‫All right, so we detected and exploited different types of rescue, oil injection and the previous
‫lessons.
‫And we performed manual detection and exploitation.
‫It really is important to get the idea behind an actual injection and I think we've, you know, covered
‫it enough.
‫So now I would like to introduce you to a wonderful tool.
‫In the next three videos, we're going to cover the Keywell map.
‫But first, I want to start with some basic options, so I'm going to use this as Gorell injection page.
‫And you can open it from the menu.
‫It's a simple search over the TDP get method.
‫You can type in something search and the typed input is in the early, you can see.
‫OK, so copy this, you, Earl.
‫Then open your terminal.
‫Now, ask you, a map is a built in and free open source tool and Kouy and I think it's going to solve
‫many problems.
‫While you go along escarole injecting.
‫So with one age, you can see basic options.
‫And we're going to cover most of them, but the usage is quite simple.
‫I think the developers did a very good job here.
‫So it simplifies the detection as well as the exploitation.
‫But wait, there's more.
‫With double age, you can view even more options.
‫And more advanced scenarios, you can use them here.
‫So let's just stop right here and run it, so type in Escorial, map you and paste the URL here between
‫the double quotes.
‫So this is a target, you, Earl?
‫Then Pete Hidell to specify the target parameter to test.
‫And type double that cookie to add cookies.
‫Now, you may need a session value or something in a cookie so you can provide it with this parameter.
‫So go to Firefox now and open developer tools and go to the network tab refresh page.
‫And click on a request and copy the value of the cookie header.
‫Paste here.
‫Then you can randomize the user agent with random agent.
‫And the age parameter will add a special HTTP header to the request sent by escarole map.
‫So I don't know if you can see it, but this is Andy.
‫Because.
‫You may want to follow Escorial map requests in a log file or any security device.
‫So I'm going to add this header.
‫And with a DBMS parameter.
‫You can point directly to the database management system of the back end.
‫And also, you can specify the operating system with the OS parameter as well.
‫Then F for fingerprinting the database.
‫B, for better information of DBMS.
‫And then add current user and current database.
‫And check to see if the current user is a database administrator.
‫OK, so now we've completed the Escorial map query, so I know it looks like a long one, but it's very
‫clear.
‫OK, hit enter.
‫So it detects an injection and now if you accept it, will try another type of escarole injection payload.
‫So, look, it finds several others, the title parameter is vulnerable, and if you want other parameters
‫to test, you can always ask why.
‫But you know, we don't need the others now and then.
‫Let's see how it finalizes the execution.
‫And now you can see the results here on the screen.
‫And there happens to be a copy in this file.
‫So let me show you.
‫It's under rudimentary in a hidden folder.
‫So I'll open the log file.
‫And here is a complete information about our finding.
‫See the payloads.
‫And the discovered information.
‫OK, so go back to the terminal.
‫Now, I'm going to run this one.
‫Users is my parameter for getting database user.
‫And the password parameter for passwords of the database users.
‫You can also get their privileges and rules also.
‫So I think the parameters are clear.
‫It gathers users, then passwords, and then it can even crack the hashes for you.
‫So accept it by hitting enter.
‫Choose one.
‫And No.
‫Then we'll try to crack the hashes with its own dictionary file.
‫OK, the execution is finalized.
‫So go ahead and open a log file.
‫And here's the output of this second query.
‫The payloads and the users are here, passwords and the hashes are here, then the privileges show up.
‫Scrolling down and here are the database users rolls.
‫OK, so go back to terminal.
‫And now let's use this query.
‫It will get all the databases with DVRs and enumerate all the information about them with a schema.
‫It will bring in everything about the database's.
‫And of course, the output is very long.
‫And you can analyze it later.
‫But this time, just delete the schema parameter.
‫That's the one that causes the long input.
‫So here are the database names in the server.
‫So now we can choose one of them with a deep parameter.
‫And it lists the tables in.
‫OK, so now we can choose a table with the T parameter and see the columns.
‫And these are the columns of the users table.
‫Great.
‫So now we have the information about the database, the table and the columns so we can pull the actual
‫data.
‫So just use this C parameter and type the name of the column.
‫Then simply dump.
‫And it runs quickly, so here's the result.
‫And we kind of lead here.
‫You can dump the whole table also.
‫It'll detect the hashes again, so choose one and crack them.
‫And thankfully, it cracked the harshest.
‫And yeah, so here is the result, Perfecta Mondo.
‫OK, now use this query, the Ezekial Shell parameter will open and ask you all shell for you to run
‫will statements.
‫So this is very cool.
‫You can run a escarole query here.
‫So like, I'd log in from B Web users.
‫No, something's wrong here.
‫That's it there.
‫I got to add a comma, so it's a really cool feature.
‫OK, so go back.
‫Now, use this query.
‫And you map provides reading and writing files, if possible, so you can read the magic file just like
‫that.
‫And now you can accept this to let Escarole map confirm the download.
‫And the file is in this folder.
‫Go ahead and check.
‫OK, so now we can upload a file.
‫But not an also innocent file.
‫So I prepared a simple shell.
‫And with the help of these two parameters, I can upload to a destination on the server.
‫And again, it wants to confirm.
‫A file is not uploaded.
‫You know, I think we don't have the right permission to do that to the directory, so let's just change
‫it to this one.
‫We can confirm again.
‫And I think that uploads the file, so we'll add the command parameter like that.
‫OK, so now we have a Web show.
‫And we can run Linux commands.
‫So go to terminal.
‫Now, instead of using the Web shell, you can use this query.
‫Will do almost the same thing that we did.
‫It will upload a shell file to the server.
‫OK, choose four and a writable directory.
‫Type No.
‫She used to to provide the right of a folder and type dub dub, dub, slash B rap slash documents.
‫And yes.
‫And here is the result of that command.
‫Now, of course, four different operating system commands, you'll need to do all these things again.
‫So actually, escarole map as another parameter for this.
‫So use this query and change it here to OS Shell, so choose for and know.
‫She to to provide the right of a holder and type slash dub dub dub slash B Web slash document.
‫OK, so we get the operating system show.
‫Now you can take the operating system commands.
‫And it looks like it's a Linux server, so I'm going to be typing these ones.
‫OK, so this is the basic usage of escudo map, and it has been a kind of a long lesson, but.
‫In the next lessons we are going to dive more into, let's call them advanced scenarios.