‫While testing, it is very important to look at all input fields.
‫And when you find an input field, you will try your payloads.
‫But you probably won't get escalator's.
‫Then you might think, well, then that means there's no escarole injection here.
‫So actually, yeah, it's possible because Web applications can send generic errors, right, so you
‫may get confused to see whether you're a valid excuse or not.
‫Let me show you something.
‫So now go to Caleigh and log in to be Web.
‫And we're going to look at another escarole injection type.
‫So from the menu, choose escarole injection blind boolean based.
‫And it's a simple search box.
‫Now, if you look for a movie and a database, you will get a positive result.
‫And if the movie's not in the database, then you'll get this negative message.
‫And if you try something to break the squirrel syntax or to cause an injection, OK, then you'll get
‫this generic error.
‫So this point.
‫What do we do, we've got nothing left, right.
‫OK, I mean, I turned to you know, I'm just kidding.
‫But in the real world, for instance, you will get a four or four page in this situation.
‫But you and me now, we're not going to give up, are we?
‫So what do we do?
‫Oh, let's go and open terminal and let's have a look at the code.
‫Now, we always see these checks, so scroll down.
‫And so here's the part that I want to show you, here is the Eskil query.
‫So see how it uses the title parameter coming from the user, then the query executes.
‫And if there is an execution error, it will print incorrect syntax error.
‫But then if there is no, it looks to the recordset, see whether it's empty or not.
‫So if it's not empty, this means that the movie exists, if it is empty, the movie doesn't exist in
‫the database.
‫OK, so let's go back to Firefox's.
‫Now we're going to blindly try our payloads to verify if there is an actual injection.
‫Now, I said blindly but logically.
‫Write this one to test.
‫And it breaks the syntax, but we don't know how.
‫So now try this one.
‫Now, I think it should work, but we do get a negative result.
‫So now try this one.
‫And once again, I think it works and we get a positive message.
‫So now change one to two and try.
‫It works, but a negative result of years.
‫OK, so we can understand if our payload executes or not.
‫And also, we can pull data by checking the execution result, whether it's positive or negative.
‫So now I'm going to add something here.
‫The first part of the payload before and is always true, right?
‫And my ask well, we'll check if the second part after and is true or not.
‫And then that way we can learn the length of the current database name.
‫Negative, the length is not one.
‫So change one, two, five positive, the length is five.
‫So now yours is.
‫And it will check the first character of the current database name.
‫It is not a.
‫It is the.
‫Is the second character W.
‫Yes.
‫Is a third character, A.
‫Yes.
‫Is the fourth character P.
‫Yes.
‫And is the fifth character P..
‫Yes.
‫So the database name is Beware.
‫I think you get the point, so we use boolean operators.
‫As well as some other functions to compare.
‫Now, of course, there are there are multiple ways of comparing this is just one of them.
‫But a checks of the ASCII value of the first character of the database name is greater than 64.
‫Positive result.
‫So the first character can be either lower case or upper case letter.
‫So I use this one.
‫So now we get the first character is a lowercase letter.
‫And we can make a boolean search to find the first character.
‫So is ASCII value greater than one oh nine no is ASCII value greater than one or two?
‫No.
‫And is ASCII value greater than 99, no.
‫And as ASCII value greater than 97, yes.
‫OK, is ASCII value 97?
‫Yes, so finally we get the ASCII value of the first character.
‫Now you can perform almost the same payloads to get other data from that database.
‫Of course, you might be tired and bored because this is really long, right, takes a long time, but
‫you're seeing how it works.
‫But think about the nature of the information, the quality of the information that you can get from
‫a real world database.
‫You need to be proud of yourself.
‫But me, I'm going to stop here.
‫But you can go ahead and try some of the other payloads and figure out what else you can do.
‫All right, cool.