OK, it's time we cover a blind squirrel injection so we already know what SQL injection is.
We know how it works and we know how we can exploit it.
But what is this injection?
Well, let me show you let's navigate to our W a log in to our page.
Navigate to blind Eskil injection, and if you remember how we actually managed to discover whether
Enescu injection was present on an application or not is we used a single quote, and once we entered
that single quote, it would give us an error or it would give us some error message or possibly even
the query itself where the error occurs.
That's how we would know that this input is not really getting filtered.
Well, if I click submit on blindest injection.
Nothing happens, it's as if this application is not vulnerable, doesn't give any error, we can type
anything with as many single quotes as we want and nothing will happen.
Any character that we input will just get processed by the application and it will retrieve the same
page back to us.
So does that mean that it's not vulnerable?
Well, it could be that there is also blindest conjecture injection, which means it's not giving us
any error back, but it's still vulnerable to the scale injection.
OK, but how can we figure out whether the skull injection is present in this application?
Well, let's try specifying the correct input first.
So if it just type one and click on submit, it will give me an idea of and it will give me its first
name and last name.
If I type, for example, to, I will give Gordon Brown and so on, so on so we can select one user
ID right here and we get one output back.
Same goes if we, for example, try one single coat or one equals one or one equals two, let's try
it like that so we don't get admin back.
But it could be due to two reasons.
Reason number one, it's not vulnerable to injection or reason.
Number two, it only this argument is satisfied if no one exists, but one is not equal to two.
So this part is not satisfied.
Therefore we only get the output for adding.
But if we were to type one single coat or single coat, one single coat equals one press enter.
We get all the users from the application.
Now we don't get their usernames, passwords.
However, we do get all of them out, put it right here.
And this would be a good indication that there is a possible ESKIL injection in the application.
Why?
Well, because this application is not meant to output 20 users.
It's only meant to output one.
And with this statement, we told the application we want the ID number one or if one equals to one,
and it gave us all the other I.D. And that is one of the ways we can discover whether it has some vulnerabilities
in the application.
Now, how can you explain this?
Well, here is where the problem occurs.
Exploiting blindest an injection is much, much longer and harder than exploiting an error based ESKIL
injection.
For example, here, we can't really output the database name.
We need to guess because we're not getting any output back or any error back.
So how can we go about getting the database named papal name, the column name and all of that?
First of all, to keep in mind is that it takes a lot of time to do that.
So for the purposes of this call, we will only show how we can get the database.
To access the database we can use and Eskil like Operator and you can find it on this page, describes
what exactly does it do?
The like operator is used in our work force to search for a specified pattern in the column, since
we don't really know how the database is called or we do actually know how it's called, but only because
we exploited it in the previous lecture.
We know that the database name is Steve.
This is the name of the database.
But let's pretend that we don't know it.
We want to discover it by exploiting blindest conjecture.
We could do it like this, we could type one single quote for the ID and database, since we know Israel
has this database function and then this like operator, which has Syntex of open code, then the letter
that you want to use, lets go with letter A and then the percent sign.
What does this mean?
Well, this line simply says that we're checking whether the database name starts with a and this person
sign simply replaces all the other characters that could come after.
So we're only checking whether the first letter of the database is a let's press enter.
We get nothing back.
Why is that?
Well, it's because the first letter of database is not a therefore it didn't give us any output back
if we were to type something like this and database and then we switch a with the because our database
does start with the and the click submit.
Now we get output back and now we would know that the database name starts with letter D.
As you can only imagine, this can take a lot of time to guess and we could use the help of purposes
to do this.
So let's go to Burset.
Let's turn on the intercept.
Let's type.
One, and perhaps we just type it in first and then I'm going to intercept someone and database like.
Hey.
Let's start with a once again just for the purposes of showing how this would work and then we intercept
the request.
Now we want to send this request to intruder.
Let's hope that we can turn off the intercept and go back to the intruder.
We want to select the positions and here we want to clear all of these positions, find the letter A.
which is right here, and then add a position to it, since that is the only thing that we want to use
as our paillard.
Once we do that, we want to go to payloads and here we want to load all of the letters possible, so
we'll just go A, B, C, D, E, F, G, and here I loaded all of the possible letters that could be
the first letter of the database.
So once without all the letters, we want to go to options.
And here in the correct match, we can clear everything.
And ad, for example, ad, so if we find the word admin in the page, then we're going to assume that
we found the correct letter.
Why is that?
Well, if we get the correct output, it will output this that has admin right here.
Or matter of fact, just so we can get even clearer response, let's copy this and parse string, which
is first name Edman, and let's face it right here.
Then we add it right here, and if our response finds this string inside of the code, that means we
found the correct letter.
All we need to do right now is start the attack.
And here it is, we already get our response letter, the is checked, it has first name admin in the
family response.
It also has a different length of the response than all the other letters, as we can see right here.
Now that we guessed the first letter, we would cancel this.
We would go back to the positions and we would, first of all, clear this, remove the A and type the
after type the we once again type it.
Then we select a once again as the second letter since we already guessed first and now our command
looks something like this.
One and database
like open quote the A percent, now we're guessing the second letter.
OK, if I submit this for once again, not give any back because A is not the second letter.
So let's see which letter is the second one.
We can start the attack.
Let's wait for this to finish.
And here it is, a letter V is the second letter.
Now we can go on to the third letter.
So the B A, we once again selected.
We started the attack.
And here it is, it appears that W. is the next or third the latter.
Let's add it right here.
And let's add a at the end, select A and from the attack once again.
And we get the response straight away, a is the fourth letter now we got the full name of the database.
Now if we try to type like this and database like.
Dve e
submit, now we get the response back and here we can see that this is the name of our database and
you will have to do this for every database, name, table, name and all of that.
So now you notice why this is much longer to perform and much harder.
Nonetheless, we covered it.
We know how it works.
We know that if we don't get any error once we specify the input doesn't mean that there is no ESKIL
injection.
We can also try something like making the application sleep for three seconds, which is also an indication
that there could be an actual injection if the application does slip for three seconds after our comment
nonetheless.
Thank you for watching this lecture.
And in the next video, we're going to start off with XML XPath Injection Suder.