I want to keep this simple and we're going to be in our lab on the actual Hyper-V host itself, which I'm moving to now.
There it is. And again, this is the MySQL workbench.
Now, the reason we're doing this in here and not inside of a website is actually twofold.
Number one, you get to see what it looks like when you put this SQL injection command into the actual SQL server itself and see the results happen in real time.
Reason number two is, is because I never could get the SQL databasing to work inside of BWAP, which is the test website we've been using up to this point in the course.
And I am still frantically trying to get that to work, but I'd rather see it work in real time.
And by that, I mean inside of our database that we have, our test database, which is Chinook, C-H-I-N-O-K, we have a query tab opened up.
Now, I want to show you real quick, as I have had problems with this already.
When you open up that query tab right there, there we go. Now I can zoom in for you.
Just go to new tab to current server, control shift T.
That way, if you don't see this tab, for instance, and you open it up and it looks like that, then all you have to do is control shift T.
Boom, shakalaka, there it is.
Now, line one is for us to be able to input actual syntax for SQL to go in and do some things for us.
For example, if we want to be able to display a username or a piece of information from the database, this is where you do it because it's querying the actual database itself.
Now, how does this relate to the website?
Well, there are websites out there that have forms to fill out with a submit button, correct?
Well, if you input that SQL code inside of that form and submit, it's going to query just like we are doing right here in my SQL workbench.
Now, the prevention for this is simple, input validation.
Remember that for later on in this course.
So, inside of number one here, code below in the code box, I'm just going to do a simple select one equals one.
Now, this may seem familiar because this is the actual check that you would submit on a website to run.
I just hit the lightning bolt right before that, and I'm going to highlight it.
I'll show you.
It's right there.
It's the lightning bolt next to the save icon.
Now, as you can see down on the bottom, we got a select one equals one, limit zero to 50,000, one row return, and we got a check mark.
You will get this kind of response from the actual website itself, especially if you're using Burp Suite to capture that packet inside of the interceptor.
And what this means is that one equals one is true.
Well, that means that the database is responding, basically saying, I am a database, and yes, that is true, and I concur.
Usually, database folks will turn off or stop the ability through input validation to prevent one equals one from responding back and saying, yes, I'm a database server.
So, the next thing that we can do is run our basic commands.
And I'm only going to show like one or two, and they get you to understand how SQL injection actually works through the form.
So, you can do a simple show database, and we do get that helper right there, but I'm just going to run that real quick, and you can see here that I just can't type today.
It needs an S. It has to be for databases.
So, when you run this inside the middle of the screen there, you get a list of all databases that are on this particular SQL server, right?
Now, that reveals to us that there are things inside the server itself, but as you can see, it just lists the names of the databases, not the actual information inside of it.
Well, that's where our next line of code is actually going to help us, and I'm going to copy and paste this for us, so that way I would get to it.
We're selecting asterisk, which means all, from a customer, which is the actual table within that database.
Where first name, because there is a field within the actual table of customer that we've seen earlier, but I want it to equal 42 or 1 equal 1, meaning true.
So, essentially, if I can't find first name equals 42, I just want to reveal that first names are true.
And by doing so, when I run this, we get a list of all first names within the table listing for that database.
This is because we have input validation turned off or weakened on our server, and since there was not a 42 as a first name, we ran with or 1 equal 1, being of the Boolean flag true.
And since the SQL server responded with true already, whenever we require first names inside of our select, we say true, and it's going to return all the first names, since they're the first condition of 42, 1 and error.
Now, this is the kind of stuff that you would submit inside of that form of a website, and there are websites that you could legally practice on.
And like I said, I am working my best to be able to get that inside of BWAP fixed, so that way later on in this course, we can actually do some more manipulation.
But I also think it's really good for us to see this happening under the cloak of the SQL server and away from the actual website itself, so you can actually see what's happening inside the database.