you're working on a red team engagement your client
probably will not authorize you to do that.
So I don't recommend you doing this at all, but I want to show you how
it's done since hackers have the power to do that.
For that I use the same Get‑SQLQuery command and then I will
write the query like this Drop table and then the name of the
table that I want to delete.
In my case it is the employeesalary table.
When I press Enter this entire table will be deleted.
And be aware there's no way back.
If you don't have backups the data will be lost forever so be really careful.
Once executed, it shows this connection's successful.
So then, now, to double‑check let's start to query this table.
Let's do a Select all.
There you go.
As you can see we get a successful connection and then a failed connection.
And this means that we're able to authenticate to the database,
but no tables were found.
And that's pretty dangerous, right?
So again,
make sure you know what you're doing before trying any kind of impact attacks.