so now that we know that our target is definitely vulnerable.
The next goal is to actually start selecting data from useful tables.
So hopefully from a users table that contains user names and passwords.
So the next thing we do is to go ahead and try to exploit it using the same SQL queries
that we tried in the previous lecture and you will
notice that they will not work because like I said,
this is a blind scale injection example.
Therefore you will not see the results on screen.
So the way we're gonna do this, we know so far that when we execute a true statement,
we see the welcome back and we execute a false statement.
We don't see the welcome back.
So we can use this to actually check if a specific table exists on the page.
So what we're gonna do is we're gonna say
do we have a table
that is called X for example. And then when we found the X.
Table, we're gonna ask the question, do we have a column
called Y. And the X. Table.
And then once we do that, we're gonna say do we have a value
in table X.
And this way, for example, we can ask do we have a table called users?
If we get welcome back, that will mean that we have a table called users.
And then we're gonna ask those the
table users contain the user called administrator.
If we get welcome back,
that means we do then we're going to check if the administrator
password starts with an a if we get a welcome back.
Then we try the next character, next character, next character.
And we can guess the whole password this way.
So basically we're not gonna be able to see the result on the screen.
We're simply going to be asking the database
engine questions a true or false question.
And based on the answer that we get, whether we see Welcome back,
we will know that the answer is true.
If we don't get a welcome back, then we know that the answer is false.
And then we can ask it a different question. That is a huge limitation.
But you will see that we can still manage to get the user name and the password
of a user or of the admin using this vulnerability with the help of Burp suite.
We're actually going to be using the repeater and the intruder to help with this.
So you're going to get other examples,
We cover them previously when we spoke about xs s vulnerabilities,
but now you're gonna see how useful they are because as I mentioned previously,
you can ask you can actually use them in so many other scenarios.
So what we're gonna do to ask, do we have a table called X?
We're simply gonna say similar to what we did in here.
So we said and two is equal to two. So I'm actually going to copy this
and we're gonna paste it here and obviously all of that is fine.
The comment and the comma and we're just going to be adding our code in here
and in here we're going to say I want to select
a
from
users
limit
one.
And we're going to say if the result is equal
to a and I'm going to explain what this means.
So basically what we're doing in here,
we have a statement that ask a question and like I said,
the main thing we want to do is get a
true or false answer from the web application and we know
the answer is true if we see welcome back and we know the answer is false.
If we don't see the welcome back.
And the question we're asking is do we have a table that is called users.
And the way we're doing this using a
select statement and we're selecting anything from the
users and we're limiting the result to one record and whatever you put in here,
you just I want to make sure that you added
after the equal sign because this is our check.
So if we have a table that is called
users in SQL this statement right here will evaluate
to a because that's what we're selecting and that's
why I said whatever you select in here,
you need to have it in here and then we have is a is equal to a is equal to a It is true.
And therefore we should see a welcome back if we have a table called Users.
So this will be the format that we're going
to use to ask questions to the database engine.
So let's go ahead and put this in practice. I already have this written in here
and I forgot to say and in here so we need to say.
And
so let's copy it
and let's just refresh the page
and we have it in here added to the end,
make sure it's added correctly. I think it is
and we're going to forward the result.
And as you can see, we have the welcome back in here,
which means that we have a table that is called users.
Now let me show you a false example. So let me just do this again.
We're going to load the page again and we're going to use the same exploit at the end
and this time instead of saying the table name is users,
let's just add something that we know should be false.
Like la la la la la
had enter forward it and now you can see that the welcome back disappeared,
meaning that there is no table that is called La la la
la la but we have a table that is called users.
So the next thing we want to do is ask do we have a column called y in the users table.
So we're saying the same thing but this time we're gonna say where
user name is equal.
Two
administrator.
So this time we're actually checking for two things.
We're checking if we have a column called user name
and if we have a user name that is called Administrator because all
of this will only evaluate to a if all of this is true.
So if we have a table called users,
which we know and if we have a column called
user name and if that column contains the user name,
that is equal to administrator.
If all of this is true,
the result between the two brackets will only be A and we know that is equal to A.
Therefore that evaluates to True and therefore we should see
Welcome back on screen if all of this is correct.
So we're going to copy this.
We're gonna go back to our page, we're gonna reload it, added the cookie
paste it
forward and perfect.
We have to welcome back appearing again,
which means that we have a column called user name and we
have a user name that is called Administrator in this column.
So so far so good.
Now the next thing we need to do is guess the password or get the password.
So the first thing that we're gonna do is we're
going to try to determine the length of the password.
So this is how we're gonna do it. Let's copy this because we're going to build up on it.
So we're selecting a from users where the user name is administrator
and
the length
of the password
Is greater than one.
So again all of this between the two brackets will evaluate
to this value if all of this statement is true.
So we know that we have a table called users and we know we have a
column called user name and we know that
this column contains a user name called Administrator.
And the check that we added now is if the length of the password is greater than one.
Now this should evaluate to True and we should see the welcome
back because any password should be at least of length one.
So let's try this first.
So again we're just going to paste it at the end of this
forward
Forward and we have the welcome back which
means that the password is greater than one
And then we can use this to determine the length of the password because we
can try to see if the length of the password is greater than 10 characters.
So again we copy this, we run it again, we edit the cookie
forward forward and again we still have the welcome back.
So that means the password is longer than 10 characters.
Now let's try again with 20. So again run it.
I did the cookie
Now instead of 10 let's try 20
and forward.
And now you see the welcome back disappeared.
So we know the password length is between 10 and 20 characters.
So let's forward this again and run it again we
have to choose a value now between 10 and 20
And I'm actually just gonna choose 19 because I know the length of the password is 20.
So if we choose 19
and forward
you'll see we have the welcome back.
So the password length is bigger than 19 but smaller than 20.
So we can actually double check it by simply using the same statement.
And this time instead of saying bigger we can just say equal.
So we're gonna say is the length of the password is equal to 20.
And if we hit that we should see the welcome
back meaning the length of the password is 20 characters.
So now we know the password length is 20
So so far we know that the user name is
administrator and we have a password of length 20.
The only thing we need to do is get the password.
So this is gonna be a bit trickier because we can't
really say is the password 123 is the password 1234.
Now you could do that but then that will take a lot
of time you can use a word list and do that but
it will take you so much time we're still going to brute
force it but we're going to be a little bit smarter about it