Original subtitles

Now, let's talk about SQL injection, SQL stands for structured query language to language use to communicate

with the database.

Almost every single application that stores data will use some sort of a school in some way.

A single injection will allow an attacker to potentially execute malicious queries that would lead him

to create, read, update or even delete data out of the database.

So when you're making a request to retrieve some sort of a data, a query similar to the ones on this

screen may appear in the background.

There are two major types of SQL injection error based, which is not as usual anymore thanks to our

new libraries.

But also there is blind SQL injection, which is more likely to run into an bug bounties in case of

an Arab SQL injection.

The application comes back and tells you that your sequel query has some sort of an error in the syntax.

For example, you could see it come back and say there is a syntax error near the character that you

have put in.

So our example on the screen, we're making a request, for example, dot com slash some endpoint and

we're assigning the apostrophe to the second example.

We're doing quotes and so on.

In case of an Arab SQL injection, the application is going to come back and that, you know, that

the character you have provided has broken the cycle query that's running in the background.

So in this case, cycle is coming back and saying, hey, there is a syntax error next to the character

apostrophe and you can do this in different ways.

You can see on the screen as an apostrophe, I quote, adding brackets, an array to the parameter and

so on.

So what actually happens when you put an apostrophe?

Why is this work?

On the left hand side?

You can see the request and the right hand side is an example that would happen in the background of

the application.

The first request here we're making is to an application to the endpoint news that B and we're fetching

the ID one.

This could be an article that in the database is numbered as ID one.

So in this case, we are fetching data based on the ID one and the query on the right hand side.

We're doing all of this and we're adding the ID from the request to the end.

So you can see the number one is being put into two apostrophes and being fetched from the articles

table where the UID column is equal to one.

And the next request, we're going to add an apostrophe to our request.

And as you can see in the request in the back end, the articles table with the UID column is equal

to one with an extra apostrophe.

This will actually break the query that's being ran in the back end, which will cause an error that

could indicate for a sequel injection and the last example we're using and to say we want to finish

a previous square and also run the next query.

So in this case, we're just saying, hey, the expression one equals two.

One, which is true in the database, is not going to give us an error.

So for this slide, we just want to look at what a quarter looks like and why does it throw out an error

when we add an apostrophe?

So in the next example, what we're going to do is we're going to end our previous query.

This is why we got the single quote and we're going to add the next query that's going to fetch the

data that we want so far in this example where we're doing it close to one without the second junction,

the web application is going back and saying, hey, give me the information for the news article that

has ID one.

But when we do a sequel injection, we say, OK, now that you have done this and this particular query,

but also I want you to fetch the data that I want so that the attacker we could be looking for passwords,

username, email addresses or whatever that were after the first example.

When we do a union select one, we practically are trying to guess how many different columns exist

in this particular table.

So we were still in the article's table, as you can see, its articles and the next DOT uid, which

is the column name.

We're still looking to see how many columns are actually within this table.

So in this case, because we're giving the wrong number of columns, the application comes back and

responds and says, hey, the select segment you have given me has less numbers of columns that I expect.

So there's different numbers of columns.

So we add another number.

These numbers could be there.

One doesn't have to be in order of one, two, three, four.

It's just placeholders for us to count.

How many actual tables are there either has to be no or we have to give it numbers and not actual characters

that could be mistaken for a name of a column.

So the next example we're doing select one, two, and it comes back and says, hey, I'm expecting

more.

There are different number of columns.

We add three, which in this case means there are three columns within the table articles and those

could be different columns like UID the title and the body of that news article that we're looking for.

So because we're doing the number of valid requests, it's going to come back and says, hey, here's

a data you asked.

I'm going to print some random data for you.

As you can see in our fourth example, we're doing the same thing.

We're closing out the query and we're saying, hey, union, select one, two, three, four, which

is one more calm than the application expects.

And it comes back and says the same thing.

Hey, you're select statement has a different number of columns.

I can't help you with this query.

So when we do this.

Our based SQL injection, we're guessing the number of actual columns that exists within that table.

In this case there are only three.

And as you can see at the end of each of these statements, we have the dash dash plus the dash.

That's usually in a square.

It means a comments or anything after that is ignored in the plus sign is actually a space.

What we're doing is we're saying, hey, I want you to comment out and ignore everything that comes

after my query that may be hard coded within the code.

So, again, the dash dash that we have at the end of it is just a comment out and force the application

to ignore if there is any leftover code from the original query.

So now that we know this application, for example, has three different columns we're going to do is

guess for the name of each column.

So in this example, we're saying, hey, I want to select one title and three.

So now that we have successfully found out how many columns exist within this table, the next thing

we want to do is guess for the name of each column.

Again, when it comes out, the hacking context matters.

So in this case, because we know that we're looking at the articles table, we want to guess things

that are related to an article like a title, the body ID and so on.

So in this case, what we're going to do is we're going to guess for the title.

We're going to say, hey, I want you to fetch one title and three.

If that column exists, we're going to get some data coming back from the website, which is the second

line.

You can see we're giving it a fake name.

We're saying, hey, select one fake name three, which is going to come back and say, hey, fake name

doesn't exist.

And this table.

And again, on the third line and the third example, the union select one, two, three.

We're doing this again to just show an example that, OK, if we give it a valid query, we return data.

We see that this is actually working.

And if we give it something invalid, it's not going to work.

You can also forced a sequel injection to fetch data from a different table.

So in this case, I'm saying, hey, I'm going to guess one, two, three, four from fake name, which

is the name of the table.

We're now saying, hey, I want you to forget whatever you're running into this table.

So this application is working within the article table.

Forget that table.

I want to go after a particular table name, fake name.

And if that table name doesn't exist, the application is going to come back and say, hey, this fake

name that you're giving me doesn't exist.

So, for example, a valid one that would be good to look for would be the user's table when we can

say, hey, one, two, three, four from users.

And if the user's table actually exists, the application is going to come back and say, hey, there

was more than four columns within this table.

Now, if they go back to step one and figure out how many columns are within the next table that were

enumerating, if this is confusing, trust me, it's all going to make sense for me to go to our lab.