And all of the lectures so far, we were exploiting ESKIL injections manually, so we were injecting
the code into the URL or into the text boxes.
And this video, I'm going to show you a tool called Ezekial Map, which allows you to do everything
we learned so far and even more stuff.
This tool can be used against my Ezekial databases, which is one that we were having the example on.
It can also be used against Microsoft, Ezekial, Oracle and other database types.
The tool is very useful and is very handy in many cases.
Sometimes the injections aren't as nice as the one we see.
Sometimes you only get one output for each record and you have to look through all the outputs so the
tool can automate that and just do everything for you, much easier and much simpler.
So let's, first of all, get the URL that we were using for the injection, so I have that text file
here that we were using and I have the URL that we were using before.
So the user info, the user name is admin password admin pass.
You don't really need to know the username and password.
So I'm actually just going to put anything here.
So just assume that we don't know the password.
So we're only injecting squirrelled injections.
We don't really need to know any of this stuff.
I'm going to do is copy this.
And then I'm going to run a scale mob.
And I'm going to do you specify the URL and I'll put my target.
And I'm going to make sure that I have a choice between two quotation marks so that it doesn't ignore
anything and any signs in the middle.
So we have some signs and characters in the middle that I wanted to all be treated as one year out.
So all I did is Eskil, my view, my target, when I'm going to hit enter and it automatically look
through all the parameters.
So it's going to look through the user info, through the user name and password to see if any of them
is injectable.
And then once it does, that is going to start in its memory.
So it's going to know that this is injectable and then will be able to further exploit the target.
So as you can see now, it's thinking that our target could be MySQL or PostgreSQL.
It's asking me if I if it should skip other tests.
And I'm going to say yes, because I know it's my skill.
And now it's asking me if it should do all the tests for both databases and I'm going to say yes, assuming
that I'm not sure which one it is, I know it's my skill, but I'm just going to let it do its thing
and we'll see if it can do it properly or not.
So at the moment is checking if it's PostgreSQL.
And I'm assuming it's going to.
No, that's not and then we're going to it's going to know that it's my Ezekial.
It just found out that the username seems to be injectable.
And sure enough, it's still not clear that the parameter username is vulnerable and we can inject it.
So it's asking me, do I want to check the other parameters, such as the password and all of them?
I can say yes and to do it, but I'm going to say no, because I don't mind if it just uses the username
for the injection.
So it's all good.
Now, Ezekial Mark knows that the target is injectable and it knows that it's going to use the username
parameter to inject stuff.
And I can see that it's figured out that it's running Linux, Ubuntu, and it's figured out that it's
using HP with Apache to point to point eight and it's using my ESKILD server as the database server.
So that's from Ezekial, my help and see what we can do now.
Now, this tool is really big and it allows you to do a lot of things.
So in this video, I'm actually just going to show you a quick look on the video and.
I recommend you spend more time with it and try to see what else you can do with it.
OK, so let's try to get the current user and we're going to try to get the current database.
So we're going to use the same camera that we used before and I'm just going to add to it.
DBI aims to get the current database's.
Or DHBs, sorry.
As you can see, we got all the database that we have, so we have D.V., the way we have information
schema us, Floyd, my school, our top 10, which was the one that we were exploited before antiquity.
Now, if we do current user.
You can see that we are rude and if I do care and database.
We'll see that our top 10 is our current database.
So now let's try to get the tables for our top 10.
So remember when we did select table name from information schema, the tables where table name were
table schema is equal to ours.
We're going to do we're going to let us open up to all of that for us.
And so the command is going to be we're going to ask you to get all the tables for us and we're going
to use the option to specify the database.
And our database is going to be called outstand.
And as you can see, it got us all the tables that exist and remember, it's the same we got accounts,
blog stable and the credit cards as well.
And now if we want to get the columns, then we can use the same command again and we're going to say,
get me the columns.
Where the table is called accounts and the database is ours 10.
And right here, we can see that we got the columns, so we have these admin password and username and
we can get the data.
Using the dump option.
So it's the same command that we used before, so we're getting the from the table that's called accounts
and the database that is called outstand, I want you to get me all the data.
And here we go.
We got all the data, we have the admin, it's password admin pass and we have Adrian.
And his password is some password.
And we got all the data right here.
So I it as I said, it was very useful.
It can be used to make our life much easier and it does everything automatically and it can do everything
we did and it can even do more stuff.