So it's now in this room that we are going to talk about this escalating action and we will see the
union in action.
First, we need to set up some settings in the metastable.
Without this, you will get arrows going to distract the world over the blue and military for that.
And what you want to do is you need to create a configuration file that says no, uh, conflict.
Of the conflict.
Conflict, that agency.
And what you want to change is in the speech before you to change this value to all us.
So I have already changed previously to be mesmerized by the world.
You need to change the two of us, no contracts and could press that button to say, you know, after
that we need to restart the Apache Web server.
So to do that, you need to, uh, it see, you need the date, which is the initial demolitions and
scripts demand that will run the services like Apache, FPP, etc. and you need to set Apache reload.
So you need to see you need to be Apache to reload, to enter the Apache Observer.
We get shot at.
Now, I don't want to lose.
I want to go into a Web server browser and take the IP address of these matters where the.
So click on this multimedia.
And what you want to do is you need to kick this TV.
So it will are are the database's accordingly, I needed to go to the starting line action, action
that user for.
So now you're saying please enter username and password computers, so let's say Nicole and Nicole.
So it is bad from our past.
So before going into this election and I'll discuss you one concept that you said, we have already
discussed this in the previous video from the school basics.
But again, I want to explain it for you.
You start every from the stable where you constantly get ambassadors constantly.
So in the back inside, this query returns some values.
That means the rule of the table, which contains a username and password.
So that will be used by BHP or Python or any other bank and programming language, and that can be used
for authentication.
So this query simply accepts that data from the table where username and password is Kostunica.
So here the there is some misconfiguration.
And what you can do is instead of making what we can tailpiece, you can type a quotation marks and
then if you use it or.
Or else you can put the two hyphens in space so we know what this means, it will read the structure,
for example, that they were user name is called to blank.
And after this discovery gets truncated because in school, this is a common trait.
So if you type two hyphens in space, it will.
The other part of this query will not be construed into the query.
So now what I can do is before this comment, I can say, ah, we have already seen this are.
Ah, I will say one is equal to one.
So what this means is I can just simply place this value in that username feared and this word will
be sent into this username, so this quotation mark would already be there.
And what I want to send is only this one.
So if I send this, it will be placed in this username, uh, fear and on reading.
These are from various enemies close to blank.
And it will be treated as two conditions.
This is used in one condition or one is equal to one, which is true because one is equal to one.
Right.
And then this on seeing this comment, the rights are part of this comment will not will be ignored
because it's a common trait.
So you don't need to care about this and what this return is, it will return a true statement.
So if you are not taking these values into the user or any variable, if you are directly saying testing
this authentication with the query, then it will automatically allow our target.
So it does not check about the username and password if there is a bypassing authentication.
So if you like to put that you follow the state this statement is equal to true, then automatically
login will be successful.
So that's all you need to store it in variables if you do not convert was OK, this will bypass the
Reagan authentication.
I hope you have understood this syntax right.
It's a very simple username.
Feel you will put this value so that you get into this username, conditio so on.
Checking this, it will be divided into the two conditions, which is username and the order.
So this will be one is close to one, which is true.
Even though username is going too fast, we don't care because one condition is true, then the whole
class will be true.
And this is the comment we don't get.
So the entire statement becomes true.
And if you call it the pourri, then you will get automatically login.
So this is a basic of this connection.
Now, what I can do is I put the only current quotation.
So whenever I put the quotation and the computer's.
I get summaries, so generally you should not get this, but this is a practice mission.
We get letters in case if you see any websites, they get only this.
This is a good inquiry.
If even you get this message, it has some induction capabilities.
So as you can see, they have already told me start from accounts where Islam is close to passwords.
OK, now let me say this.
So on our back, there is a select start from accounts.
There is an account table.
They're sticking the username and the password.
So I think it's single.
So right now, it's been caught and gone this week on Luter's.
So it's a single condition.
And.
And pastor is called the single it's only today what the single condition, if that if single quotation
does not work, you can put that out.
It's not a big deal.
So this is a very low in our military.
OK, now what I will do is I will say no, I'm going to take this one in that username till nymphal
that or one is equal to one, which is true.
And I go to space and do the two I and offer this to her.
You need to put the space.
You must not forget the space of the two heavens to controversy.
Now it will be like using a musical stool, uh quotation quotation or one is close to one comment to
your candidates.
And as you can see, there are so many details of this and that there is.
So one thing you need to notice is even you have to start from accounts.
After getting the result, this BHP observer may filter some of these columns and display you only a
few columns.
Here I have Stalactite.
I have three columns use a certain signature.
These three are the columns and PSP man show you only these programs.
But in reality, we do not know how many columns this account will help.
So we need to find a number of columns in this account so so that we can execute some variables.
So what you can do is you can say, uh, union.
So this union statement I did not tell in this previous video.
So what this means is you need this union combines to reserves, but only when the two those columns
are equal.
So if you start from accounts and union structure from, uh, and other icons, uh, those two it was
must have the same column numbers, a number of columns.
So I say union noise.
It says that, oh, what I want to do is I don't know how many columns are there.
I simply said not and no.
I said hyphen open space.
Oh, let me copy this.
So what this means is.
Username is close to quotation, quotation and then Unions', when this condition fails, if the columns
of these account stable does not match us with our number of values, in this case, we are sending
we are getting Nannerl and if I can see the error, can see such statements have different number of
columns because there is already one select, which is from a table which says, say, X number of columns,
and here we are sending only one.
So let me increase the number of columns that's not null.
And there is no rule that you need to put the alternate.
You can put the numbers.
Also, according to the source, two columns are not sufficient.
We need to put the three more columns and columns.
So let me copy this, so now I am testing the trigrams, so it's also of tested for Gorham's.
So this is somewhat tedious task, but you need if you understand the background, you get easily.
So even that first.
OK, now let's put five columns.
Now, that's a controversial controversy.
Now let's review the candidates and there you can see there are five columns in the candidate tables
fight.
Columns in accounts.
But we are getting on it regardless, because this bank and BHP is filtering already for showing the
telecoms.
Now, what I can do is you can also put the numbers for easy understanding.
We can sell one comma to comma, three come up for.
And if you click on this, we are going through this and you can see username is close to two, password
three and signature for it means that this username is the second column of this account and the password
is the third column of the accountability and the signature is the fourth column of the accountable.
And we do not two columns do the first column and the fifth column.
So two, three, four columns are not.
Now what but one thing we can do is we can get the version number of this database, so there are five
columns right now.
What I can do is one comma.
So if we if we want to display any information, you need to send the information already in these two,
three, four words because those values will be displayed in our output.
That's it.
This is a user facing I need to put the small letters, let's say user function.
And this user function indicates that current username the service is running on and I consider it a
direct Russian.
So now I can tell you this, we are doing we are asking for a user and that version of this obscure
database, as you can see, our killer, our user is rude at the local hospital.
And you can see the version of this, uh, school, uh, database is Very 051.
I want to the concert for this.
And as you can see, if I don't like this, I automatically got some, uh, vulnerabilities related
to this version number so I can just go out and on one of these vulnerabilities.
And even if I have all the luck, I can find them in my.
So we got that username and the, uh, the user and what's number and.
What you can do is you can also
load the file into police played into this, uh, our output Årets.
I'm going the top under the tree, I don't know in which the tree as schools are, Otis, I could just
go to the tree and I said, seat.
So it's possibly.
I'm going to I'm trying to view it, see positively fail, so they'll give.
We got the information of this positively and you can see if there are any users within all of us or
are just anonymous login.
Then you can see you got logged into the system using the username.
As you can see, user is encrypted.
All right, now, I think we do not get any information, but you can see the services that will prove
to be resolver and you can just Google for any of regarding that.
So I think that's all about this union base as good indications.
I hope you have understood.
We are just coming by.
We are up to now.
Let's raise what we have done.
We are sending this, uh, like a quotation.
Ah, which divides the one condition into two conditions.
And we are making it through and then we are getting the information from the, uh, Web server and
then we are just finding a number of columns using this, uh, one, two, three, four, five, six,
or we can keep the null.
And then knowing the columns, we can learn which columns are displayed in this account.
And then we are asking some information.
We got this I got this login page.
Now let's reconsider our previous example and know what you're going to restructure from a sample table.
Let's assume this is a sample table and say name and the parcel right where we have got the username
and password.
So to bypass this authentication, we need to you should not comment because it will take for the password
also.
And then, uh, OK, we need we can also put the comment.
OK, let me try that one also.
OK, first, generally
this will be the username field and what I keep in this user, uh, username is I put the current to
make sure that this is one condition and then I put the R because I want to put the true condition here
so that this condition all becomes true.
And let's say let's use the strings.
No.
One is he calls to.
So I need to put another quotation, because there is already a quotation that is belongs to this username.
So let me.
So now it will be like this username is going to blank or one is equal to one, which becomes true.
So I will reward this.
So this is the username for the guys in the previous video, we have both at the same time, but in
this video we have to fear is a right name and the password.
So it's being checked two times.
I can simply copy paste this or whatever.
I put the username, I can just copy paste enough password filters and there you go.
You can just simply paste this and you can try to again.
So let me take this.
No, I'm giving a condition.
Because we didn't use them in the past and they you can see we have been successfully constructing as.
And I'd been amazed monkey.
OK, so this is all about this bypassing other using this our base is a good indication.
So I hope you have understood we just like in the previous case scenario, we just what we are done
is we have to change it to shrink so that we do not get any conversions when we send the data.
So that's all we did.
But it's for two times when you saw username and password, if it's successful for you, it will be
so successful for the password.