Instructor: Okay, now I'd like to show you 2 2
an SQL injection and in a different file 3 3
and in different page 4 4
and I'll show you a few different things 5 5
that you can do to exploit the vulnerability. 6 6
So the first thing I'm going to go to the login page 7 7
which is in here. 8 8
User Info. 9 9
So the first time we went to the Login page from there, 10 10
this time we went to the User Info page. 11 11
So this page will show you the information 12 12
about the user provided you give the username and password. 13 13
So I'm gonna do zaid 14 14
and I'm gonna put my password, 123456. 15 15
And it'll show my details, username and password 16 16
and my signature as aa. 17 17
So the statement that's being executed here 18 18
is similar to what was being executed 19 19
when you log in. 20 20
So selecting star from accounts 21 21
where username is what you put in the user field 22 22
and password is what you put in the password field. 23 23
So what we're going to do now 24 24
is we're going to see a different way 25 25
of exploiting this kind of vulnerability. 26 26
In the previous video, 27 27
we were doing it using a POST text box. 28 28
So whatever you put in the text box 29 29
was being posted using a POST method to the web application. 30 30
Now, these vulnerabilities can exist into GET. 31 31
And what I mean by Get, 32 32
is when you do a Get when something is sent as GET, 33 33
you will see it here in the URL. 34 34
So if you look at the URL here, 35 35
you see it's being sent as the username zaid 36 36
and password 123456. 37 37
So let me just copy this URL here. 38 38
And we'll start playing with it 39 39
from the URL instead of doing it on the web page. 40 40
I just wanna show you a different example 41 41
'cause in many places, 42 42
there might not even be text boxes, 43 43
for example, it could be something like news 44 44
and news.php, so we can see here, for example, 45 45
in this example, it's index.php. 46 46
And in your pen testing, 47 47
you might see something like news.php 48 48
and for example, id is equal to two 49 49
and then you can try to inject stuff in there. 50 50
So we're having an example here 51 51
where we're gonna be injecting things 52 52
into the username field which is this field 53 53
and we're gonna be injecting stuff in here. 54 54
So any time when you're doing your pen test, 55 55
any time you see parameters like this, 56 56
you should try to inject them. 57 57
Anytime you see something .php 58 58
and then you have a parameter equals something, 59 59
then always try to inject stuff in there 60 60
and see if it works for you. 61 61
So we've also seen a way of discovering the injection 62 62
and that was using the quotation mark 63 63
and using the and. 64 64
So we do a false and a true and 65 65
and one is equal to one 66 66
and then and one is equal to two 67 67
and if the server is executing what we want, 68 68
then we're gonna know that there's an SQL injection. 69 69
I'm gonna show you another way 70 70
of discovering these exploits 71 71
and it's using the order by. 72 72
As the name suggests, 73 73
the order by statement is used 74 74
to order the results that we get on the screen based 75 75
on a specific column. 76 76
So our injection's going to be like this. 77 77
So I'm gonna do order by one. 78 78
So this, if the injection exists, 79 79
this should work 80 80
because in each select statement, 81 81
there should be at least one column is being selected. 82 82
Therefore when we say order by one, 83 83
we're saying I want to order the results based 84 84
on the first column, 85 85
therefore, this should always be acceptable 86 86
by the database. 87 87
And return a true or something that we expect. 88 88
We also need to add the comment in here 89 89
and execute this code. 90 90
So it's exactly like before. 91 91
So when we're doing this, 92 92
basically this is our URL 93 93
and what's gonna happen on the database, 94 94
so this is the code that's being executed 95 95
on the database, it's going to look like this. 96 96
So it's gonna be select star from accounts 97 97
where username is equal to zaid 98 98
and note how this is closing the quote 99 99
and we're gonna do an order by one 100 100
and there shouldn't be this code for the and, 101 101
and this comment will tell the SQL interpreter 102 102
to ignore anything that comes in after it 103 103
so all of this is going to be ignored. 104 104
So I'm copying this. 105 105
So you can actually paste this injection 106 106
for zaid order by one 107 107
into the name right here and that's gonna work 108 108
but again, I just wanna show you a different way 109 109
of doing it by injecting it through the browser. 110 110
Another thing that I want you to note 111 111
is when you're injecting stuff 112 112
into the browser, the browser, the code should be encoded. 113 113
So for example, this sign usually, 114 114
when you put it on the URL, 115 115
it should be written as %23. 116 116
Spaces, for example, get converted to %20 117 117
and %23 is the comment that we're using. 118 118
So I'm gonna copy that and replace my comment sign with it. 119 119
Now, you can google HTTP Encoder 120 120
and you'll see online there's online tools 121 121
that'll just convert this for you. 122 122
For me now I know that the hashtag 123 123
can be converted to %20. 124 124
So that's why I'm using it there. 125 125
And I'm gonna hit Enter. 126 126
And as you can see now, 127 127
we're seeing something that's acceptable. 128 128
Nothing wrong and then it's showing me the information 129 129
about zaid 123456 and showing me the signature. 130 130
So it is ignoring the password, 131 131
so the injection worked 132 132
and it's ordering by one 133 133
so it's not showing me anything wrong. 134 134
Let's try to make this number one a very large number, 135 135
so I'll put in 10,000 or 100,000 now. 136 136
So what we're saying right now 137 137
is I want you to order the results 138 138
that will be returned by the current select statement 139 139
based on column 100,000. 140 140
Now chances are there aren't 100,000 columns used 141 141
in this select statement 142 142
and therefore this should return an error. 143 143
So when I execute this, 144 144
you'll see that there is an error. 145 145
And the error is in the order close. 146 146
And still there is an Unknown column for 100,000 147 147
and this is great 'cause now we know 148 148
that the database is executing what we want. 149 149
So when we told it to order the results based 150 150
on the first column, it showed us results. 151 151
So it followed what we told it 152 152
and then when we told it 153 153
to order the results based on a column 154 154
that does not exist, it gave us an error. 155 155
So it's obviously vulnerable to SQL injections.