Now, to try and discover Ezekial injections, you need to browse through your target and try to break
each page.
So whenever you see a text box or a parameter on this forum, for example, page B, then something
is equal to something.
Try to inject stuff here.
So try to use a single quote, try to use Annand or the order by statement to break the page and make
it look different.
So I'm going to show you here an example and I'm going to go into the login page first right here.
And it's asking me to log in now, I've actually registered with my own name so you can just go in here
and register.
I have a username called Zayde and a password with one, two, three, four, five, six.
So first, let's just I'm going to log in just to show you.
So my username is Z and my password is one, two, three, four, five, six.
And now I'm logged in Azad and my signature was just not really just like as a text.
So I'm going to log out and we're back at the log in page.
All right, here we have the page so you can try to inject in that, but we'll get into that later.
So at the moment, we're having an example of injecting into text boxes so you can try to inject into
the name and into the password.
So I'm going to put my name aside and I'm going to put a single quote.
So I'm putting this sign into my password.
So let's see if we can break it.
And as you can see now, there is an error being displayed to us and it doesn't look like a normal error.
It looks like it's a database error.
And usually you'd be very lucky if you get an error like this.
Now, usually the error won't be as informative as this.
Sometimes you'll just see that the page is not acting as it's expected, as you expected.
Sometimes it will just be a page that is not does not look as it should.
For example, if it's a news page, maybe it will have the article missing, or if it's a blog, it
will have one of the posts missing or different kind of posts.
So you need to keep an eye on what's changing.
And this example, we are actually getting a really nice error else, which while it has and it's telling
us that there is an error in the statement, the error near the quotation marks that we added.
And it also tells us the statement that's been executed, this is really good for learning because now
we can see what's the statement that the system is trying to run and the system is trying to do a select
star.
So is trying to select everything from accounts where the username is equal to Zayde and the password
is equal to a single quote.
And note that the system, the Web application is already out in quotes around the names.
So when I said Zayde at other jail between two quotes and added the single quote that I added between
another two quotes.
So that's why we have three quotes right here.
So from this we can it's like 70 percent of the target website has an actual injection.
We're still not sure if it can execute what we wanted to do.
So can I actually inject code and get it to be executed?
Let's see if we can do that.
So the user name is going to be Zade again.
And what I'm going to do with the password, I'm going to put my password, so I'm going to put one,
two, three, four, five, six.
And then I'm closing it, so I'll tell you why I'm closing it, because the current statement in the
system is its select.
Staff from.
To Zaid.
And.
Is equal to and is going to open a single court by itself.
So let's call this as password's, so we're treating this as a variable and it takes in whatever I put
in here, whatever I'm going to put in this box and it's going to insert it instead of the password,
which is a variable.
So I'm just giving you an idea.
So you need to be able to imagine this happening.
So that's taking whatever I put in there and is going to put it between two single codes and it's going
to be inserted in there and executed on the system.
So what I'm doing is I'm going to put one, two, three, four, five, six, and I'm going to add the
quote myself.
So I'm going to do right now, the code is going to be like this.
So it's going to like this.
And password is equal to that.
And I have two quotes right now, OK?
And then what I'm going to do is I'm going to say and.
One is equal.
Two, one.
So one is equal to one, and I'm just trying to see if it's going to execute what I want it to do.
So my statement right now is it's going to be select, start from accounts, count where username is
equal to zayde and password is equal to one, two, three, four, five, six.
And now I'm going to be inserting this myself.
And one is equal to one.
One problem that the system is going to complain about is that we have an extra quote here, because
I'm going to be inserting this myself into the text box.
So it's going to be complaining about this.
It's going to say this.
This is an open code and it's never has been closed.
So what I'm going to do is I'm going to add the comment.
And when you add a comment, basically everything that comes in after the comment will not be executed.
I'm going to use the hash as the comment, so anything that comes in after the hash the system is going
to ignore, so I'm going to inject now is going to be this and one is equal to one and this.
So, as I said, usually what you have here.
You have your password.
Or depending on what the programmer called it, but we're just imagining this and I'm going to be inserting
this inside.
So when you do that and you inserted inside, this is what the code is going to look like.
So it's going to look like the right username, the right password.
And one is equal to one, which is true.
And then it's not going to it's going to ignore this quote right here.
So if we paste this, we should be able to log in.
It should allow me to log in.
And perfect.
We were able to log in and username ESADE.
So far we haven't done anything.
But this kind of shows us that is it running our code?
Let's try a different thing now.
Let's try to add a false statement.
So all we did, we did one equal one, and that was correct and it executed when we wanted.
Let's try one equals two and this is false.
So I have the right password and I have the right username, but I do.
And one is equal to two.
And this should be wrong because it's false.
One is not equal to two and I'm using it.
And so everything has to be true.
So it should give me an error, even though I'm going to put the right username and I'm going to put
the right password, so I'm put in one, two, three, four, five, six, and one is equal to two.
So it's going to be like, oh, this is wrong.
And as you can see, it's given me an authentication error by username or password, even though I'm
given the right the right password and the right username.
So this confirms that this website is actually injecting anything we want in the password so we can
use the password field to inject as QR code.
And it's always going to be on this form.
So we're going to put a password and you're going to put your code here.
So I'm just going to put it in capital code here because we're going to put a password, close the quote,
and then put the code that we want to execute on the system right here.
And it's going to be executed on the target system.