‫I hope you remember what we did in the blindest fuel injection lessons.
‫We saw how to perform a boolean and time based blind escarole injection XPoint.
‫And, of course, manually exploiting such a vulnerability is a time consuming event.
‫And it's also just very hard to go step by step.
‫So we can use Escorial map to get over these obstacles.
‫So first, I'm going to start with bullion based one.
‫And so there's a search box here, I think you know what's happening, just enable Foxe proxy.
‫Then type something in and search.
‫Now go to berp.
‫And the request questions here, so before forwarding, copy it to a file.
‫And I'm going to use the same file and save.
‫Then let the request go.
‫OK, open your terminal, then type Escorial, map R and request the file path.
‫He title.
‫Age and test Colin 28 08 to 09.
‫And run.
‫Now, it's funny because we're looking for a boolean based escarole injection.
‫But we discover a time-based one.
‫Yeah, so you can skip testing the others.
‫OK, so, yeah, the exploit is with an integer value.
‫OK, again.
‫And this can always happen to you.
‫OK, now, directly, I'm going to point to the bullion based injection.
‫B is for Boolean based.
‫It executes, but nothing is found.
‫So maybe providing the DBMS can help.
‫But nothing is found.
‫Oh, no, I'm getting nervous.
‫OK, so I'm going to add two more parameters.
‫Level five, there were five those.
‫The default value is one where a limited number of tests or request are performed and vice versa.
‫Level five will test were Beausoleil for a much larger number of payloads and boundaries.
‫So all at all, the harder it is to detect Enescu oil injection, the higher the level must be set and
‫risk three.
‫And there are three risk values.
‫The default value is one which is innocuous for the majority of escarole injection points.
‫Risk value, too, adds to the default level, the test for heavy query time based rescue, well, injections
‫and in value three ads also or based escarole injection tests.
‫Super.
‫All right, so finally we discover the boolean based blind injection.
‫No, no, don't test any other, just look at the result is MAP discovers a hard injection type for
‫us.
‫OK, so bring in the banner data for me.
‫And sure enough, it brings the better information for the operating system, web application and server.
‫So now think how hard it was for us to get one character of the version information.
‫OK, so get the current database.
‫OK.
‫Something went wrong because the escarole map runs in a single thread mode, some data retrieval problems
‫can happen.
‫But I'm going to show you that thread a few seconds later, so before adding threads, I'll add these
‫parameters.
‫Prefix will add what I write before as Google Maps, payload and suffix will add what I write after
‫the Escorial Maps payload.
‫Then I can refresh the school map session to start exploiting from the beginning.
‫Now, have a look at the payload, it puts everything in place.
‫So now get the current user.
‫OK, and add read 10 to retrieve data fast.
‫Now, I I couldn't see what happened, did you?
‫It was very fast, so we can use the threads parameter for bigger ResultSet.
‫Yeah, let's see, for example, this one and make the thread 10.
‫Look at how fast it is.
‫So no and no, I don't want to crack hashas now.
‫OK, so I think we're done with the Bulleen based Bascule injection, so let's have a look to see if
‫there's another one.
‫OK, so we go to Firefox's.
‫Open an appropriate page from the menu.
‫And I need a request file, so.
‫Type something in and search.
‫Open berp.
‫And the request is here, so copy this to a file and say, OK, so go to the terminal again.
‫And then run.
‫And it will get a time based blind rescue injection.
‫OK, so we know this is not a surprise.
‫We can also point with a technique parameter like that.
‫OK, so get the better information.
‫Oh, yes, please do optimise.
‫OK, so I'm going to stop it here because even Escorial map has its boundaries.
‫So as we've done, Escorial map should also wait and time based escarole injections.
‫So now you may think, well, adding threads to the parameter can solve it.
‫Well, good thought, but I am so very sorry it doesn't work for time-based escarole injections.
‫And as you can see, Ezekial Map is very clever, it completes the previous data retrieval process.
‫OK, so I just I just can't wait that much, so finally we come to the end of the school injection part
‫of this course, I hope you enjoy that.