Original subtitles

1

In the previous video, we have seen how authentication bypass can be done by exploiting sequel injection

2

be used, a standard sequinned payload, which is X or X equals specs.

3

This is not the only payload, though.

4

It is a standard sequel injection payload.

5

We can modify it in whichever way we want as long as it forces the query to return true value and doesn't

6

break the syntax of the sequence.

7

So let's make a small modification to this payload and see if it works.

8

I'm just going to change this x2 way and instead of equal values are not equal here.

9

So this payload should still true because X is not equal to Y, which is true in this case.

10

So this should still return to.

11

So let's try to inject this payload into the login page and see what happens.

12

I'm pasting the payload here and pasting the payload here, too, and let's click login.

13

Look at that, even that payload work.

14

So what it means is it doesn't always have to be a payload that you take from the Internet.

15

You can customize the payload according to your situation.

16

I just wanted to touch upon modifying a standard payload.

17

So you want to stick to standard payloads that you copy from the Internet and you get to know that you

18

can also modify the payload according to your needs.

19

Right.

20

So that's an indication bypass.

21

But secret injection is much more than this.

22

We can extract the content from the entire database.

23

So in the next video, let's discuss some advanced sequel injection picnic's.