‫Now, if you remember in the previous lesson, we exploited as fuel injection vulnerability in a search
‫box.
‫And the search function.
‫Basically compares the user's input into a database by using a like statement by.
‫So then we created ask you all queries that can work well with the like statement.
‫So now we're going to do almost the same thing, but this time.
‫With something different, let me show you, so go to be web, choose escarole injection, post, select.
‫So on this page, you select a movie.
‫And the information about movies will show in the table below.
‫And to see the FDP request enable Foxe proxy.
‫And select a movie.
‫And it is a post request.
‫And the movie ideas sent to the server.
‫All right, so nothing else needs to be in the request, just send the request to the repeater tool
‫and forward it.
‫And look at that, see the information about the movie is in the table here.
‫Then forward an intercept of.
‫Now, before we go any further, let's have a look at the code.
‫So function is here to call security checks according to security levels.
‫OK, we already displayed the functions, so scroll down to see the scroll query and here's a query.
‫So it has two parts.
‫Now, the second part is where user input comes in.
‫So it takes an exact numeric value.
‫And then she likes everything about this record.
‫So we need to write appropriate queries to work with this query.
‫And then the remaining code will display the output, but now.
‫Here's a problem, only the first record can be displayed, so in pulling data, we need to be concerned
‫with this, OK, only the first record can be displayed.
‫Remember that?
‫OK, so go back open repeater.
‫Check the Maine request again.
‫And it shows the data.
‫So put a single quote.
‫And look, we have a syntax error.
‫So then put another single quote.
‫And there's the same syntax error, another one.
‫Syntax error again.
‫All right, so I'm going to add a different payload.
‫And this time it works, so I think this movie must be the first record.
‫So now I'll discover the column numbers.
‫Or to buy one.
‫The movie name has changed.
‫That also proves the vulnerability.
‫Three columns.
‫No, five columns.
‫No.
‫Seven.
‫No, nine columns.
‫No, but we do get an error, eight columns.
‫No, in an area again, so the number of this column in the select statement is seven.
‫Of course, I already know it, but let's have a look at the way that we detected it, so I followed
‫it this way.
‫OK, so now write this to discover which columns are displayed.
‫So except one, all are displayed.
‫Escarole injection is identified.
‫So we should pull actual data and metadata about the server.
‫So first let's pull version, user and current database.
‫We are the route user and use the Web database.
‫And the version is 5.0 dot nine six, and we can also look up vulnerability's for this version, but
‫it's not and what we're doing right now.
‫And by the way, you can always change his number to know it'll also work.
‫OK, so get the database names.
‫In this query only gets the first record.
‫So we need to change it.
‫So if you add a limit clause like that, you can pull all the database names in turn.
‫And this will get the information schema.
‫So next one is BWP.
‫Then to.
‫Then three.
‫You can also try this one.
‫All right, so now we have all the database names, so then we can get the table names.
‫And it will display only the first one as well.
‫And we can use a limit clause just like that to specify all the tables.
‫Or this payload to group them.
‫All tables are in one row now, so they get the tables of the BW database, use this.
‫Five table names are here.
‫And then we need to call them names.
‫And this restriction looks familiar, the just the first record, so adding the limit clause, we can
‫pull the columns.
‫Yeah, but it's not very efficient, is it, especially when you manually exploit the application,
‫so you use this to get the columns of the movies table.
‫This one's better.
‫So now we know the information about the database and tables so we can pull the actual data.
‫And this payload can work.
‫But we need to get over a one line problem, how are we going to do that?
‫Well, the limit clause can help us again.
‫But I know this way is kind of boring and slow, but.
‫Let's just stop for a second.
‫It's not an exercise anymore, let's think of it as a very important table.
‫So it's worth the step by step approach.
‫Of course, you can also write a crazy query like this.
‫All right, so anyway, all data is grouped into one line.
‫And due to being able to read and write files from and to the system.
‫I think you can go ahead and run this payload.
‫And then this payload will send the result to a file.
‫And don't worry about the warning, it works.
‫And with his new payload, you can view that file.
‫OK, so now it's time to increase our level of medium.
‫So I'm going to just change this here to one, but this time the query below won't work.
‫So the problem here is single quotes, the application sanitizes the input.
‫So that means we need get rid of them.
‫But instead of just writing strings in a single quote, I'm going to use the Charra function with ASCII
‫values, so let's see how that works.
‫Just like that in the columns.
‫They are all here.
‫And the magic file.
‫And you know this so good and the rest is here for you to discover.