Now we've seen how to extract data using an injection, you can increase security to level one, but
you can exploit this exactly the same way that you exploited level zero.
And if you increase the security level to five, it's actually very secure.
It's going to be as secure as the Web in that we see in the log and bypass or uses the MySQL Escape
real escape strength combined with single quotes and double quotes.
So it's pretty much on injectable.
Well, I want to show you in this lecture is a trickier Ezekial injection and I'm going to show you
that in the video instead of Mattilda.
So I'm going to close this.
And we're here at DPW and I'm just going to go down to the security level and I'll make sure that that's
set to low.
Now, I'm actually interested into the medium level, but I'm going to show you how to exploit this
in the low level just so that the information flows properly.
So I'm going to go to the Ezekial injection and I'm just going to put no one in here.
Now, as you can see, we get a average page giving us the first name and the surname of the user that
we are given.
Now, I can inject this in the post, in the box or here in the URL, and I'm going to inject it into
the URL and I'm going to put a single quote here.
And as you can see, we get an error telling us that there's an error in the statement, which means
that there is an Ezekial injection here, we can verify it by adding a true statement saying and one
is equal to one, which should give me I actually forgot to add my comment here.
So I'm just going to add the comment.
So the true statement should actually give me a normal, valid webpage like we see here, so it's given
us the first name and the second name properly.
Now, if I say one is equal to zero, which is an invalid, should give me an invalid page.
And here we go.
We are getting an invalid page, which which means that the ID parameter here is injectable and the
page is doing what we're asking you to do.
We can also verify this using the order by one and then we can say ordered by a very large number and
should give us an invalid page.
And here we go, that's dumb is this Web page is definitely vulnerable to Ezekial injections.
Now, I'm going to try to determine the number of columns I'm going to put three.
And this is telling us on an unknown column.
Let's try to put to.
And the page is valid, so that means we have two columns in this page so we can build our union select
statement.
Now you can see I'm actually actually have them built already and I'm able to select everything, but
I just want to show it to you again.
So I'm just going to build the union select statement with you actually here, so I'm just going to
say union select one to.
And we can see that we can display stuff and one and into so I'm going to select the database and one.
And we can see that my database name is DPW, so I can go ahead and try to select all the tables using
my information schema database.
So the query is going to be very similar to the way we run here with DV.
The only difference is that the table schema is going to be said to give it instead of 10.
So I'm going to start here and as you can see, I can get my tables, which is Guestbook and users.
Now we can go ahead and try to select and find the columns for each of these tables using the same statement
that we used in the previous lecture.
I'm not going to run it now because I've already run it.
And if the if the table statements, right.
Then the columns tables are going to run.
So I've already found that there is a user username and password column in the user's table.
And I'm just going to run this statement to select the username and password.
Just to show you what's going to happen.
And as you can see, we can select the usernames and passwords for all the users that we have in the
users table.
Now, I'm actually not interested into any of this because we've done all of that before with Matilda.
Well, I want to show you is how to run these statements with the medium security level.
So I just wanted to do this to show you how it works on the low.
Now, I'm going to go ahead and change the security level to medium.
And now I can go to a secure injection.
OK, and we're going to try to discover it the same way that we did before, so I'm going to put number
one first to see a valid page and this is a valid page.
Now, I'm going to try to put a single quote after the one.
And as you can see now, we're getting an error.
But this error is different.
It's actually complaining about the existence of the single quote.
So let's try to put an end.
We've got to put and one is equal to one like we did before.
And close it with our comment.
And this should actually show us Violet Page, but as you can see now, it's not showing us a valid
page.
It's actually still giving us an invalid page, even though we said one is equal to one, which it shouldn't
affect our statement or our query.
So let's try to put the TTP code for the quote instead of using a quote.
So I'm going to put percentage 27 and see if that will bypass any security maybe they're using.
And again, I'm still getting the same or same problem, still complaining about the quote.
So let's try and play more with this now, as I said, exploiting skill injections can vary from website
to website depending on the way it's implemented.
So there is a lot of trial and error in this.
So let's try and remove the quotes and see if that'll actually fix our problem and make it injectable.
Great, now this has given us a valid Fage, now let's try to change it and say one is equal to two
and see what happens.
And yet this has given us an invalid page, so the website is responding to what we are saying.
The only difference now is that we're not using the quote, we're just injecting it straight away.
After the ID, after the No.
OK, so let's go ahead and try to build our union select, so I'm going to type in union select one
to.
And yep, that looks like we can write stuff in number one and number two, so let's try to select table
name.
From information schema, the tables like we always do, just to get all the tables that we need.
And here we go, we're getting all the tables just like we got them before.