‫Eskil injection.
‫So the actual injection is the most famous and perhaps the oldest Web application attack.
‫It is an absolute nightmare for data driven applications.
‫So let me talk to you a little bit about it, thanks to Web 2.0, users can interact with applications
‫in different ways, right?
‫And applications can use user supplied data to perform any task on the back end, such as selecting,
‫deleting, updating and so on and so forth.
‫So if users provide valid and secure data, right, there's no problem.
‫But what if users try to inject codes instead of data?
‫So actually, this is a huge problem for Web applications, because they can confuse a lot of actual
‫valid data and code.
‫So that's why they need to differentiate between valid and invalid data.
‫So I ask you, well, injection arises when the user or pen tester injects escarole statement into data
‫that's sent to the server.
‫And then if there's no sanitation escaping or any other security solution, the objective data can run
‫on a database server.
‫So the result of this execution will be sent back.
‫And then lastly, the Web server processes, the query result, prepares the response and sends it back
‫to the user.
‫OK, so that's how a basic rescue, well, injection works.
‫But by performing this task, one can easily read and manipulate sensitive information that's stored
‫in the database.
‫So here we're not just talking about the date of being like on fire, but it's like the whole system
‫is in danger because database servers are allowed to use and issue operating system commands.
‫And if they're not configured properly, the pen tester or the attacker can even gain access to the
‫entire system.
‫So anyway, we can divide Ezekial injections into three classes based on the extraction of data.
‫In band.
‫So this is the most straightforward injection attack in which retrieve data is presented directly in
‫a Web page.
‫Inferential or blind?
‫So in this type, there's no actual data transfer, but the tester is able to reconstruct the information
‫by sending particular requests and then observing the resulting behavior of the database server.
‫Out of band.
‫Is data that's retrieved using a different channel, such as an email with the result of the injected
‫code.
‫So now we also have five techniques to exploit escarole injections.
‫The union operator can be used when the rescue while injection floor happens in a select statement.
‫And it makes it possible to combine two or more queries into a single ResultSet.
‫The bullying technique, so we can use bullying conditions to verify whether certain conditions are
‫true or false.
‫The error base technique forces the database to generate an error, giving the attacker or testor information
‫upon which to refine their injection.
‫The out-of-band technique is used to retrieve data using a different channel.
‫And time delay techniques.
‫Time delay techniques used database commands to delay answers in conditional queries, so it's very
‫useful when an attacker doesn't have some kind of result immediately from the application.
‫OK, so now let's examine some of them.
‫So open up Caylee and go to the Web.
‫Over the drop down menu and there are several types and aspects for rescue, well, injection and bewell,
‫choose escarole injection post search.
‫OK, so there's a simple search box here, so it's right in the Marvel movies and Search.
‫And it will bring the result in to a table.
‫OK, so now enable Foxe proxy and then type something in and search.
‫Go to berp and here's a request.
‫It sends data over post and the post parameters are here.
‫OK.
‫Forward.
‫And here comes a response.
‫The returned data is in a table.
‫So we're going to play with a request later.
‫So we're now open terminal.
‫And view the page as you well, I sixta BHP.
‫Now, according to levels, there are security checks.
‫So we're going to view each of these functions after this file, so we'll scroll down.
‫Now, this is the actual sentence to perform search operations on the database table.
‫And below is the code that helps to display the data.
‫So exit and for the functions file.
‫The check one function and slashes to the data provided by the user.
‫And of course, we also have seen that function before.
‫And the check to function uses a built in function to escape escarole related, reserved characters
‫such as the double quote.
‫OK, so go back and open up Chrome.
‫And I'm going to open up my hand, men choose movies table and open the actual tab, and I'm going to
‫pace the actual sentence used in the page here.
‫So this is syntax.
‫I'm just going to clear it.
‫And this is the viewer Escorial sentenced to perform this search.
‫And escarole injection happens by injecting this sentence.
‫So let's type something here.
‫And here is the result, one line of data.
‫So what happens if you add a single quote?
‫OK, so you get an error because single quotes are special characters to ask you, Al.
‫And the first two of them are paired with the last one is not.
‫And it confuses my Escuela.
‫So now what happens if you add a hash symbol here, hasher pound, whatever, it will execute no errors
‫because the hash character is also reserved for my escudo.
‫The hashes used the comment, the text in a line, as you can see here.
‫So I think that gives you a pretty good example of how escarole injection works.
‫So now you can do the same thing on the B Web page, put it in a single quote.
‫You get an error.
‫But in a harsh.
‫Nowhere's.
‫So that also means that you can execute rescue.
‫So now let's write some smart queries to get data from Maisky.
‫Well.
‫And order by 10.
‫And by the way, or by 10:00 will order the result by the tenth column.
‫And if there is no intent to kill column, then you'll get an error.
‫As you can see here.
‫So that way you can discover the column numbers in a ResultSet.
‫OK, so it's not at all so.
‫But it's seven.
‫So seven columns are in the result.
‫But only five of them are shown on the page.
‫So now we can use the union operator to merge our own select query.
‫So I'll write this in to see what columns are displayed on the page, and here's the result second,
‫third, fourth and fifth columns.
‫Style, instead of these numbers, we can use Escadrille statements and functions to pull data from
‫the database server.
‫Now, I'm going to pass this payload to find these values.
‫And the version of the database, the current user of the database and the current database.
‫In an Escorial injection process, you extract data step by step.
‫So first you get the version of the database, then the name of the user, and then your current database.
‫Then you can pull data through databases, tables and columns.
‫So that's the way we're going to do.
‫OK, now with this payload, discover the database names on this server.
‫And here are the databases and their properties.
‫So that Target database is BW.
‫And paste this payload to see the tables of Boab.
‫And here it has five tables.
‫So here now you can see the row numbers of the tables.
‫And this is where you get to choose a table to target.
‫So I'm going to get the columns of the movies table.
‫So here the column names.
‫All right, so now we can pull data from this table.
‫Right, this payload.
‫And we'll put data in the first column.
‫All right, I yeah, in this scenario, there's no crucial any important information right in this table,
‫but.
‫Just think of it as being able to execute Escorial statements.
‫So then you can get, well, almost everything from a database at the current Conexion user has rights.
‫So in this example, we can do all of that.
‫For instance, we could get MySQL users and their hashes with this payload.
‫And you can always crack caches later.
‫Now, remember earlier I was saying database systems generally have the capacity to execute operating
‫system level commands.
‫So that means that you could possibly, if you were so inclined, run such a task.
‫OK, so I'll say that, for instance, you can view files on the system.
‫Right, so the magic file can be loaded onto this page with his payload.
‫Now, I think you'll remember the content of the password file.
‫You can also upload files to the server, actually to the database server.
‫But you do have to bear in mind that your connected user should also have the rights and permissions
‫in order to be able to write data to a directory on the server.
‫So I'm going to upload a sample shell to the B Web directory.
‫But I can't.
‫So I need to find a particular folder to see if it exists.
‫And let's see if I can find the documents folder, so paste the payload and search.
‫And yes, we applaud the shell.
‫Actually, it's not a regular upload, we just wrote some data to a file on the server, that's all.
‫And I write a simple BHP shell like we used before.
‫And now let's see if we can run some commands.
‫Go to the documents folder from the you are out and call Shell, not BHP.
‫And add ACMD as a parameter with a Linux command.
‫And here is a result.
‫Of course, you can change the commands, who am I?
‫Rich and see.
‫I want a different show and that cat show.
‫All right, so now I'm going to listen on terminal and see that an MVP four four, four, three, OK?
‫Now, I'm going to pace this one line, Kat, reverse shell.
‫And hit enter.
‫All right, so you see the response doesn't show up.
‫So I think it works and, yeah, it works.
‫Beatbox connects to the port on Carly.
‫And you can run Linux commands now.
‫And run this python code to get a bash style shell.
‫OK, so we got a full shell from a simple escarole injection.
‫So the rest is up to you and your imagination, and now we're going to look at some different examples.