‫So until now, we have exploited some escarole injection vulnerabilities, but the main queries are
‫all built with select statements.
‫So we add our payloads after select statement now, this time we're going to, hmm, maybe just do something
‫different.
‫And we're going to perform an actual injection over insert statements.
‫So let's go to be WAP and then ask you all injections toward blog.
‫You may remember this page.
‫It has, well, almost the same view as stored excess.
‫But the back end code is completely different.
‫It was kind of like a commenting page.
‫So here you can enter something and it will be displayed below.
‫OK.
‫So open terminal.
‫Type vem Escuela, I underscore seven BHP.
‫And the security check is performed based on whatever the security levels are checked.
‫Scroll down below and in this line, the user's input is checked.
‫Then the insert statement comes.
‫And it uses the user input and the session user name to insert to block tables.
‫And below, there is a select statement to display the entries in that table.
‫And it selects all the records to display.
‫So first, it shows the owner of the entry and it shows the entry itself.
‫And the rest is now very important.
‫So go to be Web.
‫Well, no, no, actually, go to Chrom.
‫So if you're not already, just log in to Miamian.
‫Open Enescu, a window.
‫So I'm going to paste the code here and clear it.
‫All right, so this is pure SQL query and our input data will come into between these first single quotes.
‫OK, and when you put in a single quote, as we did previously.
‫See how it won't cause an error, it will insert the single quote.
‫Into the table.
‫But if you add this payload.
‫It will just execute the query.
‫Then insert A and B in the movies table.
‫And the remaining part will be executed as comment.
‫OK, so covid that payload if you want.
‫And go to Firefox.
‫Pasted in here, an ad entry.
‫So you see, there's no problem.
‫So the last line proves the insert process.
‫OK, then paste this one.
‫This shows the sub select queries also causing no problems.
‫And now we can enumerate the database itself.
‫So now, right, this payload.
‫And here are the values of the version, the database and the user.
‫And the payload we provide selects the data from the database.
‫And then the original query inserts that data into the movie stable.
‫The second original select statement brings the records into the movies table.
‫So, OK, let's go with databases on the server.
‫As you see, we can only view one database.
‫The information of this one database, so the problem is in the insert statement.
‫So because we use some select statement and insert so the insert statement can only insert one line.
‫So that's why we cannot see all the data together.
‫And we can use a limit clause.
‫And this is information for BW.
‫But you can do this for the other ones in this way as well.
‫However, if you group the names, there's no problem.
‫So you see all the names are here.
‫Now, right, this payload to get the table names.
‫You know, we get an error.
‫And it is indeed a syntax error.
‫OK, so now it's done so with its payload, we can one by one read each table, but I have nothing to
‫do with the system tables now.
‫So I need boabs tables.
‫And here they are.
‫So now we can get the call names with this payload.
‫And we need to go one by one.
‫And once again, I only need my targetable.
‫So pace this one.
‫And then these are the columns of the users table.
‫And now we can pull the actual data.
‫OK, so you can use this payload to bring the information from the user's table.
‫But you do need to go one by one again here.
‫And now I of course, I don't want to finish this lesson without my magic file.
‫So use this payload to load the password file.
‫And yeah, I'm sorry, we cannot view all of the content at this time because he is yet another restriction.
‫So normally we inject into every parameter, but the result of the sub select statement is inserted
‫in the owner column and then the size of this column is about 100 characters.
‫So that means that we're only able to read this much data.
‫But you get my meaning.