OK, in the previous lecture, we saw an example of how we can exploit the ESKIL injection inside of
TBWA application, but right now let's see how we can apply the same comment that we used to exploit
it, which I have written right here.
This is the comment or the end comment that we use to extract all of the data from the database.
Let's see how we can change it to make it work on the medium level.
So last video was a low level.
Now let's change it to medium and submit and navigate back to the injection.
Now, if you try to run the same comment, we just hope this.
And we tried to run it.
It will not work.
It will result in an error.
Luckily, this error does give us a little bit more information than it should, for example, if we
scroll all the way to the right here, we will see how exactly our comment is getting processed in the
page.
You can see it wherever we have a single quote specified, it is getting filtered by a backslash.
So every time we specify a single quote, it adds a backslash.
The application at backslash, which then results in my ESKIL error.
This comment is not valid once it has this backslash.
Another thing that we can notice is that it doesn't really give us the entire command to top.
It only gives us a part of the comment.
This could mean that there could be a character limitation that we can specify.
Let's give it a try to see how we can bypass this backslash and how we can actually bypass the character
limitation in case there is one.
So let's go back to the page and let's delete this.
Let's delete all of it, and the first thing that I want to take a look at is the source code.
Let's enlarge this.
And what we are mostly interested in is the actual query used to query the database.
Of course, the source code is not something that we would have in the real application, but luckily
during the practice, we can take a look at the source code and figure out how we can exploit this.
You will notice one main difference that's different, this application from the low level application,
our I.T. or our input is not getting stalled between the single quotes.
This is really good because this can help us bypass the single, quote, problem that gets filtered
by a backslash, because if it doesn't get added between the single quotes, we don't really need to
use single quotes at all.
We can type a command that looks something like this.
So if we take this same command, we can make it work.
If we run it like this to union select concat and let's type user idea.
Now, since this is getting processed as a character, we must remove it altogether.
So what we are going to do is we're just going to type it like this user I.D. and then first name.
The only problem with this is that these users and first and last names are not going to be physically
divided by the semicolon.
Nonetheless, it's still better than not extracting any data so we can run it like this.
We need to specify the user and the password.
And we're extracting this from TBWA Dot users.
We specify two dashes to Common Part, the rest of the comment.
And if we copy this.
Go back to our application.
And Freenet.
Well, here it is.
It worked successfully, we managed to extract all the data just by removing the single quotes from
our comment, as we can see right here.
It appears to be that that is the only filter I thought there could maybe be a character limitation
filter there as well that could easily be bypassed.
We could just remove the unnecessary data, such as, for example, this one, we don't really need
the user I.D. The first or last name on thing we are interested in are users and passwords.
And we can type it like this to union select one comma and then concat user password from TBWA users.
And this will make our comment even shorter, allowing us to perhaps bypass the character limitation.
Let's give it a try to see whether this command will also work.
And before I type it in, you will take a look at the only problem that we have is that the first last
name is not getting separated and the username and password are also not getting separated, but we
are extracting them nonetheless.
Let's take a look at this third comment to see whether it will work.
And it will work, we removed specifying the first and last name.
So now in the first name field, we only get number one, which we specified right here.
And in the last name field.
We get the username and password all together and we get that, as usual, for every user in the application.
Nonetheless, I just want to show you how we can exploit the injection on medium level.
And in the next lecture, we're going to tackle the subject of blind Ezekial Injection Suder.