Now to try and discover SQL injections, you need to browse through your target and try to break each
page.
So whenever you see a text box or a parameter on this forum, for example, page dot PHP, then something
is equal to something.
Try to inject stuff here.
So try to use a single quote, try to use an end or the order by statement to break the page and make
it look different.
So I'm going to show you here an example, and I'm going to go in to the login page first right here,
and it's asking me to log in.
Now, I've actually registered with my own name, so you can just go in here and register.
I have a username called Z and a password with one, two, three, four, five, six.
So first let's just I'm going to log in just to show you.
So my username is Z and my password is one, two, three, four, five, six and now I'm logged in as
eight and my signature was AA just not really just like as a test.
So I'm going to log out.
And we're back at the login page.
Well, right here we have the page so you can try to inject in that, but we'll we'll get into that
later.
So at the moment, we're having an example of injecting into text boxes so you can try to inject into
the name and into the password.
So I'm going to put my name as Azadeh and I'm going to put a single quote.
So I'm putting this sign into my password.
So let's see if we can break it.
And as you can see now, there is an error being displayed to us and it doesn't look like a normal error.
It looks like it's a database error.
And usually you'd be very lucky if you get an error like this.
Now, usually the error won't be as informative as this.
Sometimes you'll just see that the page is not acting as it's expecting as you expected.
Sometimes it'll just be a page that is not does not look as it should.
For example, if it's a new page, maybe it will have the article missing.
Or if it's a blog, it will have one of the posts missing or different kind of posts.
So you need to keep an eye on what's changing.
And this example, we are actually getting a really nice error, some of us which file it has and it's
telling us that there is an error in the statement and the error near the quotation marks that we added.
And it also tells us the statement that's been executed.
This is really good for learning because now we can see what's the statement that the system is trying
to run and the system is trying to do a select start.
So it's trying to select everything from accounts where the username is equal to Z and the password
is equal to a single quote.
And note that the the system, the web application is already adding quotes around the name.
So when I said Z, it added Z between two quotes and it added the single quote that I added between
another two quotes.
So that's why we have three quotes right here.
So from this we can it's like 70% of the Target website has an SQL injection.
We're still not sure if it can execute what we want it to do.
So can I actually inject code and get it to be executed?
Let's see if we can do that.
So the username is going to be Z again.
And what I'm going to do with the password.
I'm going to put my password.
So I'm going to put one, two, three, four, five, six.
And then I'm closing it.
So I'll tell you why I'm closing it, because the current statement, the system is it's select.
Staff from.
To Z.
And.
Is equal to and can open a single code by itself.
So let's call this as password.
So we're treating this as a variable and it takes in whatever I put in here, whatever I'm going to
put in this box, and it's going to insert it instead of the SE password, which is a variable.
So I'm just giving you an idea.
So you need to be able to imagine this happening.
So let's take in whatever I put in there and it's going to put it between two single codes and it's
going to be inserted in there and executed on the system.
So what I'm doing is I'm going to put one, two, three, four, five, six, and I'm going to add the
quote myself.
So what I'm going to do right now, the code is going to be like this, so it's going to select this
and password is equal to that.
And I have two quotes right now, and then what I'm going to do is I'm going to say and.
One is equal.
Two on, so one is equal to one.
And I'm just trying to see if it's going to execute what I wanted to do.
So my statement right now is it's going to be select start from accounts where username is equal to
Z and password is equal to one, two, three, four, five, six.
And note, I'm going to be inserting this myself and one is equal to one.
One problem that the system is going to complain about is that we have an extra quote here because I'm
going to be inserting this myself in the text box.
So it's going to be complaining about this.
It's going to say this.
This is an open code and it's never be has been closed.
So what I'm going to do is I'm going to add the comment and when you add a comment, basically everything
that comes in after the comment will not be executed.
I'm going to use the hash as the comment.
So anything that comes in after the hash, the system is going to ignore.
So I'm going to inject now is going to be this and one is equal to one and this.
So as I said, usually what you have here.
You have slashed our password.
Or depended on what the programmer called it.
But we're just imagining this and I'm going to be inserting this inside.
So when you do that and you insert it inside, this is what the code is going to look like.
So it's going to look like the right username, the right password, and one is equal to one, which
is true.
And then it's not going to it's going to ignore this quote right here.
So if we paste this, we should be able to log in.
It should allow me to log in and perfect.
We were able to log in and username is eight.
So far we haven't done anything, but this kind of shows us that.
Is it running our code?
Let's try a different thing now.
Let's try to add a false statement.
So what we did, we did one equal one, and that was correct.
And it executed what we wanted.
Let's try one equals two.
And this is false.
So I have the right password and I have the right username, but I do.
And one is equal to two.
And this should be wrong because it's false.
One is not equal to two.
And I'm using an and so everything has to be true.
So it should give me an error, even though I'm going to put the right username and I'm going to put
the right password.
So I'm put in one, two, three, four, five, six, and one is equal to two.
So it's going to be like, oh, this is wrong.
And as you can see, it's given me an authentication error by the username or password, even though
I'm given the right, the right password and the right username.
So this confirms that this website is actually injecting anything we want in the password so we can
use the password field to inject SQL code.
And it's always going to be on this form.
So we're going to put a password and you're going to put your code here.
So I'm just going to put it in capital code here because we're going to put any password, close the
quote, and then put the code that we want to execute on the system right here.
And it's going to be executed on the target system.