1
00:00:02,020 --> 00:00:07,230
So I just want to highlight why Asriel injections are so important and so dangerous.

2
00:00:08,190 --> 00:00:14,180
The reason behind that is they are fine and you can find them everywhere and play a lot of places a

3
00:00:14,180 --> 00:00:19,040
lot of big Web sites have these kind of exploits and like things like Yahoo.

4
00:00:19,050 --> 00:00:20,350
Google had them.

5
00:00:20,410 --> 00:00:25,890
It's they're very hard to protect against and it's very easy to make a mistake to make these exploits

6
00:00:25,950 --> 00:00:28,630
available for exploitation.

7
00:00:31,340 --> 00:00:36,860
The other reason that they're very dangerous is that they give you access to the database in many scenarios

8
00:00:36,860 --> 00:00:43,870
if you find the skill injection you really don't need to upload a Ph.D. show or get a reverse connection.

9
00:00:43,940 --> 00:00:48,720
There is really no point of uploading stuff and then increasing the danger of being caught.

10
00:00:48,890 --> 00:00:53,840
Cause if you have access to the database as we see in here you pretty much have everything you need.

11
00:00:53,850 --> 00:00:59,150
You have usernames passwords you can log in with normal username and password as a normal user or you

12
00:00:59,150 --> 00:01:01,340
can if you're looking for sensitive data.

13
00:01:01,340 --> 00:01:03,700
We can see that we had access to credit cards.

14
00:01:03,950 --> 00:01:09,350
You pretty much can do anything you want so there there's really no point of trying to further exploit

15
00:01:09,350 --> 00:01:12,140
the system if you are going to scale injection Bingo like that.

16
00:01:12,150 --> 00:01:19,040
That's all you need really in many scenarios we actually use a PH we show to gain access to the database

17
00:01:19,040 --> 00:01:20,250
and see if we can read it.

18
00:01:20,290 --> 00:01:25,870
I say for example if you manage to upload a page PCL on the server on the server other floatable But

19
00:01:25,940 --> 00:01:28,150
then you couldn't access the database.

20
00:01:28,220 --> 00:01:32,990
There isn't much that you can see you can see credit cards you can see a username and password.

21
00:01:33,350 --> 00:01:38,110
You really can you have control over the server but you can't read stuff.

22
00:01:38,120 --> 00:01:44,110
So sometimes when you upload a PH reshelve the next step is to gain access to the database.

23
00:01:44,990 --> 00:01:48,410
Another thing is that they can be used to do many things.

24
00:01:48,410 --> 00:01:54,320
So if you find if you manage to find that Asgill injection in a web site that is not your target so

25
00:01:54,320 --> 00:01:57,300
it's not the one that you're targeting but it's in the same server.

26
00:01:57,500 --> 00:02:00,760
Then you can use it to read files outside the W.W. root.

27
00:02:00,770 --> 00:02:06,530
So similar to file inclusion vulnerabilities you can use it you can use the Ogmund the username and

28
00:02:06,530 --> 00:02:12,380
password for the admin and see if you can upload so usually the admin can upload a lot of things instead

29
00:02:12,380 --> 00:02:13,280
of just the images.

30
00:02:13,400 --> 00:02:19,100
And then you can upload APHC shell or Bicester from there and then from there navigate to your target

31
00:02:19,100 --> 00:02:23,890
computer or to the target's website sorry.

32
00:02:23,990 --> 00:02:30,700
Or you can actually in some cases you can use it to upload a page we surely can use this and Asgill

33
00:02:30,780 --> 00:02:32,810
injection to upload a page we show.

34
00:02:32,970 --> 00:02:37,040
So basically Asgill injections can be used as well including vulnerabilities.

35
00:02:37,140 --> 00:02:43,650
They can be used as file upload vulnerabilities and also they'll give you access to the whole database.

36
00:02:43,650 --> 00:02:48,230
That's why they are very very dangerous and very useful if you manage to find one.