OK, now I'd like to show you an actual injection and then the different file and different page, and
I'll show you a few different things that you can do to exploit that vulnerability.
So the first thing I'm going to go to the login page, which is in here, user info.
So the first time I went to the login page from there, this time I went to the user info page.
So this this page will show you the information about the user provided you give the username and password.
So I'm going to do that and I'm going to put my password.
One, two, three, four, five, six.
And it'll show my details, username and password.
And my signature is a.
So the statement that's been executed here is similar to what was being executed when you log in, so
it's selecting staff from accounts where username is what you put in the user field and password is
what you put in the password field.
So what we're going to do now is we're going to see a different way of exploiting this kind of vulnerability.
In the previous video, we are doing it using a post text textbooks.
So whatever you put in the text box was being posted using a post method to the Web application.
Now, these vulnerabilities can exist.
And to get and what I mean by that is when you do I get when something is sent as get, you will see
it here in the URL.
So if you look at the URL here, you see it's being sent as the username and password.
One, two, three, four, five, six.
So let me just copy this earlier.
And we'll start playing with it from the URL and instead of doing it on the Web page.
I just want to show you a different example, because in many places there might not even be text boxes,
for example, it could be something like news and news that so we can see here, for example, in this
example, it's indexed.
And in your testing, you might see something like and use that BHP and for example, it is equal to
two and then you can try to inject stuff in there.
So we're having an example here where we're going to be injecting things into the user name field,
which is this field, and we're going to be injecting stuff in here.
So any time when you're doing your test, any time you see parameters like this, you should try to
inject them.
Any time you see something that and then you have a parameter equals something that always try to inject
stuff in there and see if it works for you.
So we also seen a way of discovering the injection and that was using the quotation mark and using the.
And so we do a false and a and and one is equal to one and then and one is equal to two.
And if the server is executed what we want, then we're going to know that there is an ESKIL injection.
I'm going to show you another way of discovering these exploits and it's using the order by, as the
name suggests, the order by statement is used to order the results that we get on the screen based
on a specific column.
So our injection is going to be like this.
So I'm going to do.
Or there by.
One, so this if if the injection exists, this should work because in each select statement, there
should be at least one column is being selected.
Therefore, when we say order by one, we're saying I want to order the results based on the first column.
Therefore, this should always be acceptable by the database and return a true or something that we
expect.
We also need to add the comment in here and execute this code, so it's exactly like before.
So when we doing this basically.
This is our URL and what's going to happen on the database, so this is the code that's been executed
on the database.
It's going to look like this.
So it's going to be select star from my cancer usernames equal to Zayde and note how this is closing
the quote and we're going to do an order by.
One, and there should be this code here for the end, and this comment comment will tell the school
interpreter that to ignore anything that comes in after it.
So all this is going to be ignored.
So I'm hoping this.
So you can actually paste this injection for Zade order by one into the name right here, and that's
going to work.
But again, I just want to show you a different way of doing it by injecting it through the browser.
Another thing that I want you to note is when you're injecting stuff into the browser, the browser,
the code should be encoded.
So, for example, this sign, usually when you put it on the URL, it should be written as percentage
23 spaces.
For example, get converted to percentage 20 and percentage 23 is the comment that we're using.
So I'm going to copy that and replace my comment sign with it.
Now you can Google HTP encoder and you'll see online there's online tools that will just convert this
for you, for me.
Now I know that the hashtag can be converted to percentage twenty three.
So that's why I'm using it there.
And I'm going to hit enter.
And as you can see, now, we're seeing something that's acceptable.
Nothing wrong, and then it's shown me the information about Z one, two, three, four, five, six,
and showing me the signature.
So it is ignoring the password.
So the injection worked and it's ordering by one.
So it's not showing me anything wrong.
Let's try to make this, number one, a very large number.
So put in 10000 or 100000 now.
So what we're seeing right now is I want you to order the results that will be returned by the current
select statement based on column 100000.
Now, chances are there aren't 100000 columns used in this select statement, and therefore this should
return an error.
So when I execute this, you'll see that there is an error and the error is in the order close.
And it's telling us that there is an unknown column for 100000 and this is great, because now we know
that the database is executing what we want.
So when we told it to order the results based on the first column, it showed us results.
So it followed what we told it.
And then when we told it to order the results based on a column that does not exist, it gave us an
error.
So it's obviously vulnerable to ESKIL injections.