so now that we understand what SQL is, how can we discover it.
As explained.
And as we've seen in the excess s examples, the bottom concept is the same.
We always look for places in the web applications where we can manipulate the input.
So again all the arguments that you see all of the parameters,
all of the post and get requests anywhere that you could manipulate as a user.
You should test it for SQL injections.
How do we perform the test? Very simple.
We try to inject a statement that returns a false
and analyze what happens on the website if the website breaks and then we try
to inject a statement that returns a true and that shouldn't break the website.
So if the true statement does not break the website and the false statement
does break the website then the website
is actually accepting whatever we're giving it.
So it's executing the statements we give it
and therefore from there we conclude that it's vulnerable
to SQL injections and then we can inject other
queries that allow us to access the database or upload files or read files and so on.
So let's go ahead to the first example and have a
look at how we would go about discovering and SQL injection
as you can see in here we have a normal shop website as mentioned before.
You should go ahead and test every single aspect of the website.
Use it as a normal user.
See how the website works normally without exploiting it.
So you get an idea of what the pages look like first so that when you break the pages,
you know what a good page or a normal page looks like and what a broken page looks like.
So anyway, you can see here from the top,
you can actually filter products based on the
tags we have in here are the categories.
So for example if we click on accessories,
you will see that it's gonna filter the products that we
have in here and you're only gonna see the accessories.
Also if you look here on the top you
will notice that the category is equal to accessories.
So we have a parameter called category and
the value that is being sent is accessories.
Now straight away.
If you look in here you'll see that the title in here says accessories.
So if you apply what we learned before you're
gonna try to manipulate this and play with it.
So if we just type anything after the accessories,
you can see that it's being reflected in here
and therefore before you even try and SQL injections,
you should actually try html injection as shown before and then try an Xs.
S. Because you have user input that is being directly reflected on the page.
And that's usually a really good cue to test for X. S. S. And html injections.
Now this is not our topic. So that's why we're not gonna do that.
Well,
I'm just trying to tell you how I would go about
a pen test if this was a real world scenario.
What we're trying to test for is SQL injections.
So we're just gonna go back to what it was.
We just said accessories and to test for SQL injections.
We want to put a true and false statement as mentioned in here.
Now before we do that let's try to understand what's happening when
you actually go to this website when we're sending this U.
R. L. To the server.
What happens is we have an SQL query this is the
original query that is being executed by the web application.
It's doing something like this. It's using a select query
from a table called shop where the category is equal to the user input.
So in our case it's called accessories in here not food and
drink but in this example the category is food and drink.
So what you see in here in yellow is the user input.
Everything in white is being written by the web application itself.
We can't really play with this.
We can only change what's written in yellow because whatever we put in here after
the equal sign is being placed in yellow between the two quotation marks in here.
So what we're essentially trying to do is we're trying to inject our own code in here.
If we manage to do that this will be sent to the database engine and it will be
executed by the database engine which will retrieve whatever
data we want to retrieve from the database.
So
the injection is gonna look like this. You have the name of the category.
Food and drink. We're gonna write our own single quote to close this.
So as you can see the web application itself closes it
in here but we're gonna add that manually in the input
and then we're going to say and one is equal to one
and we're adding to
minuses after it. Because this can be used as a comment to comment.
The extra quote that the web application adds
by itself because we're adding our own manually.
So the resulting statement is going to be select star from shop where the
category is equal to food and drink and one is equal to one.
Now we know one is equal to one is true
and we know that there is a category called food and drink
and therefore this statement should not affect the execution of the page.
The main thing you want to pay attention in here is we're manually adding
a single quote to close the quote that the web application opens itself.
And there were using a comment at the end to basically tell the
web application to ignore this last quote that is added by the web application
itself because then we will have an extra open quote and that would
break the whole query in here because every open quote should be closed.
Then we're going to run a false statement and this time we're saying
select star from shop where the category is food and drink which is true
and one is equal to zero. Now this time it's false.
Now if the page breaks when we do this
then we know that the web application is actually
executing whatever queries we're sending it and therefore we
will know we can use other SQL queries in here
to communicate directly with the database and
retrieve whatever data we want from it.
So let's go ahead and test this.
Right now we're actually opening a category called accessories.
And we're gonna add our single quote after it and we're gonna say
and one is equal to one and then we're gonna add our comment
and perfect as you can see the page loaded exactly the way it should be.
Nothing changed in the page.
So this means this statement that we added did not affect the
execution of the page which is what we're expecting because it's true.
So we're selecting the category that is called accessories
and one is equal to one which is true.
Now let's change that and say one is equal to zero
and perfect.
As you can see now the page broke,
which means that even though there is a category called accessories,
the web application is not able to retrieve it and that's because we said
and one is equal to zero which is false which is breaking this.
Select query because the query is becoming like this
and therefore now we know that we are able to
manipulate this Web application and inject SQL queries in here,
and whatever we put in here is actually going to be executed on that website.