In this lecture, I would like to cover a case that I faced in pretty much 50 percent of the websites
that I do penetration testing on.
So let me first just run and exploit the one that we've already seen.
So we're just going to run this statement, which will select the table name from information schemata
tables.
So this should list all the tables that exist within our page.
And I have my security set too low at the moment, so I'm just going to start that here.
Remove this extra one and hit enter.
As you can see, it gets exploited and it shows us the table name here instead of number one.
So we see all the table names that exist within this current database.
Now, the case that I'd like to cover is when you actually run the statement, so the website will be
vulnerable and when you run the statement, you will only see one result at a time.
And that's because the page is programmed in a way to display only one result at a time.
To do this, we're actually going to need to modify the code for the low security level for DPW.
I will do that now and then we'll come back to exploit it.
So I'm actually just going to modify the code for DPW.
This is not part of the exploitation.
This is just to make this exploit a little bit trickier.
So Mr. Meet Exploitable now, and I'm going to open the low security level of the Ezekial injection
file, so I'm going to use Sudo because the file has root permissions and I'm going to use Nano as the
text editor.
So this is the program that we'll use to modify the file and the file is stored in.
The w w w w a vulnerability's Eskil injection.
Source and then follow that up.
So, again, I'm just going to go through this.
Come on.
So what we're doing is we're saying pseudo to run the file in privileges.
Nano is the program that we're going to open the file with.
And then the file is stored and by there will be vulnerabilities as kuli source load.
I'm going to hit enter.
And asking me for the admin password now the root password is Ms admin exactly like the username.
And.
We have the source here for the file, so I'm going to modify here, I'm actually going to modify this
loop.
So what this loop does, it actually loops through all the characters, all the records that this Ezekial
statement gets right here and then it displays them on screen.
So what we want is we want to modify it to only display one result, the first result.
So I'm just going to comment this line to forward Slash's other comment.
So basically, this line will be ignored.
And I'll also come at this one because it closes the wire loop, so this line would be ignored as well.
Now, you don't really need to care to worry about what this means if you're not a programmer, it's
not very important.
Just comment these lines and we'll see what happens at the client site because, well, what we're interested
in this lecture is not the programming we're interested in to the penetration testing.
So I'm just going to hit control to save this.
I'm going to hit Y and enter and that's it.
And save the file.
So we're back here and I'm going to run exactly the same statement, so I'm not going to modify it.
So I'm still saying union selectable name from information schemata tables.
I'm actually going to refresh the page.
And as you can see now, this is not really working, nor is it working, but it's only showing us the
first the first record that's been selected, which is the American.
So this is not even useful.
So the first thing that I'm going to do is this is bringing us the Army record because the admin has
the ID of no one.
So we're going to do now is we're actually just going to give it an invalid I.D. So I'm going to give
it a minus one.
As you can see now, the statement works, we're getting a table that exists in the information scheme
at our tables, but we're only getting one table at a time.
We're not getting the full list of the tables.
And this is because the page is programmed in a way that will only display one result.
And this happened to me a lot of a lot of times when I'm doing penetration testing.
So keep in mind that we can run any Ezekial statement that we want on the tape, on the server so we
can modify our skill statement to iterate over all the records and display their content.
So what we're going to do is we're going to now, obviously, you can use the word statement to on this
show database tables within your current database.
But at the at the at the moment, I want to show you how it how to iterate over all the tables.
So what we're going to do instead is use the limited keyword to specify which record we want to display
with the current statement.
This way we'll be able to iterate over the records one by one and display all of them.
So the statement is going to be union select table name from information, scheme the tables, and we're
going to say I want to limit and the limit keyword teach to values.
The first value is the location of the record that we want to start displaying records from.
So where we want to start displaying records.
So I want to start displaying records from the first record, so I'm going to put zero because the record
numbers start at zero.
And the second value that the limit keyword takes is the number of records that we want to display on
screen, starting at the value that we specified in here.
Now we know that this page right here can only show me one record at a time.
So the second value to the limited keyword can only be won in this case.
So basically what we're saying is we want to select the table name from the information schema that
tables.
And I only want you to display one record starting from record zero.
So if I copy this.
And pasted here.
You'll see, I'll get the first table right now, and then if I want to go to the second table, all
I have to do is modify this.
So like I said, this value the first value in here means I want to start at record zero.
So if I want to start at record one, I'm just going to put one and then I can copy this.
And paste it up in here again.
And as you can see, we got the next table now, again, if I want to get the table after this, all
I have to do is modify this and set it to two.
And that means that I want to start this plane from record to and I only want to start to display one
record again if I hit enter.
As you can see, I'm getting the next table and I can keep doing this to iterate over all the records
manually.
Now, we can also enhance the statement by using the word close, so before the limit, we can say I
want to select table name from information schemata tables where tables schema.
Is equal to DV w a.
And now if we paste this in here.
As you can see, this is showing me the users and again, I can iterate over the tables by changing
the number here.
So this is displaying the record at offset one.
I can set this to zero to display the first record.
And as you can see, the first table or the first record is Guestbook, and that's it.
So just a quick and nice lecture to show you how to bypass this problem.
If you face it in pages, that would only display one value or one record for you at a time.