Instructor: Now to try and discover SQL injections, 2 2
you need to browse through your target 3 3
and try to break each page. 4 4
So whenever you see a text box 5 5
or a parameter on this form for example, 6 6
page.php then somethings equal to something, 7 7
try to inject stuff here. 8 8
So try to use a single quote, 9 9
try to use an and, or the order by statement, 10 10
to break the page and make it look different. 11 11
So, I'm gonna show you here an example. 12 12
And I'm gonna go in to the login page first, right here. 13 13
And its asking me to log in now. 14 14
But I actually registered with my own name. 15 15
So you can just go in here and register. 16 16
I have a username called Zaid 17 17
and a password with one two three four five six. 18 18
So first, let's just... 19 19
I'm gonna log in just to show you, so. 20 20
My username is Zaid 21 21
and my password is one two three four five six. 22 22
And now I'm logged in as Zaid 23 23
and my signature was aa. 24 24
Its just nothing really, just like as a test. 25 25
So I'm gonna log out 26 26
and we're back at the login page. 27 27
Right here, we have the page 28 28
so you can try to inject in that. 29 29
But we will get into that later, so. 30 30
At the moment, 31 31
we're having an example of injecting into text boxes. 32 32
So you can try to inject into the name 33 33
and into the password. 34 34
So I'm gonna put my name as Zaid 35 35
and I'm gonna put a single quote. 36 36
So I'm putting this sign into my password. 37 37
So let's see if we can break it. 38 38
And as you can see now, 39 39
there's an error being displayed to us. 40 40
And it doesn't look like a normal error, 41 41
it looks like it's a database error. 42 42
And usually you will be very lucky 43 43
if you get an error like this. 44 44
Now usually the error won't be as informative as this. 45 45
Sometimes you'll just see that the page 46 46
is not acting as it's expected, 47 47
as you expect it. 48 48
Sometimes it'll just be a page 49 49
that does not look as it should. 50 50
For example, if it's a news page, 51 51
maybe it'll have the article missing 52 52
or if it's a blog, it'll have one of the posts missing 53 53
or different kind of posts. 54 54
So you need to keep an eye on what's changing. 55 55
In this example, we're actually getting a really nice error. 56 56
Its telling us which file it has, 57 57
and its telling us that there's an error in the statement. 58 58
And the error near the quotation mark that we added. 59 59
And it also tells us the statement that's being executed. 60 60
This is really good for learning. 61 61
Cause now we can see what's the statement, 62 62
that the system is trying to run. 63 63
And the systems trying to do a select *. 64 64
So it's trying to select everything from accounts, 65 65
where the username is equal to Zaid 66 66
and the password is equal to a single quote. 67 67
And note that the system 68 68
the web application is already 69 69
adding quotes around the name. 70 70
So when I said Zaid, it added Zaid between two quotes. 71 71
And it added the single quote 72 72
that I added between another two quotes. 73 73
So that's why we have three quotes right here. 74 74
So from this we can, 75 75
its like 70% of the target website, 76 76
has an SQL injection. 77 77
We're still not sure 78 78
if it can execute what we want it to do. 79 79
So can I actually inject code 80 80
and get It to be executed? 81 81
Let's see if we can do that. 82 82
So username is gonna be Zaid again. 83 83
And what I'm gonna do with the password, 84 84
I'm going to put my password. 85 85
So I'm gonna put one two three four five six 86 86
and then I'm closing it. 87 87
So I'll tell you why I'm closing it, 88 88
because the current statement through the system 89 89
is select * from, 90 90
to Zaid and, 91 91
is equal to. 92 92
And its gonna open a single quote by itself. 93 93
So lets call this S password. 94 94
So we're treating this a variable. 95 95
And it takes in whatever I put in here, 96 96
whatever I'm gonna put in this box. 97 97
And its gonna insert it instead of the S password, 98 98
which is a variable. 99 99
So I'm just giving you an idea, 100 100
so you need to be able to imagine this happening. 101 101
So its taking whatever I put in there, 102 102
and its gonna put it between two single quotes. 103 103
And its gonna be inserted in there, 104 104
and executed on the system. 105 105
So what I'm doing is, 106 106
I'm gonna put one two three four five six 107 107
and I'm gonna add the quote myself. 108 108
So what I'm gonna do right now, 109 109
the code is gonna be like this. 110 110
So its gonna select this, 111 111
and password is equal to that. 112 112
And I have two quotes right now, okay. 113 113
And then what I'm going to do is, 114 114
I'm gonna say and, 115 115
one is equal to one. 116 116
So one is equal to one. 117 117
And I'm just trying to see 118 118
if its going to execute what I want it to do. 119 119
So my statement right now is, 120 120
its gonna be Select * from accounts, 121 121
where username is equal to Zaid 122 122
and password is equal to one two three four five six. 123 123
And note, I'm gonna be inserting this myself, 124 124
and ones equal to one. 125 125
One problem that the system is gonna complain about, 126 126
is that we have an extra quote here, 127 127
because I'm gonna be inserting this myself in the text box. 128 128
So it's gonna be complaining about this, 129 129
it's gonna say this is an open code 130 130
and never be has been closed. 131 131
So what I'm gonna do is I'm gonna add the comment. 132 132
And when you add a comment, 133 133
basically everything that comes in after the comment 134 134
will not be executed. 135 135
I'm gonna use the hash as the comment. 136 136
So anything that comes in after the hash 137 137
the system is gonna ignore. 138 138
So I'm gonna inject now is gonna be this, 139 139
and one's equal to one and this, 140 140
so as I said, usually what you have here, 141 141
you have slashed your password, 142 142
or depending on what the program are called it, 143 143
for just imagining this. 144 144
And I'm gonna be inserting this inside. 145 145
So when you do that, and you insert it inside, 146 146
this is what the code is gonna look like. 147 147
So it's gonna look like the right username, 148 148
the right password, 149 149
and one is equal to one, which is true. 150 150
And then it's not gonna, 151 151
it's gonna ignore this quote right here. 152 152
So if we paste this, 153 153
we should be able to login. 154 154
It should allow me to login. 155 155
And perfect we were able to login and username is Zaid. 156 156
So far, we haven't done anything. 157 157
But this kind of shows us that is it running our code? 158 158
Let's try a different thing. 159 159
Now, let's try to add a false statement. 160 160
So we did we did one equal one, 161 161
and that was correct and it executed when we wanted. 162 162
Let's try one equals two. 163 163
And this is false. 164 164
So I have the right password. 165 165
And I have the right username, 166 166
and one is equal to two. 167 167
And this should be wrong 'cause it's false 168 168
one is not equal to two 169 169
and I'm using an and so everything has to be true. 170 170
So it should give me an error 171 171
even though I'm gonna put the right username, 172 172
and I'm gonna put the right password. 173 173
So I'm putting one two three four five six 174 174
and one's equal to two. 175 175
So it's gonna be like, oh, this is wrong. 176 176
And as you can see it's given me an authentication error, 177 177
bad username or password, 178 178
even though I'm given the right password 179 179
and the right username. 180 180
So this confirms that this website is actually injecting 181 181
anything we want in the password. 182 182
So we can use the password field to inject SQL code. 183 183
And it's always gonna be on this form. 184 184
So we're gonna put a password 185 185
and you're going to put your code here, 186 186
so I'm just gonna put it in capital code here. 187 187
Because we're gonna put a password, close the quote, 188 188
and then put the code that we want to execute 189 189
on the system right here, 190 190
and it's going to be executed on the target system.