WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.090 align:middle line:90%
The SQL injection is one of
the more common attacks that

3
00:03.090 --> 00:05.220 align:middle line:90%
is used today because
it's one of the ones

4
00:05.220 --> 00:07.590 align:middle line:90%
that some software
developers never think

5
00:07.590 --> 00:08.983 align:middle line:84%
to harden their code against.

6
00:08.983 --> 00:11.400 align:middle line:90%
So what we're going to do in
this particular skills, first

7
00:11.400 --> 00:14.130 align:middle line:90%
of all, we're going to introduce
application architecture.

8
00:14.130 --> 00:15.810 align:middle line:84%
What is SQL in the first place?

9
00:15.810 --> 00:18.060 align:middle line:90%
What does a SQL database
do, and then we'll

10
00:18.060 --> 00:20.790 align:middle line:90%
introduce how this exploit--
how this exploit could

11
00:20.790 --> 00:23.910 align:middle line:90%
be used in a website
to access or change

12
00:23.910 --> 00:24.995 align:middle line:84%
our data in a database.

13
00:24.995 --> 00:27.120 align:middle line:90%
And it's going to be really
fun, because at the end

14
00:27.120 --> 00:29.340 align:middle line:90%
of this Nugget, we're
actually going to demonstrate

15
00:29.340 --> 00:32.070 align:middle line:90%
a way that you can
practice SQL injection
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.340 --> 00:32.070 align:middle line:90%
a way that you can
practice SQL injection

16
00:32.070 --> 00:34.440 align:middle line:90%
and learn how
hackers actually work

17
00:34.440 --> 00:36.900 align:middle line:90%
through the process of
performing this attack.

18
00:36.900 --> 00:37.920 align:middle line:84%
Let's get going.

19
00:37.920 --> 00:40.680 align:middle line:90%
In order to really
understand a lot of attacks,

20
00:40.680 --> 00:44.370 align:middle line:90%
you really need to understand
how applications work

21
00:44.370 --> 00:46.470 align:middle line:90%
on the most basic
level, and what

22
00:46.470 --> 00:49.500 align:middle line:90%
we're going to do before we
jump into the SQL injection is

23
00:49.500 --> 00:51.840 align:middle line:90%
talk about, what does
an application really

24
00:51.840 --> 00:53.070 align:middle line:84%
do under the hood?

25
00:53.070 --> 00:54.480 align:middle line:84%
What does SQL do?

26
00:54.480 --> 00:56.040 align:middle line:84%
What does the SQL database do?

27
00:56.040 --> 00:58.590 align:middle line:90%
Where does all of this
tie-in together, and then

28
00:58.590 --> 01:00.960 align:middle line:90%
we can understand how
attackers are going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.590 --> 01:00.960 align:middle line:90%
we can understand how
attackers are going

29
01:00.960 --> 01:02.815 align:middle line:84%
to try to exploit this attack.

30
01:02.815 --> 01:04.440 align:middle line:90%
So what I want you
to do here is I want

31
01:04.440 --> 01:05.519 align:middle line:84%
you to imagine this is you.

32
01:05.519 --> 01:07.311 align:middle line:90%
You're smiling and
you're happy, and you're

33
01:07.311 --> 01:10.410 align:middle line:90%
shopping online on your
favorite online retailer, who

34
01:10.410 --> 01:13.170 align:middle line:90%
might offer two-day free
shipping and video streaming

35
01:13.170 --> 01:15.930 align:middle line:90%
services and books and all sorts
of other good things like that.

36
01:15.930 --> 01:19.500 align:middle line:90%
From what you see, you
just log in to the website,

37
01:19.500 --> 01:21.510 align:middle line:90%
you start adding
things to your cart,

38
01:21.510 --> 01:23.190 align:middle line:84%
and then you click Purchase.

39
01:23.190 --> 01:25.750 align:middle line:90%
Under the hood, a
lot of things happen.

40
01:25.750 --> 01:28.350 align:middle line:90%
So let's explore for
a moment theoretically

41
01:28.350 --> 01:30.900 align:middle line:90%
about how this application
may be working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.350 --> 01:30.900 align:middle line:90%
about how this application
may be working.

42
01:30.900 --> 01:32.820 align:middle line:90%
You see, you've added
something to your cart.

43
01:32.820 --> 01:34.800 align:middle line:90%
I'm just going to create
a little bean here,

44
01:34.800 --> 01:37.410 align:middle line:90%
and I'll draw some pink
things to represent

45
01:37.410 --> 01:39.000 align:middle line:90%
what you're buying,
and these things

46
01:39.000 --> 01:40.300 align:middle line:84%
are now sitting in your car.

47
01:40.300 --> 01:42.930 align:middle line:90%
You've got them locked and
loaded and ready to go,

48
01:42.930 --> 01:45.000 align:middle line:90%
and now you're ready
to purchase it.

49
01:45.000 --> 01:47.850 align:middle line:90%
What's important for
this application to do

50
01:47.850 --> 01:50.580 align:middle line:90%
is to create a record
of your purchase.

51
01:50.580 --> 01:52.830 align:middle line:90%
It needs to know things like,
where is it shipping to?

52
01:52.830 --> 01:54.360 align:middle line:84%
What credit card did it charge?

53
01:54.360 --> 01:56.040 align:middle line:84%
Was the charge successful?

54
01:56.040 --> 01:57.780 align:middle line:90%
What was the shipping
that it promised?

55
01:57.780 --> 02:00.150 align:middle line:90%
So the first thing
the application does
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:57.780 --> 02:00.150 align:middle line:90%
So the first thing
the application does

56
02:00.150 --> 02:03.240 align:middle line:90%
is it sends all of this
information to a server,

57
02:03.240 --> 02:05.640 align:middle line:90%
and this is one of the first
and most important aspects

58
02:05.640 --> 02:06.570 align:middle line:84%
to focus on.

59
02:06.570 --> 02:09.240 align:middle line:90%
All of this stuff that you've
been doing up to this point

60
02:09.240 --> 02:13.060 align:middle line:90%
took place in your web browser,
like Firefox, for instance.

61
02:13.060 --> 02:14.670 align:middle line:90%
Your browsing the
website, you're

62
02:14.670 --> 02:16.320 align:middle line:84%
adding things to your cart.

63
02:16.320 --> 02:17.980 align:middle line:90%
You're clicking on
things and making

64
02:17.980 --> 02:20.190 align:middle line:90%
little dialog boxes
pop up, and all of that

65
02:20.190 --> 02:22.230 align:middle line:90%
is happening in
your web browser.

66
02:22.230 --> 02:25.410 align:middle line:90%
Because your web browser
has downloaded some files

67
02:25.410 --> 02:28.260 align:middle line:90%
like an HTML file
or a JavaScript file

68
02:28.260 --> 02:31.530 align:middle line:90%
or a CSS file, that's really
all that a web browser does
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:28.260 --> 02:31.530 align:middle line:90%
or a CSS file, that's really
all that a web browser does

69
02:31.530 --> 02:33.480 align:middle line:90%
is it downloads these
little documents

70
02:33.480 --> 02:35.250 align:middle line:90%
and turns them
into a pretty page

71
02:35.250 --> 02:36.580 align:middle line:84%
that you can interact with.

72
02:36.580 --> 02:39.210 align:middle line:90%
But once it's time to
do something actionable,

73
02:39.210 --> 02:42.780 align:middle line:90%
like creating a purchase so
that it charges your credit card

74
02:42.780 --> 02:45.420 align:middle line:90%
and it goes to the
shipping, that information

75
02:45.420 --> 02:49.380 align:middle line:90%
leaves the web browser, and
it first goes into a server.

76
02:49.380 --> 02:53.280 align:middle line:90%
This is oftentimes called
the application server

77
02:53.280 --> 02:55.860 align:middle line:84%
or the back end server.

78
02:55.860 --> 02:58.260 align:middle line:90%
So all of your purchase
order information

79
02:58.260 --> 03:00.720 align:middle line:90%
arrives at the
server, and the server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.260 --> 03:00.720 align:middle line:90%
arrives at the
server, and the server

80
03:00.720 --> 03:02.610 align:middle line:90%
has a little application
that's running

81
03:02.610 --> 03:06.060 align:middle line:90%
on it that looks at this
information and validates it.

82
03:06.060 --> 03:08.860 align:middle line:90%
It validates that information
was entered correctly

83
03:08.860 --> 03:11.400 align:middle line:90%
and formatted correctly,
and it understands

84
03:11.400 --> 03:13.290 align:middle line:90%
who is trying to
work with, and then

85
03:13.290 --> 03:15.390 align:middle line:90%
it sends information
all over the place.

86
03:15.390 --> 03:17.950 align:middle line:90%
Once it's validated that
your order is successful,

87
03:17.950 --> 03:21.360 align:middle line:90%
it may send information
down to the shipping team.

88
03:21.360 --> 03:24.910 align:middle line:90%
It may send information
to an analytics team,

89
03:24.910 --> 03:27.570 align:middle line:90%
or maybe even a
customer support team.

90
03:27.570 --> 03:30.330 align:middle line:90%
That way, someone can follow
up with you on your purchase.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:27.570 --> 03:30.330 align:middle line:90%
That way, someone can follow
up with you on your purchase.

91
03:30.330 --> 03:32.430 align:middle line:90%
But then ultimately,
what has to happen

92
03:32.430 --> 03:37.178 align:middle line:90%
is this record of your purchase
has to be stored in a database.

93
03:37.178 --> 03:39.720 align:middle line:90%
So one of the very next things
that our server is going to do

94
03:39.720 --> 03:42.870 align:middle line:90%
is it's going to send
this data into a database.

95
03:42.870 --> 03:45.030 align:middle line:90%
You can think of a
database as nothing

96
03:45.030 --> 03:48.510 align:middle line:90%
more than a gigantic
collection of Excel files.

97
03:48.510 --> 03:50.760 align:middle line:90%
If you've worked with
an Excel sheet before,

98
03:50.760 --> 03:52.350 align:middle line:84%
you're in good company.

99
03:52.350 --> 03:55.200 align:middle line:90%
You probably understand or
you could look at a database

100
03:55.200 --> 03:56.940 align:middle line:90%
and understand what's
happening here.

101
03:56.940 --> 03:59.490 align:middle line:90%
And these databases
are often run

102
03:59.490 --> 04:03.970 align:middle line:90%
with the SQL structured query
language programming language.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:59.490 --> 04:03.970 align:middle line:90%
with the SQL structured query
language programming language.

103
04:03.970 --> 04:05.730 align:middle line:90%
So for kind of
recapping the journey,

104
04:05.730 --> 04:08.140 align:middle line:90%
your little web browser
has downloaded a website

105
04:08.140 --> 04:11.040 align:middle line:90%
and you've interacted with
it and triggered an action.

106
04:11.040 --> 04:13.080 align:middle line:90%
So your web browser
and the website

107
04:13.080 --> 04:15.160 align:middle line:84%
send information to the server.

108
04:15.160 --> 04:18.300 align:middle line:90%
If you're curious, the server's
probably running a programming

109
04:18.300 --> 04:20.790 align:middle line:84%
language like C# or JavaScript.

110
04:20.790 --> 04:23.430 align:middle line:90%
And then from here, the server
will validate that information

111
04:23.430 --> 04:25.930 align:middle line:90%
and send it all over to all
the different resources,

112
04:25.930 --> 04:28.620 align:middle line:90%
including to the
SQL server database,

113
04:28.620 --> 04:31.260 align:middle line:90%
and it communicates to this
using the SQL programming
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:28.620 --> 04:31.260 align:middle line:90%
and it communicates to this
using the SQL programming

114
04:31.260 --> 04:31.890 align:middle line:84%
language.

115
04:31.890 --> 04:36.330 align:middle line:90%
And this is the architecture
of the three tier application.

116
04:36.330 --> 04:39.640 align:middle line:90%
You have the web tier,
you have the app tier,

117
04:39.640 --> 04:41.920 align:middle line:90%
and then you have
the database tier.

118
04:41.920 --> 04:43.470 align:middle line:90%
So this now begs
the question, what

119
04:43.470 --> 04:45.390 align:middle line:84%
is the SQL injection attack?

120
04:45.390 --> 04:46.920 align:middle line:84%
What is a hacker trying to do.

121
04:46.920 --> 04:49.170 align:middle line:90%
Let me clear the screen and
tell you a little bit more

122
04:49.170 --> 04:50.515 align:middle line:84%
about the SQL injection.

123
04:50.515 --> 04:52.515 align:middle line:90%
Now, we imagine that we're
on that same website.

124
04:52.515 --> 04:56.490 align:middle line:90%
And at the very top of that
website, there is a search bar.

125
04:56.490 --> 04:58.920 align:middle line:90%
If the web application
itself has not

126
04:58.920 --> 05:01.510 align:middle line:90%
been programmed
correctly to parse
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:58.920 --> 05:01.510 align:middle line:90%
been programmed
correctly to parse

127
05:01.510 --> 05:04.780 align:middle line:90%
the information in a search
bar and validate that it's good

128
05:04.780 --> 05:08.620 align:middle line:90%
first, we could actually
write actual computer code

129
05:08.620 --> 05:11.890 align:middle line:90%
in the search bar and try
and send that computer code

130
05:11.890 --> 05:15.190 align:middle line:90%
straight into the server or
straight into the database.

131
05:15.190 --> 05:17.320 align:middle line:84%
This is called an injection.

132
05:17.320 --> 05:19.420 align:middle line:90%
And in the SQL
injection attack, what

133
05:19.420 --> 05:22.630 align:middle line:90%
a hacker is trying to do is
they're trying to manipulate

134
05:22.630 --> 05:26.380 align:middle line:90%
the search bar to actually
write SQL code that may look

135
05:26.380 --> 05:30.180 align:middle line:90%
something like select
star from database,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:26.380 --> 05:30.180 align:middle line:90%
something like select
star from database,

136
05:30.180 --> 05:32.290 align:middle line:90%
so that when they click
the Search button,

137
05:32.290 --> 05:37.240 align:middle line:90%
it sends this SQL code straight
into the database to retrieve

138
05:37.240 --> 05:39.910 align:middle line:90%
information out of the
database but what comes back

139
05:39.910 --> 05:43.030 align:middle line:90%
is the actual search
query from the database.

140
05:43.030 --> 05:45.280 align:middle line:90%
So with that in mind, let's
take a little moment, just

141
05:45.280 --> 05:48.760 align:middle line:90%
like a 30-second overview
of what SQL really does.

142
05:48.760 --> 05:52.000 align:middle line:90%
When we see a Select
statement written in SQL,

143
05:52.000 --> 05:54.610 align:middle line:90%
what it's trying to
say is retrieved data

144
05:54.610 --> 05:55.540 align:middle line:84%
from the database.

145
05:55.540 --> 05:57.980 align:middle line:84%
Select data from the database.

146
05:57.980 --> 06:00.970 align:middle line:90%
And when you see something
like select star from,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:57.980 --> 06:00.970 align:middle line:90%
And when you see something
like select star from,

147
06:00.970 --> 06:05.590 align:middle line:90%
this is saying select all
data from a specific table,

148
06:05.590 --> 06:07.600 align:middle line:90%
or a fancy way of
saying an Excel sheet,

149
06:07.600 --> 06:08.870 align:middle line:84%
out of the database.

150
06:08.870 --> 06:13.120 align:middle line:90%
So if I were to type this into
my search bar and click Go,

151
06:13.120 --> 06:15.430 align:middle line:90%
the website would end
up going to the database

152
06:15.430 --> 06:18.910 align:middle line:90%
and retrieving all
data out of this table

153
06:18.910 --> 06:20.440 align:middle line:84%
and returning that back to me.

154
06:20.440 --> 06:22.720 align:middle line:90%
But beyond that, outside
of just retrieving data

155
06:22.720 --> 06:26.380 align:middle line:90%
from a database, we can
use an Insert statement

156
06:26.380 --> 06:28.300 align:middle line:84%
to write data to a database.

157
06:28.300 --> 06:32.860 align:middle line:90%
We can use a Delete statement
to delete data from a database.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
06:28.300 --> 06:32.860 align:middle line:90%
We can use a Delete statement
to delete data from a database.

158
06:32.860 --> 06:36.970 align:middle line:90%
We can use a drop statement
to delete an entire table

159
06:36.970 --> 06:39.400 align:middle line:90%
or entire database
from a database,

160
06:39.400 --> 06:42.070 align:middle line:90%
and depending on what
the hacker's objective is

161
06:42.070 --> 06:45.310 align:middle line:90%
will determine which type of
statement he'll they'll use.

162
06:45.310 --> 06:46.990 align:middle line:90%
They could use a
select statement

163
06:46.990 --> 06:50.860 align:middle line:90%
to retrieve say credit card
information or usernames

164
06:50.860 --> 06:51.910 align:middle line:84%
and passwords.

165
06:51.910 --> 06:53.680 align:middle line:90%
They could use an
Insert statement

166
06:53.680 --> 06:55.660 align:middle line:90%
to write new records
to the database that

167
06:55.660 --> 06:57.310 align:middle line:84%
are totally bogus and spoofed.

168
06:57.310 --> 06:59.740 align:middle line:90%
They could use a drop
or a Delete statement

169
06:59.740 --> 07:02.800 align:middle line:90%
to try and damage the database
by taking it down and deleting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:59.740 --> 07:02.800 align:middle line:90%
to try and damage the database
by taking it down and deleting

170
07:02.800 --> 07:04.010 align:middle line:84%
information out of it.

171
07:04.010 --> 07:06.250 align:middle line:90%
So the mitigation
technique here is

172
07:06.250 --> 07:09.340 align:middle line:90%
to look at the code to
tell your application

173
07:09.340 --> 07:12.550 align:middle line:90%
server to first look at
what they searched for

174
07:12.550 --> 07:16.240 align:middle line:90%
and try and determine if
it's a programming language

175
07:16.240 --> 07:18.170 align:middle line:84%
like a Select statement.

176
07:18.170 --> 07:20.470 align:middle line:90%
In fact, if you looked at
the very name of this video,

177
07:20.470 --> 07:22.660 align:middle line:84%
it looked like a SQL injection.

178
07:22.660 --> 07:24.430 align:middle line:90%
But now, it's time
to see it in action.

179
07:24.430 --> 07:27.460 align:middle line:90%
This is the part where I want
to show you a resource where

180
07:27.460 --> 07:29.620 align:middle line:90%
you can actually
practice this attack

181
07:29.620 --> 07:32.300 align:middle line:90%
and walk through the steps
that our hacker will actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:29.620 --> 07:32.300 align:middle line:90%
and walk through the steps
that our hacker will actually

182
07:32.300 --> 07:32.800 align:middle line:84%
go through.

183
07:32.800 --> 07:33.543 align:middle line:84%
This is so cool.

184
07:33.543 --> 07:34.960 align:middle line:90%
Let me clear the
screen, and we're

185
07:34.960 --> 07:36.543 align:middle line:90%
going to bring up a
web browser, and I

186
07:36.543 --> 07:37.960 align:middle line:84%
encourage you to follow along.

187
07:37.960 --> 07:40.543 align:middle line:90%
The website that we're going to,
as you can see on the screen,

188
07:40.543 --> 07:43.444 align:middle line:90%
is hacksplaining.co
m/exercises/sqlinjection.

189
07:43.444 --> 07:46.010 align:middle line:84%


190
07:46.010 --> 07:47.860 align:middle line:90%
If I give that a
click, this is it.

191
07:47.860 --> 07:50.710 align:middle line:90%
They've now simulated a
little banking website,

192
07:50.710 --> 07:54.400 align:middle line:90%
where we can try and inject
SQL code into the login

193
07:54.400 --> 07:55.340 align:middle line:84%
and password.

194
07:55.340 --> 07:57.330 align:middle line:90%
So this little pop up
box here is a guide

195
07:57.330 --> 07:59.830 align:middle line:90%
that's going to walk you through
the steps of how to perform

196
07:59.830 --> 08:02.380 align:middle line:90%
this attack and what the
hacker would actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
07:59.830 --> 08:02.380 align:middle line:90%
this attack and what the
hacker would actually

197
08:02.380 --> 08:04.160 align:middle line:84%
look for in the real world.

198
08:04.160 --> 08:05.803 align:middle line:90%
You can click on
these to move forward,

199
08:05.803 --> 08:06.970 align:middle line:84%
and this is what it's doing.

200
08:06.970 --> 08:10.210 align:middle line:90%
It's showing you the
actual log of your website.

201
08:10.210 --> 08:12.745 align:middle line:90%
If you press F12 in
your web browser,

202
08:12.745 --> 08:15.370 align:middle line:90%
this is where you could actually
view the logs of your website.

203
08:15.370 --> 08:17.573 align:middle line:90%
It's right here in this
little console section.

204
08:17.573 --> 08:19.240 align:middle line:90%
This is what they're
trying to tell you.

205
08:19.240 --> 08:20.980 align:middle line:90%
This is what you would be
looking for if you were

206
08:20.980 --> 08:22.347 align:middle line:84%
trying to attack this website.

207
08:22.347 --> 08:24.430 align:middle line:90%
So let me close this to
bring up some screen here,

208
08:24.430 --> 08:25.780 align:middle line:90%
and it says here are
the application logs.

209
08:25.780 --> 08:27.280 align:middle line:90%
Watch what happens
when you interact

210
08:27.280 --> 08:28.570 align:middle line:84%
with a vulnerable application.

211
08:28.570 --> 08:32.380 align:middle line:90%
So it tells you, try and type in
this password and email address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
08:28.570 --> 08:32.380 align:middle line:90%
So it tells you, try and type in
this password and email address

212
08:32.380 --> 08:33.460 align:middle line:84%
and click Log In.

213
08:33.460 --> 08:35.470 align:middle line:90%
Well, it says this is
an unknown password,

214
08:35.470 --> 08:37.600 align:middle line:90%
but now, what they're
encouraging us to do

215
08:37.600 --> 08:41.350 align:middle line:90%
is to add in a single quote
in the password field.

216
08:41.350 --> 08:45.220 align:middle line:90%
You see, in SQL,
quotes denote text.

217
08:45.220 --> 08:48.640 align:middle line:90%
So our assumption is that
somewhere in their SQL code,

218
08:48.640 --> 08:51.190 align:middle line:90%
they've created an open
quote and we're now

219
08:51.190 --> 08:54.650 align:middle line:90%
injecting a close quote
in that text field.

220
08:54.650 --> 08:56.530 align:middle line:90%
So if I click Log
In now, it says

221
08:56.530 --> 08:58.840 align:middle line:90%
there's an unexpected
error, but look at this.

222
08:58.840 --> 09:00.490 align:middle line:84%
Look right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
08:58.840 --> 09:00.490 align:middle line:84%
Look right here.

223
09:00.490 --> 09:04.390 align:middle line:90%
The log has now spit out the
secret code that's failing,

224
09:04.390 --> 09:07.510 align:middle line:90%
and now we know that we have
direct access to the SQL

225
09:07.510 --> 09:08.420 align:middle line:84%
database.

226
09:08.420 --> 09:10.840 align:middle line:90%
So we'll step through it one
more time, and it points out,

227
09:10.840 --> 09:13.880 align:middle line:90%
hey, look, here's the SQL
syntax error that it's throwing.

228
09:13.880 --> 09:16.552 align:middle line:90%
And from that, we can now
actually see the SQL code

229
09:16.552 --> 09:18.010 align:middle line:90%
that it's trying
to run, and we see

230
09:18.010 --> 09:20.590 align:middle line:90%
where we've injected the
additional single quote.

231
09:20.590 --> 09:24.430 align:middle line:90%
So if I type password and
single quote, we've now seen,

232
09:24.430 --> 09:27.100 align:middle line:90%
each time I type the quote and
then delete the quote and then

233
09:27.100 --> 09:30.040 align:middle line:90%
type the quote again, we
see how the syntax updates.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

233
09:27.100 --> 09:30.040 align:middle line:90%
type the quote again, we
see how the syntax updates.

234
09:30.040 --> 09:32.020 align:middle line:90%
And it tells us what
type of injection

235
09:32.020 --> 09:33.290 align:middle line:84%
we're doing right here.

236
09:33.290 --> 09:34.930 align:middle line:90%
And now we know that
it's vulnerable.

237
09:34.930 --> 09:38.470 align:middle line:90%
So now it's encouraging us to
write our code like this, where

238
09:38.470 --> 09:40.220 align:middle line:84%
we could type a close quote--

239
09:40.220 --> 09:44.740 align:middle line:90%
where in the password field, we
could type a close quote or 1

240
09:44.740 --> 09:47.230 align:middle line:84%
equals 1 minus minus.

241
09:47.230 --> 09:51.490 align:middle line:90%
The minus minus comments any
following subsequent quote out.

242
09:51.490 --> 09:53.350 align:middle line:90%
So you can see what
we've done here.

243
09:53.350 --> 09:55.840 align:middle line:90%
We're saying, where
the password is blank

244
09:55.840 --> 09:59.670 align:middle line:90%
or where 1 equals 1, which
means 1 always equals 1,

245
09:59.670 --> 10:01.840 align:middle line:90%
and it's going to return
to me all the data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

245
09:59.670 --> 10:01.840 align:middle line:90%
and it's going to return
to me all the data.

246
10:01.840 --> 10:04.350 align:middle line:90%
So if I click Log In
now, look at that.

247
10:04.350 --> 10:07.140 align:middle line:90%
We found a way into
someone's bank account

248
10:07.140 --> 10:09.310 align:middle line:84%
by leveraging a SQL injection.

249
10:09.310 --> 10:11.040 align:middle line:90%
So the mitigation
technique here was

250
10:11.040 --> 10:13.350 align:middle line:90%
that we should have parsed
this information out.

251
10:13.350 --> 10:16.170 align:middle line:90%
We shouldn't allow single quotes
in the first place or double

252
10:16.170 --> 10:19.410 align:middle line:90%
quotes in the first place or we
should escape those characters

253
10:19.410 --> 10:21.460 align:middle line:90%
if we're expecting
them in our code.

254
10:21.460 --> 10:24.150 align:middle line:90%
So that's been introducing
how the SQL injection really

255
10:24.150 --> 10:26.342 align:middle line:90%
works in a way that you
can practice it right now.

256
10:26.342 --> 10:28.050 align:middle line:90%
I hope this has been
informative for you,

257
10:28.050 --> 10:30.710 align:middle line:90%
and I'd like to thank
you for viewing.