‫Instructor: Hi.
‫Within this lecture we are gonna go ahead
‫and solve the API8 challenge.
‫So if we take a look at the API8,
‫it says injection.
‫So far so good.
‫So this is probably SQL injection.
‫And if you're watching the web pen testing course
‫then you know a great deal of SQL injection by now,
‫because we have seen it in a great detail,
‫in a great depth.
‫But if you're watching the mobile Ethical Hacking course,
‫as I said before,
‫I put the section in both
‫of the courses because it is related
‫with both of them.
‫So maybe you don't know
‫a great deal about SQL injection.
‫Okay,
‫so in a nutshell,
‫we are trying to run SQL comments
‫in the database,
‫in the remote database,
‫so that we can gather information out of it.
‫But these comments,
‫of course
‫are not meant to be executed by a regular person.
‫So it's a vulnerability
‫and you have to listen
‫like a couple of sections in order
‫to fully understand this.
‫Fully understand the logic behind it.
‫If you are curious about the SQL injection
‫and you're coming from mobile application,
‫Mobile Ethical Hacking course,
‫I suggest you do a quick research and then come back
‫and watch this.
‫Because I'm just gonna go ahead
‫and show you a very quick tool
‫or very quick way
‫to find out about the SQL injection vulnerabilities.
‫Okay,
‫so what we are going to do, let's see
‫what kind of endpoints do we have over here?
‫We have a login
‫with a username and a password
‫and also we have a secret,
‫okay, after we log in
‫most probably we get a user token
‫like an authentication token
‫and using that authentication token
‫we can get the secret back.
‫As you can see,
‫if we come over here to the headers
‫as you can see there's an API authentication token
‫but we don't have that unless we log in.
‫And to log in, there is a username and password.
‫I'm just gonna go ahead and give some random tests
‫like test, test 1, 2, 3.
‫As you can see,
‫it says incorrect username and password
‫but we don't have any kind of other hint.
‫In the previous examples we have come across
‫in a situation like this.
‫But then we had some data leakage scenario,
‫so we have found out some resources in our app,
‫but right now this isn't the case.
‫So I'm just gonna go ahead and send this to Burp Suite.
‫Here you go.
‫Now I'm in the Burp Suite again,
‫Since I don't have any wordless,
‫since I don't have any users
‫and password less,
‫I'm just going to send this to intruder
‫but we are not going to brute force usernames and password.
‫Okay?
‫We are going to just go ahead and try SQL injection.
‫In order to do that
‫I'm just gonna clear out the selections
‫because we don't need to change the P H P S S I D.
‫Okay, just click on the clear.
‫We are just going to change the username and the password.
‫So in order to do that
‫of course just select the thing that you want to change
‫and then edit
‫like this.
‫So I'm going to do it one more time.
‫Here you go.
‫Make sure you don't change the P H P S S I D.
‫So far, so good.
‫Right now, since I have this,
‫I have two different parameters, right?
‫I have the username and I have the password.
‫So if I had one parameter, then I would go for a sniper.
‫And we had two parameters before,
‫I believe we went for pitchfork,
‫but this time we can go for something else.
‫And let me show you what it is.
‫We're gonna go for something called battering gram.
‫And in order to do that, you can just choose it
‫from the attack type and we are going to give it
‫on SQL list and we'll just grab the things
‫and try them for the both of the parameters.
‫Okay?
‫So why do we get this pay loads?
‫In fact,
‫if you have the Burb Suite
‫not free edition, not communicate edition,
‫but pro version,
‫you can actually just select it from this list.
‫This list has something like SQL injection,
‫this injection, that injection,
‫different kind of lists embedded
‫for us in the professional Burb Suite.
‫However, that is not the case for the community edition.
‫However,
‫we can actually Google it out
‫and just find that list or a similar list,
‫right?
‫So that we can just copy and paste it from there.
‫So I'm gonna go ahead and run search
‫for Burp Suite intruder
‫SQL injection fuzzer,
‫okay
‫maybe TXT or github, something like that.
‫So people tend to put those kind of things in gitup
‫and we can easily find that list
‫inside of any gitup repository.
‫You're gonna see we will have a lot
‫of options because I have done this before.
‫So I'm just gonna go ahead and search for this.
‫And here you go.
‫I believe there is something wrong
‫with my internet connection, but yeah,
‫here you go.
‫So we have a lot of results.
‫I'm going to open every one of them
‫not every one of them, well actually
‫but a couple of them at least,
‫so that we can see
‫and compare what kind of things we should use.
‫So for the first one,
‫I have a false list.
‫You don't need to go for the same repository with me
‫by the way, I'm just going one
‫by one and trying to figure out the best one.
‫I can share this SQL injection payloads with you later on.
‫So, let's see.
‫Yep, this one's no good.
‫This one is actually a little bit complicated,
‫so I'm not gonna go for that one.
‫Yeah, let's see.
‫Yeah, here we go.
‫This is just one liner, I'm not looking for that one.
‫Let's see this one, one entry,
‫okay, one entry.
‫I'm looking at that one.
‫And there is something called quick voice.
‫Here we go.
‫So in the quick fuzz,
‫there is a TXT file and I,
‫as far as I can see
‫this is not only SQL injection,
‫but there are so much more
‫but there is also SQL injection as well.
‫Here you go.
‫This is a good list.
‫Why not?
‫We use it, right?
‫As you can see, these are not related
‫with this SQL injection
‫but I believe it starts right here.
‫So I'm just gonna copy and paste this stuff into a txt.
‫Of course, again,
‫if you couldn't find this
‫of course you can just post the video and just
‫write the URL on your own,
‫like manually and just come to that file
‫and copy what I'm copying right now.
‫But I will just share it with the resources of this lecture.
‫So I'm copying this equal injection part
‫and I'm just gonna paste it to a Txt file on my desktop.
‫And if you're using Mac,
‫you can open the terminal
‫and go to desktop, like this CD desktop,
‫and just write touch
‫something like SQL injection dot txt.
‫Okay? It will create a file for you so that you can just
‫open it and paste the things.
‫Here you go.
‫Now this has been saved for me.
‫Of course, if you're using Windows, just create a txt file
‫like right click and say
‫new txt file or new tax file.
‫So far so good.
‫So I'm gonna open the Burb Suite, and by the way
‫I could have just pasted over here, but I had to save it so
‫that I can share it with you later on.
‫Since I have pasted this list,
‫I can deselect this url
‫encode these characters,
‫I believe.
‫And since I saw that, I remembered we are still
‫in the sniper,
‫so we cannot do that.
‫I'm just gonna go for the bettering gram.
‫As I said before, it'll just try this simple list
‫for the both of the parameters.
‫If we had chosen pitchfork like we did before
‫then we would have provided two lists.
‫But right now I just want one list and I want them
‫to try it on the both of the parameters.
‫Okay? That's why I have chosen battering gram.
‫So I'm gonna deselect this URL called these characters,
‫and that's about it.
‫So what I'm going to do
‫I'm just going to start this attack,
‫and of course we are gonna have to wait a little bit.
‫And as you can see
‫we're getting 500's,
‫403's.
‫We are going to wait a little bit.
‫And since it has only 107,
‫107 possibilities,
‫I believe it's gonna not
‫it's not gonna be as long as we have waited before
‫so that we can see the requests and responses immediately.
‫And again, we are just trying the sequel injections.
‫And if you have watched web pen testing course
‫then now you have another way
‫to tri SQL injection rather than SQL Map as well.
‫But if you're watching the Mobile
‫Mobile Ethical Hacking course
‫then you might wonder the logic behind this.
‫Again, I suggest you take my complete ethical hacking course
‫and watch it from here,
‫or weapon testing course
‫or you can just do a like a real quick research in Google
‫because it's not very related to mobile ethical hacking.
‫That's why I didn't put so much information
‫or like a wide section inside of it.
‫But over here,
‫now we needed to take a look at it.
‫So that's what we are doing.
‫And by the way, I have just looked at a response
‫and the response over here is
‫that it says you have an error in your sequels in text.
‫Check the manual that corresponds to your My SQL server.
‫Great.
‫So some of the responses say that
‫not some of the responses saying incorrect
‫but some of the responses
‫saying different things.
‫I believe we have to wait
‫until this is finished
‫and then we can just analyze everything.
‫Here you go.
‫Everything seems to be finished for me.
‫I just post the video, obviously in order to wait
‫for it to be finished,
‫but after it's finished
‫I can just sort it according
‫to their status code and see the responses.
‫Okay?
‫We have come across in a situation
‫where we get some different messages
‫like different syntax saying
‫just find your own syntax or something like that.
‫So as you can see,
‫there is a length column as well.
‫And we have two 89's and two 95's.
‫So different lengths different,
‫even though the different
‫we have the same status code,
‫we have different responses.
‫And over here, some of the responses actually
‫give us an authentication key
‫like this.
‫So even though we have the same status code,
‫sometimes we might take a look at the length
‫of this responses as well
‫to see different kind of things
‫different kind of responses.
‫So I'm just gonna send one of these to repeater.
‫Okay?
‫So this was the one where we got the success.
‫It means that we got it, okay?
‫It means that we have used SQL injection
‫and I'm gonna have to turn off the interception.
‫We used SQL injection to get into the database
‫without even knowing username and password.
‫So I can copy this,
‫okay,
‫I can copy this authentication key
‫or I can copy this payload
‫from here,
‫and just paste it in the postman
‫like this for the username,
‫this and for the password
‫this and the single quotation marks are important.
‫So beware of that.
‫Here you go.
‫Once I send this, I get the authentication key.
‫Now, if I go to get secret and send this
‫because I already have the authentication key.
‫Here you go.
‫We got the flag back.
‫Now again,
‫this lecture was not
‫about SQL injection, like SQL injection 1 0 1.
‫This lecture was about finding a quick way to see
‫if we have a SQL injection vulnerability inside of the API.
‫So I hope you liked it.
‫Let's stop here and continue
‫within the next lecture together.