OK, before we start with exploiting Eskil injection, I want to show you a quick guide that will teach
us how exactly this injection works and what are the steps that we need to perform in order to discover
it.
The reason we're going with the guide first is because this is arguably the hardest vulnerability that
we covered by now so we could use a little bit of practice in order to really get used to it and to
really understand.
So what I want you to do is I want you to open your Firefox in your search for typing ESKIL injection
practice, and you should find this link to be among the first ones.
It is Eskil Injection Dash explaining.
You want to click on that link?
And the full you are out to the example is this one case you want to type it in?
Once we get there, we want to click on Get Ready and start the application, so once you click on that,
it will load this application right here.
This is our website.
These are the steps that we need to go through in order to exploit the scale of injection, and here
we will have a small guide which will come as this message.
So the first one says this is the vulnerable application.
We will be trying to hack with an injection.
And it appears it's a bank application with Log-in for.
So let's move on to the next step.
It gives us another window that says, here are the application logs, what what happens here when you
interact with the vulnerable application?
OK, one thing to notice is that logs is something that we wouldn't really have in real life.
This is given to us just so we can understand this vulnerability.
OK, so let's go on to the next step.
It tells us, go ahead and try logging in with the following credentials, user at email, dot com and
password.
Let's type that in user at email, dot com and password.
Let's click on login, don't save.
And nothing really happens if we go to long, it will say invalid credentials specified, but the next
step tells us that getting the password didn't work.
Let's try adding a, quote, character after the password and you will see in just a second.
Why are we adding this, quote, character?
Let's type that in first.
So let's take password.
Our email is specified, and let's just click on log.
Now we get an error and unexpected error occurred.
This says this application crashed with an unexpected error.
What could that mean?
Well, let's go to the next step, which will lead us to log's that says the log shows and Eskil syntax
error.
This indicates that the code character messed something up in an unexpected way.
And if we take a look at the logs, we do get syntax error.
And here we also get the ESKIL query used to query our username and password or in this case, our email
and password.
And you will notice where the error is.
Our credentials are being specified between the single quotes by default.
Once we added a single code at the end of our password, it messed up the syntax because now here we
have one open single quote and to close single codes, which gave us the syntax error.
This is a really, really good indication that there is an ethical injection vulnerability on the application.
Let's move on to the next step.
Now it pops another window, and in this window we get the Eskil Querrey or the Eskil code used to query
our credentials to the database.
And this code that we get right here is the same one that we got inside of our loks.
It will change once we type something and it will show us how it looks like inside of this coat window.
So let's go to the next step and let's type once again password
question mark or pardon me, saying, quote, It even tells us to do that again.
And here we can see how it looks like if I delete this single quote, you will notice that this is the
entire ESKIL query.
This also belongs to this comment.
But as soon as I type.
A single quote, it messes up this part that comes after, so this is why this single quote gave us
an error, the syntax is no longer valid once we specified here.
Let's go to the next step.
It even tells us right here the quote is inserted directly into the string and terminates the inquiry
early, this is what caused that syntax error we saw in Delux.
OK, we already mentioned that.
Let's go to the next step.
It says this behavior indicates that the application might be vulnerable.
We already mentioned that as well.
And the next step tells us to enter the following comment.
We specified the regular user e-mail dot com and the password is single quote or one equals one dash
dash.
Why are we typing that in?
Well, let's type it first and then we're going to explain it.
So let's go with a single quote, space or space.
One equals one batch that if we go to our code window and we take a look at the query.
It actually is a valid query.
It's a valid ask syntax.
We're selecting everything from users where email is equal to this email and password is equal to nothing
or one is equal to one.
And this dash dash at the end is just a syntax for a comment in obscure language.
What this last line does, it simply says find the user with this email that has password to be equal
to nothing.
Or if that user doesn't have a password that is equal to nothing, then check whether one is equal to
one.
And if any of these two conditions are fulfilled, log in to that account.
Now, since probably password is not equal to nothing.
This will not go through.
But the second argument is that one equals to one.
And if any one of them is equal to true, then it will log a scene in case this user exists inside this
application and one is always equal to one.
So this should, like a said, let's give it the try.
And here it is, it says, even here we are in we successfully gained access to the application without
having to guess the password.
Now we are locked into the bank account of that user with a simple or one equals one comment.
So what we essentially did right here is we injected as syntax inside of this query and we tricked the
application to execute our code just because it doesn't filter user input.
Nonetheless, you saw how easy this was.
And we're going to take a look at more similar examples in the next few weeks.