Now we've seen how to extract data using an SQL injection.
You can increase the security to level one, but you can exploit this exactly the same way that you
exploited level zero.
And if you increase the security level to five, it's actually very secure.
It's going to be as secure as the web login that we see in the login bypass.
So it uses the My SQL Escape real escape string combined with single quotes and double codes.
So it's pretty much an injectable.
What I want to show you in this lecture is a trick here, SQL injection, and I'm going to show you
that in the v w a instead of metal de.
So I'm going to close this.
And we're here at TBWA, and I'm just going to go down to the security level and I'll make sure that
that's set to low.
Now, I'm actually interested into the medium level, but I'm going to show you how to exploit this
in the low level just so that the information flows properly.
So I'm going to go to the SQL injection, and I'm just going to put number one in here.
Now, as you can see, we get a valid, valid page giving us the first name and the surname of the user
ID that we given.
Now I can inject this in the post and the box are here in the URL and I'm going to inject it into the
URL and I'm going to put a single quote here.
And as you can see, we get an error telling us that there is an error in the statement, which means
that there is an SQL injection here.
We can verify it by adding a true statement saying and one is equal to one, which should give me.
I actually forgot to add my comment here, so I'm just going to add the comment.
So the true statements should actually give me a normal, valid web page like we see here.
So it's given us the first name and the second name properly.
Now, if I say one is equal to zero, which is an invalid, should give me an invalid page.
And here we go.
We're getting an invalid page, which means that the ID parameter here is injectable and the page is
doing what we're asking it to do.
We can also verify this using the order by one, and then we can say order by a very large number and
it should give us an invalid page.
And here we go.
That's that means this Web page is definitely vulnerable to SQL injections.
Now, I'm going to try to determine the number of columns.
I'm going to put three.
And this is telling us on an unknown column.
Let's try to put two.
And the page is valid.
So that means we have two columns in this page so we can build our Union Select Statement.
Now you can see I'm actually actually have them built already and I'm able to select everything, but
just want to show it to you again.
So I'm just going to build the Union Select Statement with you actually here.
So I'm just going to say union select one to.
And we can see that we can display stuff in one and into.
So I'm going to select the database and one.
And we can see that my database name is DV RWA.
So I can go ahead and try to select all the tables using my information schema tables.
So the query is going to be very similar to the way we run here with DWI.
And the only difference is that the table schema is going to be set to DWI instead of all ten.
So I'm going to paste that here.
And as you can see, I can get my tables, which is guest book and users.
Now we can go ahead and try to select and find the columns for each of these tables using the same statement
that we used in the previous lecture.
I'm not going to run it now because I've already run it.
And if the if the table statement runs, then the columns table is going to run.
So I've already found that there is a user username and password column in the users table, and I'm
just going to run this statement to select the username and the password.
Just to show you what's going to happen.
And as you can see, we can select the usernames and passwords for all the users that we have in the
user's table.
Now, I'm actually not interested into any of this because we've done all of that before with Matilda.
What I want to show you is how to run these statements with the medium security level.
So I just wanted to do this to show you how it works on the low.
And now I'm going to go ahead and change the security level to medium.
And now can go to SQL injection.
And we're going to try to discover it the same way that we did before.
So I'm going to put number 1/1 to see a valid page, and this is a valid page.
Now I'm going to try to put a single quote after the one.
And as you can see now, we're getting an error.
But this error is different.
It's actually complaining about the existence of the single quote.
So let's try to put an end.
We're going to put and one is equal to one like we did before.
And close it with our comment.
And this should actually show us a valid page.
But as you can see now, it's not shown as a valid page.
It's actually still giving us an invalid page, even though we said one is equal to one, which it shouldn't
affect our statement or our query.
So let's try to put the HTTP code for the quote instead of using a quote.
So I'm going to put percentage 27 and see if that will bypass any security maybe they're using.
And again, I'm still getting the same error, same problem, still complaining about the quote.
So let's try and play more with this now.
As I said, exploit in SQL injections can vary from website to website depending on the way it's implemented.
So there is a lot of trial and error in this.
So let's try and remove the quote and see if that will actually fix our problem and make it injectable.
Great.
Now, this has given us a valid phage.
Now let's try to change it and say one is equal to two and see what happens.
And yep, this has given us an invalid page, so the website is responding to what we are saying.
The only difference now is that we're not using the quote, we're just injecting it straight.
After the ID, after the number.
Okay.
So let's go ahead and try to build our union select.
So I'm going to type in union select one to.
And yep, that looks like we can write stuff in number one and number two.
So let's try to select table name.
From information schema to tables like we always do just to get all the tables that we need.
And here we go.
We're getting all the tables just like we got them before.