All language subtitles for 2. SQL Injection

But they're going to start with desperation.

We have for every bag, we're going to have a little definition and we start right away.

This is not a beginner.

Workshop, so a skilled injection as cure injection that consist of insertion or injection of a secretary

via the input data from the client of application.

In fact, this fuel injection have always been one of the must use attack, ever.

So I guess everyone knows about this challenge.

Addictions, good injections are like.

One of the top three of the most used for breaches in the hacking, and I also like the most critical

you can get because with the actual injection, you can do many, many, many, many things.

So first, with this kind injection, you can retrieve data from the database, which says give injections.

You can inject data into the database with an injection, and you might end up having a remote code

execution if the user is database administrator.

So give us injection.

There is many things to be done, but how do you find injections easily?

No, I won't say easy, but like the good ways, the ways I use the places that people don't usually

explore.

So let's go.

How to do tests for askin injections.

There are multiple ways of testing voiceprint injections.

One of the most known is a single cut to prometteurs that you put on.

Look for errors in the webpage.

Everyone knows this technique.

You just come.

You put single code and you wait for a single injection error and you're good, but it doesn't happen.

Always like this.

So you have many different types of insulin injections.

You have blind insulin injections, you have Boolean based injections, you have no major injections.

So it doesn't just work like I'm going to put a single, couldn't wait for it.

And especially in big bouncy were the big launch of.

So the moment you feel is a field where people are hitting on targets days and days after this.

So you're never going to end up testing your website that no one has it on before.

You should suspect that in case there was an insulin injection, it a simple single quote someone should

have found it like way before you.

It's possible that I've never had this luck to just come on the website, try to do my backbone decision

and just put the quotation mark.

And yeah, I was doing it.

It doesn't work like that.

So there is many different characters you can use to test for insulin injections.

We talk about a single quote, but you can also try to inject some weird shards to the inputs.

So, for example, double quotes, you have this the MacDonald thing, you have this chance.

You're going to try to inject and see if there is any error in the end in the book that gets activated.

That's good for them.

Check.

Later, as we said, a transitions can be found everywhere once you as this forest transitions in jet

and custom parameters sent by the application.

But not only do you have this first conviction on the is such accepting which you might get surprised.

So funny.

But it happened.

Like, let's say, two weeks ago I was testing website and I have this website and I'm checking on Brexit

and I've seen it except on the perimeter that is getting set like on every request I do to the web application.

So it's not like typical to just see an application that is going to just sit except on acceptance,

which I went forward and took the precaution language from the head there was the website was sitting

to me and they put it in my request and I tried to play with it a bit.

And after some tries ended up finally gets an injection on this header.

So this is like the most uncommon thing you can find funny is an injection in except on a header.

You also have to test first your injections on or don't you it to put on education firms, but not only

you have to test for acute injection on site based inputs, such as, for example, when you have API,

such users that you want just have to assume that the idea is not getting like past three GB.

You have to assume that it might be vulnerable so you can just try to inject in the past.

So let's say that you have, for example.

That's to say that you have, for example.

How to respond.

Yeah.

If you have such a such users large one, for example, Shaft to try to inject here, you know, so

just like you will do for like perimeter equal value, you're just going to taste like that and double

code and start testing it manually.

Just have to do the same focus for the database.

So this is something that many people do.

People just assume it exists on parameters?

No, you have to test for everything that you can think about that is going to get passed to database.

Let's see.

Yes, sorry, we are here.

OK, so let's see some real world example reports.

Gaze one blind as an injection via death perimeter.

So I was testing for I was sitting here with web applications for program on Hacker one.

Upon visiting once abdomen, I look at my history and I found this picture being made.

So this post request is something that you see you typically see every day just supposed to log in with

the language permettre being said here.

And mud and meltdown, which means like looking, I guess, in in Dutch and so us saw the user of which

is being set by an application, the first thing to try is to open a single quote, which from within

the request.

But as I said, this never.

Like almost never works.

So sadly, this led to nothing.

After further investigation, I found out that the language could permit or that is here was vulnerable

to blind as cruel injections.

So why a punching one and this payload to we should permit requests the application to delay the response

time by nine seconds.

So this there are some aspirin injection payloads you can find like on GitHub.

You can find if an on both default warchest.

So you have like a ton of extra injection payloads and you can just if you suspect that an input is

vulnerable, you can just like import the parameters to the payloads to shoot and shrewder and just

run them against the the input.

And you can even -- like you can do everything you need so you can check their response time.

How much time did the response take to to to respond to this?

For brainiest fuel injection, you can see the webpage content up to send the request.

So it's very m- very handy tools to have.

So they can we don't look only for a transaction via single quotes, which are Richard, earn this for

instruction as well.

These are more widespread and less detected by other hikers.

So this is a report.

As you said, it's the brand is construction where we can sit that any time delay and application was

during the response after the time we set.

Case to.

If anyone has questions.

Throw the the curse, please just dump them into the chat and I can answer them.

Just checking if everyone.

Everyone is following.

Is my connection?

Good to you.

So can.

Okay, all right.

Thank you.

So to bullion based blind rescue transactions, geographical barometer.

So everyone.

You know, rough birth control have been implemented.

You can see in the last couple of last three or four years, I've seen many websites started adopting

graphic shell, which is kind of.

And points for us, for hikers where we can get skimmers and check try to retrieve data from it, but

not also people always go for like IDRs on go after requests.

But you can test for any type of bridges you can test for transactions.

You can test for remote code execution so you can test for buy strawberries and industry requests.

So there is you can Typekit test every bit of that you have in mind.

A couple of weeks ago, I decided to take on the internship program, which is public and had more than

1000 reserve grade reports while perusing the application.

I found the request that was being made to drill and print through created at websites that's worth

creating.

The first thing that comes in mind is rough and introspection tree lot.

Can they find more methods to test either in the and looked.

So I'm going to give chips as soon as we we advance.

I know everyone has.

I myself, I have.

I've had much, much trouble with rescuers and risk worth dinner when everyone started to for it.

So I didn't understand how science works and how should I proceed to be able to construct a a good rescue

request and how I should, how I should run it.

So there is this boat extension, which is called.

Ian Curtis, Canada.

I guess some people might know about it, some might not know more about it, so you can just get it

from GitHub.

So from the Jim.

And this is an extension that whatever rough, cruel.

Um, Link, to you add, in case they work for Fell and don't accept and restrictions is going to be

to you, is karma.

You can just like use Santa's repeater and you can just add your cookies.

Let me see if I can get a pretty quick reaction.

Let's see here.

OK.

Let's see what happens.

So as you have seen, this is a of career.

And points like attrition that use such.

And all I had to do is just post it here and press loot.

And so we have the mutation theories that have been built for us.

And also all the curious which have been.

Returns, so you just have to like it, right click centripetal.

And it's also just have to start testing.

So this is something that you have to save because it's not included in the slides.

Is this stuff I'm going to just like talk about every time, every every time we go forward?

So this is very important.

I I myself, I can this Rochelle.

I'm going to put out this extension because it's very hard to construct the the requests if you don't

have all the knowledge on it.

I can go the here and.

Well, why does it go back?

So we were here.

So why burning application that was being made to shell and points repeated at websites such work shell?

The first thing that comes to mind is governance, introspection, a load.

Can they find more methods to test the theory right now between the methods invoked?

Let's go forward for a thing trying introspection theory on the brink.

So as I have shown you just like five subsequently go, you can use your scanner on purpose to test

for introspection.

And this one, luckily was working.

The request was successful, and there's several responded with all the available risk of cruel methods.

One caught my eyes really fast.

So there was the growth methods Method Place called Polaris Connect up by Clancy.

And it says in description, This operation is in beta.

This field is currently in beta phase and missions without even notice and a bunch of other information

about the point.

We are going to check.

So Türkce the request assigned to the previous slide.

The application needs us to set the custom header for the server to process a request.

You can see here ex experimental IP API is visible.

So I just said this header.

On my growth call out see on point and you can see here, lest we forget, there is this kiri, you

have set the header that the server was nudging and we just get it 200 OK and with some data.

So our request is well constructed the way it formed, and we can go forward and start to start searching

for vulnerabilities in the methods.

So we had this it says courey policies connect up my client e.g. hotel client e.g. authorization as

81.

OK, so.

I have tried some some scanning on this, some specific barometer transition command I.G.

And after some time, I can see that injection speed injection can lead to something really bad.

So when I tried this Blindspotting injection, which basically is to test for the gist of the vulnerability,

if I said the parameter value to or not equal that one.

And for example, anything equal, anything I was getting.

It's not.

I was not in Europe because in fact, there is no thing that is wrong in my territory.

So one.

Equal one, and this equals this, so going forward, in case I challenge this value of the parameter,

so addiction, there's a payload for gene or not, one equal to if I change one to two, I was getting

this error which sees.

Connect applications arrow with the London Sign and Gaze 10 06.

And so it is good that the wait time out.

So this is very disrespectful.

So if you have like one equal one, you get no error.

You both want equal to and you start getting errors.

So of course, there might be something that is very fishy.

What I usually do when they suspect that there is there is an injection reach of a bone matter after

doing some manual tests.

I just directly import the request to aspirin.

My suggestion might be a really powerful tool for detecting and scanning aspirin injection.

Yes.

Of course.

Sure.

Do you want us to just go forward with the questions, or do you prefer them at the end?

Let's see.

So there is this tool for Shivam, there is a tool called Atlas Access is a tool which basically takes

its cash injection dumper scripts.

You are going to bypass the words like cloud all.

So for example, let's see here.

You should take Atlas Obscura map.

So Atlas is a testament, Thumper suggests, or, you know, a skill map.

You have no scripts and no scripts are, for example, scripts which are going to change some showers

to other chairs to bypass the wolf's.

So access is a tool that takes your your venerable link and it takes a skill map and it's going to like

find the perfect Tampa-St. for your boss.

Of course, it doesn't work every time, and sometimes you have to go manually and you have to start

testing it by yourself and trying to find a good bypass for each each wolf.

So it might be custom sometimes, but usually this tool works really well for me as.

And so, as I said, for the two --, I'm for the one injection.

So first thing I would try to do is just a messenger.

Could someone think I'm going to try to do is just.

But seeing some.

Some random showers and checking for potential errors or time delay or something that's going to happen.

One.

Yeah, it's a good time to talk about it.

So there is one trick or one thing that worked for me in the past week for an injection.

So I've had a similar similar request, says like host sludge.

For example, let's see script that beach equal test and we had like, for example, a username.

Yeah, that's cool.

You can ask as many questions as you possibly will have time.

Don't be shy.

So I had the website which was doing something like that.

We had hosts that scripted BHP as there's some user name equality and the one trick that worked for

me to detect and it's injection is in pushing.

This weird character to put the percentage story on this cable.

Yeah, so I just this went.

OK, so.

You.

That's right.

Good.

So this is not even credible.

So this is a child just like, you know, f and stuff.

So some most of the time application don't have if they don't have the proper processing for this kind

of input, it might it might just like break something and throw on there.

So.

After I put this input here, there was debug log, which showed me, like, for example, insert I

insert egg equals test.

Username equals something zero, because this sure is not valid, but what was interesting is that in

this era, it says, for example, it was something that insert IG.

Your username, name, password into a pop up of the values, it says.

It says we have A. username, which we don't have, we have here, sorry.

Name, which we don't have in this request, so it was empty and password, which was empty too.

So it was something like that.

So this didn't trigger this transaction, but one I didn't put this chart.

It showed me that there was a prometteurs.

The request that our.

I.D. username, password.

So I've had I.D. and I had username, but I didn't have name nor password.

So basically this I.D. parameter was not vulnerable to extra injection.

I've tried everything and it was not vulnerable.

But after I've seen this parameter here, I was just able to add it up.

Here and this one was renewable.

So by throwing, by making an application through an error log, I've had the opportunity to see other

parameters that are not that I don't know about, which were indeed venerable test convictions.

So for Atlas, as you were talking address here, you can see what it says.

Atlas is an open source tool that can suggest, assume attempts to bypass rough edges eyepiece.

So let me just try to drop in just like for you, baby.

And I buy it here.

Yeah.

So we've had this one undergrads.

Ian Cure-All Scanner.

But it's.

OK.

So if anyone needs the tools, you can find them on this election, Chanel.

So let's see some use cases of Atlas.

Basically, you're going to put two runs the strip titan Atlas, with the link you suspect is vulnerable

to a injection but has enough behind and you put the payload that triggered the worst to burn you or

give you on Earth.

So for example, if you were doing website such I'd equal, for example, let's say it was this and

you did like, for example, and one econ one at that, though if you had this, so you are going to

use Python, Atlas

Twitter.

That's the link.

So you just saw it, but it here.

And you include a payload that caused the error to trigger.

So this is the payload which got the wolf to burn me, and one access has this payload.

It's going to do mutations.

So he's going to try for other, for example, on the other hand, or, for example, at least some

documents or trying.

And it's going to give you back a response of which Tampa-St. is useful for your wife kids.

And later on, once access gives you the proper postscript to use, can just go to a school map and

do the shrimp, basically with the Tampa-St. permit.

So let's see here.

For example, you can use birth, you can use get you can add up headers to if needed.

And, for example, you can see.

Let's see, do everyone see when they zoom like this?

Yeah, I guess.

So.

OK.

So for example, here.

He but we don't buy it unless you're up the bite on the issue.

The website databases random agents, OK?

Just the basic as everyone uses.

And Aptos come up with him, he got potential permission from the state that access denied.

This means that the he doesn't know if the permit is renewable, but he knows that there is a wolf that

is blocking him from going forward.

So what he did is.

Copying the payload, the trickier the wolf, so we can see here payload price and photo.

So he did patent access link.

He put the link payload, he put the payload and wait for access to give you back.

The Tampa-St.

results.

Atlas is trying with space to make sure history.

OK, this is the payload that it generated.

No, it doesn't work.

It's still four or three with this payload.

And so.

Train with version key stomper.

And this is the payload that Atlas has generated and oops, 200, OK, so this payload worked.

This means that this payload is not blocked by the wolf.

The wolf doesn't catch it.

And so the a script we just use is called version that keyword.

And at this point, all you have to do is run Python as trail map the website, the same commands you

just run, basically with the parameter thumper and the double script atlas found here, which is race

unit keyword.

So I hope this makes sense to everyone.

See, for this transition behind wolves and behind growth run on sorry.

So sometime you will have.

Yeah, excrement is a very powerful tool.

I had a document about this.

I have found on on a during that bar exam, which was very, very, very, very useful to me.

Let's see if I can find the links we can share with you.

It's it's basically the best resource map I have found.

Yeah.

So I talked about it.

One or two years ago?

This is it.

So every time I have.

Problems came up or I don't understand the function or I need help with astronomer.

I just go back to this obscure map encyclopedia.

It contains basically everything that is needed for you to moisturize astronomer.

So basically everything.

So for example, if we just go and search for Tampa-St., you can see some rejection data.

And you can see here.

But an escaped mob and the Tampa perimeter here.

So this is very, very, very complicated question.

I'm just going to send it to you through Slack so you can have to read it if you like.

Later and.

So.

Yeah, sure, Shivam, this was the first.

Solution to your problem about wolves and close friends and.

Cared for and how to see what's behind it websites.

So the Syrian solution for cases where you have potential is an injection and there is enough that is

behind the blocking you from making the request is you are going to try to find the real IP of the website.

Finding the real IP of the website is going to make you pass by the cloud forever and so avoid getting

blocked by cloud from to find the IP of a website.

You have multiple multiple people, multiple methods and you have to try all of them to get a real IP

IP website.

Let's talk about the easiest ones first.

Shivam, the easiest worm, the easiest method to get a website's real IP behind them.

Yeah, and I'll see it.

One for proxy is just looking for IP history or internet.

So if you go to IP history, you open a you genius.

And you just type like not know why this website is legit, so it's going to tell you IP history results

for sites.

So this was the IP.

Then on 2014, this became the IP here, later in 2005.

This is a piano and so on.

So for example, if you see this.

And later on, you see in 2014, it was this was owned by Konopka or something.

And you see Cloudflare.

So you you know that this IP was moved to this IP behind Soter.

So you know that this IP, the real IP of the website that is behind called for.

And usually when you connect to the websites directly without passing by the growth where you don't

have any problems anymore with objections and worse.

So this is one of the methods.

To get the websites, Real AP.

Let's talk about other potential solutions to bypass the works by finding what sites like you can go

for server side request forgeries.

Let's say you have an application.

Which takes, for example, website behind love that comes attached, it says it takes emerged that

BHP link equal.

OK, so you have this, for example.

And this is behind us, and you have to know the you of the website so you can easily do just that.

But the website you own.

And wait for the website to call your external website in case the website is sending its the request

through its real IP.

You are just going to get the real IP of the website just like this and usually web site just make the

request with the real IP.

So, OK, the blog what you can see.

But they don't usually look when they are making external requests to too hard to implement.

So this is something to remember.

You can get real websites by using, for example, server side request forgeries and trying to get Typekit

from your logs.

And let's talk about other again other methods to get the website help you out.

For example, if you go, for example, in JavaScript files, you might end up finding some informations.

You can, for example, go to I send Finder.

OK, so by fixing by company name.

OK.

I'm not sure which website was it was, yeah, this one.

This is a very handy website.

This is the last year for ABC, for a sense.

You can see here, for example, let's say I put OK, let's say Facebook is behind it was.

OK, I'm just going to what Facebook and this website is going to give me all the IP ranges that Facebook

owns.

So even if, for example, let's say, Facebook was behind Cloudflare, they you have you still have

the declaration of the IP the own.

So all you have to do is just take, for example, each IP range.

And Musk can using a map or else you love and find the application you were hiking on inside the appearance,

you are chicken.

So I hope this one makes sense.

Shivam, do you have any other question before we continue forward?

Seems like she fell asleep.

No, he didn't.

Okay, so let's see, um.

Do you feel as if we permitted just some specific one, a first for?

I can't see that a fist for every parameter because you might get those and just like being lazy to

to notice anything you click on.

So I think this moment of transitions when I find the need to, for example, if I see um.

So just with the time it's it begins being more easy to to know where to find the the good parameters,

for example.

But for example, if I have a barometer that says website, for example.

It's equal for seven, let's say, this one.

OK.

And you come and your input, for example, is significant and the applications their issue needs integer.

OK, so the application is clearly telling you that this is not going to pass through the functionality

because we need an integer and not anything else than a number.

So it's not worth spending at just four, in my opinion, it's not worth spending time trying to to

inject something that tells me, Oops, what I need is a number, not what we put.

So I hope this makes sense.

And so, you know, how to how to choose the parameters and also so forwards to adapt to it, for example,

let's say that you have.

Websites that lets see username equal, let's say, for example, this and it gets you reflected in,

for example, for example, a.

Starchy.

OK, so you can clearly see that this barometer username is not getting processed by the backend, just

getting reflected on the page, on the H.M. page, on the dome.

So it's not worth injecting here because there's nothing that is actually processed by the by either

the database.

So just skip this kind of cases to to to save time.

How this make sense forward, have I answered your quiz?

OK.

Anyone has questions because before we go forward on those projections topics.

OK, so I guess we can go forward.

OK.

So when do you stop on the perimeter and say it's not for?

So at first before even trying to to to go in depth into it or trying to to to hack into a perimeter

first injection, I should have some signs, but tell me, man, this perimeter is really fishy, you

know?

So this one is really fishy.

I have to get this feeling after doing some tests is, for example, at some point I don't find any

way to confirm my statements, but this parameter is vulnerable.

I'm just going to save the the request to my legs.

And maybe, you know, two, three, four, five months later, five months later, in case I get better

at a second injection, I can visit again this request and try to exploit it again.

So it is good having a fixed five where you just see the request and throwing up and functionality you

were not able to to test today, you were not able to hack today.

And just coming back to them five months later, six months later, when you feel like you are ready

to take it again and you are ready to stick with other perspectives because you have learned much between

this time.

Usually you just followed up against my answer.

Usually if I can't find any.

Confirmation that if biometrics were never an estimate, which is, of course, better than me assuming

injections because this crime is committed in Australia, there is means that it is not even able to

and I can't find a way to to to to confirm.

I'm just going to stop here to not waste much time.

So they don't she's not about.

The best big you found, so everyone that joins backbone, of course, there is the need to hike the

result of two hugging and the love to trying to break to breach stuff.

But we all love money.

So, but really, they are looking for bonuses, too.

So if you end up spending too much time on.

It's a barometer of that is.

For example, not 100 percent, but no, you're just going to waste money because every second that

passed.

State, you invested time, but you didn't get anything out of.

Out of it, so just focus.

Focus on the thing that you are sure our venerable and try to exploit them till you can provide a good

performance at.

You.

You, Safwat says, what about the Dum Dum Dum Dum tool, Jeff Barton's?

I decided to vote for funding, yes, transitions.

So I guess forward, I guess this are stories for people who go for automation.

This is not something that I do on my own.

I don't use.

I love Dum Dum Dum Stool is a great brother.

And he he he added up so much value and backbone and U.S. and history.

But I don't use this word.

So I can't give much.

Informations about it, so.

I there says, what are the most common characters the triggers are for you by 16 points per injection,

like you had mentioned?

Are there any more?

Yeah, there is more.

So basically everything that is not printable by the application triggers arose every time for me.

Let's talk about a issue.

So I have.

So there is, for example, this one we talked about.

There's also this one that usually.

Returns errors.

You have also in your bite that sometimes you turn around, you have just trying to to to to insert

some random.

Factors into a barometer, so for example, if a website, if the Obameter takes only, for example,

numbers and you put this.

If it's not 100 on the background, it's just going to throw some debug log, which might be helpful.

And there is a couple more, for example, we should go to.

Let's see if we could.

You have these websites with which takes any doctor you want and turns it into.

Into any goods.

So, for example.

So.

For example, this kind of practice sometime triggered it for me, which helped me explore it more and

more in depth.

My big bone she targets so.

Yeah, yeah.

So you can this this one and entry from today on Troy, watching them when you are trying.

Oh, there is something I should also tell you about that I was about to to forget, so thanks, I'll

be there for the question.

And there's another thing that might trigger errors and the backlogs that might help you, for example,

if you have this website and the promoter IG sometimes.

Adding The brackets here are going to cause.

The application was through.

And if this happens because this is not released, so it is normally a single object, but you are going

to input a list which is not supported by the, I can say is going through an error.

So you have along with this one and other characters that you might find everything that is not pretty

but on is read for the application.

Can you just keep pushing also adding up brackets just before?

Just before interest, and so this happens more often than you think you're got really more often that

you think sometime when.

Doing some backbone to this or hiking your mind, for example, need a single path to a bus?

Full disclosure.

A full disclosure of the server, so, for example, where is the server located at, for example?

Let's see.

That's OK.

Let's see.

It's here.

So just pushing.

You should really.

So if so, just in pushing this, you're going through some holes which are going to lead you to just

get.

Some the burglars that might help you with our expectations, such as credit ABC.

And although we know which is.

So one thing I forgot to tell you about a scale map is that we actually map you can also and gives you

a very successful transaction.

The user is the administrator.

You can use a skill map to escalate the bank.

So not I don't know if everyone is aware of it here, but this map has some parameters like I read.

For example, if but if I read that is that password in case the username gave the user that is the

database is administrator, if you input this to a school map as the.

You stood strong and you put this is going to try to read the local file.

Buzzwords so you have more and more common words like I'm always and others, which you can see on the

astronomy lingo sound like.

So for what is it going to taste, one promoter for different burgers like this is this is just for

you.

And if it's true.

Yeah, of course, every promoter can be vulnerable to any kind of ability.

So you have to test for everything.

What are you finding the need to just have don't have just to stop on one parameter and see, I'm done.

No, you have to test for everything except this.

You have something.

So coming forward is everyone, you have more question before we go.

I guess.

Welcome.

My pleasure.

So I guess we can go forward.

Let's see where we were.

We were exactly here.

OK.

OK, so you were here.

And we've had the error that triggered us to to launch a school map.

And so if you have like lost data using a school mapper but data or delete method, don't just copy

copy the link and other matters, just save the request to testify.

An important user of a barometer, an astronomer.

So you have to have the records to checks in plaintext.

And you can import it was pretty up easily.

This makes it really timesaving for everyone.

So you get to experiment.

Give me access to other databases to to to databases which contains like informations about the tables

and columns, and I was able to retrieve data too.

So this is a simple case with experts.

Take away, Luke, for a second injections everywhere, even in healthcare, as more people look for

the addiction is pitiable, parameters go beyond it, so have it in mind.

This was from injections and here there is this first injection in professional on points.

This first two injections in the full path of the website to test, you have to test for it everywhere

you feel the need to.

Import the the questions came up when confirming system placements, it should be cheap to dump other

bases on Trump, like, if so not to dump but released and don't dump any other BS.

Champagnie program blows it.

OK, so we have some labs we're going to do.

Is everyone ready for the labs?

We have actually.

I guess see here.

We have around one, one hour and a half to go before the next.

Before the first break, right, because I'm not very good with standing stuff.

So we can start doing.

The labs rescue transactions, so.

You all have the website should be tests BHP that where would that come?

I'm going to give you 10 minutes to spot the screen injections.

OK.

You have your hiking set up set can try to to get it.

Do you hear me?

OK, so everyone is on edge.

OK, so try to split the screen injection.

On this level.

And the first one to solve it in the next 10 minutes will have to to show his screen and show us how

he approaches the target.

And so he can command all together and get more ships around this.

Please, if everyone is trying to inject to find this fuel injection, please reply yes in the newsroom.

So I know everyone is connected and doesn't have phones connections.

Okay, thank you for your responses, very appreciated.

So, first man, give give your friends some time.

Let me take my camera for one minute and try to fix one thing.

And you also continue trying to find those transition.

Okay, nice.

Give me one minute for the video.

Give time to the other to try to find it.

So everyone wants to hear me.

I'm fixing one thing.

Give me some time.

So does anyone need more time to try to find it?

Nine, Survivor.

So what nice name a nice.

Alejandro.

You get it.

Is.

Nice.

Umi Mishra, did you get it?

Lewis, can you hear me?

You got it to.

Dramatic.

OK, you.

OK.

OK, so who wants to go Sherry screen and show us what higit?

Who's down to show his screen and show us what he found?

And then we can go forward together.

Now you do want to show restraint.

Yes, sure, no problem.

You can go on, you can write on, it takes some.

When it takes not.

How do I give you short screen?

Let me see how I do.

I'm not sure if.

You should you should show from your side, I guess.

OK.

Hmm.

It's pretty easy you should have a show screen.

You should have your show screen option.

There is two people in the WHO is GB and everyone.

I'm not sure.

You see.

OK.

So I'm not sure how we.

Activated.

She's from here.

You know.

Do we have anyone from from Twitter.com to you?

Yeah, OK.

Let's do it like this.

You can share the link.

Everyone shares his link and his solution.

In the chat.

OK.

Okay.

Let's go and see

what's up here.

U.S., do you need me to look into anything here?

Yeah, I wanted to try to.

How do I allow people to show their screens?

OK, so I think you can go to the participant section and click on more when you there's a more option

and when you were over, there means.

And I think.

Can allow them.

OK, so it's good, someone.

I'm not sure which which of you guys in the abraded, but it's good news.

It's good.

Not sure what's happening here.

It's someone hugged me, my connection is not working.

Yeah, I do have internet.

We see lights up here.

Q So.

Tim Burton from.

So we have this here.

Yes, Peter.

Yeah.

So, yeah, everyone obviously got it so pretty easy to just.

But this one.

Just by pushing a single.

Could you can see those transition and you can start to see for it?

There's just one.

You can see a video at what I was talking about.

So this is the week I was talking about.

Area, so giving this.

He's going to throw under Sing US to Bruce was brilliant.

Even so, this can give us more tips and tricks preaching what we are trying to exploit.

So I didn't this on this parameter before, though before we started, but luckily it's working so you

can see a live example.

Thank you for showing this.

The four neighboring districts.

There is two people in the waiting room and the choice you should accept them.

OK, so let's go.

We can have more labs coming later on.

Let's just take the next steps and see what you have and what you should do.

So now we are going to check for exactly.

Also known as external anti-cheat injection.

Before we start this module, this and you want to have questions about everything that we've talked

about.

The anything I should develop more for you.

Man, yeah.

Neil Askew injections are everywhere.

As conditions are still very, very common, but it's just not.

As indisputable as it was in the past.

So just take the chips I give you.

And start testing these chips, and hopefully you can start getting some good results.

You have to.

Alejandro, is there anything?

You want to ask before you go forward.

Be done.

Lezion, yeah, go on one more.

You know, this fuel injection.

What are your feelings about it?

Sorry, I didn't get you.

Yes.

I didn't hear.

Know no fuel injection, what do you experience about the.

So extra injections, just like extra injection, though, also come on and MongoDB, so you know,

it's two injections, mostly on MongoDB also.

Nowadays, most of the databases you will find are MongoDB and you will find a little the rescue here.

And as for injections on MongoDB?

Is also command, so.

So.

When you have, for example, there is a really good website.

Let's see here.

Yes, working on.

So.

Here you can find many, many, many payloads you can import into merchant reader when you have to.

To make with this.

So, for example.

If you just see one of them to a text file, for example, myself I've made, let's see if freezing

folder where I have like my custom payload.

I have developed and some payloads I have seen in the wilds and own resources.

So for example, if you choose, I'm not sure.

So at the top of the situation, I have a bunch.

Of payloads.

I'm just going to mass three if I find something that's fishy.

Using Burp Suite on Twitter.

So I recommend you to do the same as transitions.

And with service, eye surgery on local institutions, and all this might help you much, the new backbone

she journey.

So with nurse projection, it's come on.

But it's not that easy to spot because with no skin injections, you don't have many years that show.

So it's mostly about education bypass.

So for example, when you you, you can see here for.

For bypassing the detention methods.

So if you want to, for example.

Sometime on.

So you have two cases on the mogaji, been in business transactions, for example, under this equal,

this value and bust an equal one.

This is this might bypass the distribution methods.

So it's hard to find it's not easier to find, but it's worth putting time.

But one thing you should know is that when you in case you are trying this payloads, for example,

on a database that is not MongoDB on the backend, you'd be just wasting your time.

Just a waste of time.

You might be trained payloads and payloads in the payload payloads and just end up getting nothing out

of it because just the database is MySchool, or it's another database that is not MongoDB.

So it'd be good to what I recommend is having, for example, two or three entries from each its gel

injection method.

So you can check here you get your injection, you take two or three peyroux that might trigger errors

like.

Like, on a scale, this is the pillow that my three don't ever just take a bunch of out to a bunch

of payloads, throw them into.

At least and start spreading it into a custom perimeter.

If you find anything that fishy and from this point of view, you might have more information about

if a permit is reasonable or not and you'll do you, you will know which databases are on the back end

based on the response you get from your scans.

Did they respond, you agree?

Did they think you like come?

So I'm just going to post this thing to.

OK, so it seems like if anyone's wants to build a custom list later on for his B-roads can just take

a bunch of barrels from there and go on.

So we're going to start with the second.