SQL injection, it is one of the biggest and most serious vulnerabilities out there.
As injection happens, once the database query is taking an argument of an unfiltered user input, usually
those inputs are something like usernames or passwords.
It could also be something like an input on a page where you search for a specific product.
Whatever it is, the backend process is the same.
Our input is getting sent to the database of the website.
The database checks whether our input is stored somewhere.
Usually this is something like a password check.
So the website would send the hash of our password that we inputted.
It would send it to the database and it would see whether it can find the match.
If the match is found and we input the correct password, then the database confirms it to the server
and we get to log in to our account.
Now, this is just an example.
It doesn't have to be passwords that we input.
It can be any type of application as long as it communicates with the database.
And as we know, this communication between the server and the database is being done with the help
of something like an ESKIL is just the programming language used to communicate with the database.
Now, all of this is how a normal application should act, but this is all considered if our input does
indeed get well filtered.
But what if we as attackers, instead of sending our regular input that the application expects, we
send an e-mail query?
Well, that is when the problems can occur.
And in this vulnerability, it can be a really big problem.
If the input isn't filtered and our Esequiel query gets through, then what we can do is we can craft
a query that could maybe tell the server to drop or send us the entire database.
If we were to do this successfully, we would have all the usernames and passwords and all the private
information of all the users registered on that specific website.
As you can imagine, this can be really bad, an example of an ethical query that can be used to extract
something from the database looks something like this.
So it says select elements from people where condition.
The things in the square brackets would get exchanged for elements and tables that are inside the database.
So the real life command that's a real website could potentially send to the database could look something
like this.
Select star sign from books where I.D. equals the five.
Now, this star sign is simply just referred that says select everything every time you see the stars
on it usually means everything.
So select everything from the table called books, where the idea is equal to five.
And I could potentially be in ideas for products or user or pretty much anything depending on the application.
And this is just an example of a normal ESKIL query.
In the practical lectures, we we'll see how we can manipulate user input and ask your language in order
to get information from the database.
See you in the next lecture.