1 00:00:00,023 --> 00:00:01,350 ‫Instructor: Hi. 2 00:00:01,350 --> 00:00:03,570 ‫Within this lecture we are gonna go ahead 3 00:00:03,570 --> 00:00:06,870 ‫and solve the API8 challenge. 4 00:00:06,870 --> 00:00:08,790 ‫So if we take a look at the API8, 5 00:00:08,790 --> 00:00:10,980 ‫it says injection. 6 00:00:10,980 --> 00:00:12,210 ‫So far so good. 7 00:00:12,210 --> 00:00:15,210 ‫So this is probably SQL injection. 8 00:00:15,210 --> 00:00:18,120 ‫And if you're watching the web pen testing course 9 00:00:18,120 --> 00:00:21,630 ‫then you know a great deal of SQL injection by now, 10 00:00:21,630 --> 00:00:25,170 ‫because we have seen it in a great detail, 11 00:00:25,170 --> 00:00:26,700 ‫in a great depth. 12 00:00:26,700 --> 00:00:29,905 ‫But if you're watching the mobile Ethical Hacking course, 13 00:00:29,905 --> 00:00:31,230 ‫as I said before, 14 00:00:31,230 --> 00:00:32,700 ‫I put the section in both 15 00:00:32,700 --> 00:00:34,982 ‫of the courses because it is related 16 00:00:34,982 --> 00:00:36,930 ‫with both of them. 17 00:00:36,930 --> 00:00:38,640 ‫So maybe you don't know 18 00:00:38,640 --> 00:00:41,257 ‫a great deal about SQL injection. 19 00:00:41,257 --> 00:00:42,176 ‫Okay, 20 00:00:42,176 --> 00:00:43,770 ‫so in a nutshell, 21 00:00:43,770 --> 00:00:46,357 ‫we are trying to run SQL comments 22 00:00:46,357 --> 00:00:48,180 ‫in the database, 23 00:00:48,180 --> 00:00:49,440 ‫in the remote database, 24 00:00:49,440 --> 00:00:52,290 ‫so that we can gather information out of it. 25 00:00:52,290 --> 00:00:53,310 ‫But these comments, 26 00:00:53,310 --> 00:00:54,143 ‫of course 27 00:00:54,143 --> 00:00:58,470 ‫are not meant to be executed by a regular person. 28 00:00:58,470 --> 00:01:00,430 ‫So it's a vulnerability 29 00:01:01,727 --> 00:01:03,090 ‫and you have to listen 30 00:01:03,090 --> 00:01:05,010 ‫like a couple of sections in order 31 00:01:05,010 --> 00:01:07,200 ‫to fully understand this. 32 00:01:07,200 --> 00:01:10,230 ‫Fully understand the logic behind it. 33 00:01:10,230 --> 00:01:12,900 ‫If you are curious about the SQL injection 34 00:01:12,900 --> 00:01:15,000 ‫and you're coming from mobile application, 35 00:01:15,000 --> 00:01:17,040 ‫Mobile Ethical Hacking course, 36 00:01:17,040 --> 00:01:20,400 ‫I suggest you do a quick research and then come back 37 00:01:20,400 --> 00:01:21,330 ‫and watch this. 38 00:01:21,330 --> 00:01:23,420 ‫Because I'm just gonna go ahead 39 00:01:23,420 --> 00:01:26,130 ‫and show you a very quick tool 40 00:01:26,130 --> 00:01:27,870 ‫or very quick way 41 00:01:27,870 --> 00:01:31,890 ‫to find out about the SQL injection vulnerabilities. 42 00:01:31,890 --> 00:01:33,330 ‫Okay, 43 00:01:33,330 --> 00:01:35,130 ‫so what we are going to do, let's see 44 00:01:35,130 --> 00:01:37,260 ‫what kind of endpoints do we have over here? 45 00:01:37,260 --> 00:01:38,580 ‫We have a login 46 00:01:38,580 --> 00:01:41,010 ‫with a username and a password 47 00:01:41,010 --> 00:01:43,320 ‫and also we have a secret, 48 00:01:43,320 --> 00:01:44,670 ‫okay, after we log in 49 00:01:44,670 --> 00:01:47,400 ‫most probably we get a user token 50 00:01:47,400 --> 00:01:49,050 ‫like an authentication token 51 00:01:49,050 --> 00:01:51,726 ‫and using that authentication token 52 00:01:51,726 --> 00:01:53,913 ‫we can get the secret back. 53 00:01:54,900 --> 00:01:56,010 ‫As you can see, 54 00:01:56,010 --> 00:01:58,170 ‫if we come over here to the headers 55 00:01:58,170 --> 00:02:01,225 ‫as you can see there's an API authentication token 56 00:02:01,225 --> 00:02:04,890 ‫but we don't have that unless we log in. 57 00:02:04,890 --> 00:02:08,280 ‫And to log in, there is a username and password. 58 00:02:08,280 --> 00:02:11,408 ‫I'm just gonna go ahead and give some random tests 59 00:02:11,408 --> 00:02:13,440 ‫like test, test 1, 2, 3. 60 00:02:13,440 --> 00:02:14,520 ‫As you can see, 61 00:02:14,520 --> 00:02:18,000 ‫it says incorrect username and password 62 00:02:18,000 --> 00:02:21,090 ‫but we don't have any kind of other hint. 63 00:02:21,090 --> 00:02:23,700 ‫In the previous examples we have come across 64 00:02:23,700 --> 00:02:25,380 ‫in a situation like this. 65 00:02:25,380 --> 00:02:29,700 ‫But then we had some data leakage scenario, 66 00:02:29,700 --> 00:02:34,140 ‫so we have found out some resources in our app, 67 00:02:34,140 --> 00:02:36,120 ‫but right now this isn't the case. 68 00:02:36,120 --> 00:02:38,943 ‫So I'm just gonna go ahead and send this to Burp Suite. 69 00:02:39,840 --> 00:02:40,673 ‫Here you go. 70 00:02:40,673 --> 00:02:43,020 ‫Now I'm in the Burp Suite again, 71 00:02:43,020 --> 00:02:44,970 ‫Since I don't have any wordless, 72 00:02:44,970 --> 00:02:46,620 ‫since I don't have any users 73 00:02:46,620 --> 00:02:48,150 ‫and password less, 74 00:02:48,150 --> 00:02:50,280 ‫I'm just going to send this to intruder 75 00:02:50,280 --> 00:02:54,330 ‫but we are not going to brute force usernames and password. 76 00:02:54,330 --> 00:02:55,163 ‫Okay? 77 00:02:55,163 --> 00:03:00,090 ‫We are going to just go ahead and try SQL injection. 78 00:03:00,090 --> 00:03:01,200 ‫In order to do that 79 00:03:01,200 --> 00:03:03,570 ‫I'm just gonna clear out the selections 80 00:03:03,570 --> 00:03:07,098 ‫because we don't need to change the P H P S S I D. 81 00:03:07,098 --> 00:03:10,137 ‫Okay, just click on the clear. 82 00:03:10,137 --> 00:03:14,623 ‫We are just going to change the username and the password. 83 00:03:14,623 --> 00:03:16,331 ‫So in order to do that 84 00:03:16,331 --> 00:03:20,668 ‫of course just select the thing that you want to change 85 00:03:20,668 --> 00:03:22,006 ‫and then edit 86 00:03:22,006 --> 00:03:23,516 ‫like this. 87 00:03:23,516 --> 00:03:25,427 ‫So I'm going to do it one more time. 88 00:03:25,427 --> 00:03:26,404 ‫Here you go. 89 00:03:26,404 --> 00:03:30,000 ‫Make sure you don't change the P H P S S I D. 90 00:03:30,000 --> 00:03:31,980 ‫So far, so good. 91 00:03:31,980 --> 00:03:34,830 ‫Right now, since I have this, 92 00:03:34,830 --> 00:03:38,310 ‫I have two different parameters, right? 93 00:03:38,310 --> 00:03:41,400 ‫I have the username and I have the password. 94 00:03:41,400 --> 00:03:46,170 ‫So if I had one parameter, then I would go for a sniper. 95 00:03:46,170 --> 00:03:48,475 ‫And we had two parameters before, 96 00:03:48,475 --> 00:03:51,510 ‫I believe we went for pitchfork, 97 00:03:51,510 --> 00:03:55,140 ‫but this time we can go for something else. 98 00:03:55,140 --> 00:03:57,870 ‫And let me show you what it is. 99 00:03:57,870 --> 00:04:00,930 ‫We're gonna go for something called battering gram. 100 00:04:00,930 --> 00:04:03,990 ‫And in order to do that, you can just choose it 101 00:04:03,990 --> 00:04:06,540 ‫from the attack type and we are going to give it 102 00:04:06,540 --> 00:04:10,230 ‫on SQL list and we'll just grab the things 103 00:04:10,230 --> 00:04:13,286 ‫and try them for the both of the parameters. 104 00:04:13,286 --> 00:04:14,673 ‫Okay? 105 00:04:17,212 --> 00:04:18,812 ‫So why do we get this pay loads? 106 00:04:20,940 --> 00:04:22,230 ‫In fact, 107 00:04:22,230 --> 00:04:24,180 ‫if you have the Burb Suite 108 00:04:24,180 --> 00:04:26,340 ‫not free edition, not communicate edition, 109 00:04:26,340 --> 00:04:27,810 ‫but pro version, 110 00:04:27,810 --> 00:04:31,860 ‫you can actually just select it from this list. 111 00:04:31,860 --> 00:04:34,710 ‫This list has something like SQL injection, 112 00:04:34,710 --> 00:04:36,720 ‫this injection, that injection, 113 00:04:36,720 --> 00:04:39,750 ‫different kind of lists embedded 114 00:04:39,750 --> 00:04:43,110 ‫for us in the professional Burb Suite. 115 00:04:43,110 --> 00:04:46,064 ‫However, that is not the case for the community edition. 116 00:04:46,064 --> 00:04:47,490 ‫However, 117 00:04:47,490 --> 00:04:49,620 ‫we can actually Google it out 118 00:04:49,620 --> 00:04:52,770 ‫and just find that list or a similar list, 119 00:04:52,770 --> 00:04:53,603 ‫right? 120 00:04:53,603 --> 00:04:56,790 ‫So that we can just copy and paste it from there. 121 00:04:56,790 --> 00:04:59,400 ‫So I'm gonna go ahead and run search 122 00:04:59,400 --> 00:05:01,390 ‫for Burp Suite intruder 123 00:05:03,069 --> 00:05:05,130 ‫SQL injection fuzzer, 124 00:05:05,130 --> 00:05:05,963 ‫okay 125 00:05:05,963 --> 00:05:09,690 ‫maybe TXT or github, something like that. 126 00:05:09,690 --> 00:05:13,740 ‫So people tend to put those kind of things in gitup 127 00:05:13,740 --> 00:05:16,230 ‫and we can easily find that list 128 00:05:16,230 --> 00:05:19,200 ‫inside of any gitup repository. 129 00:05:19,200 --> 00:05:20,880 ‫You're gonna see we will have a lot 130 00:05:20,880 --> 00:05:23,841 ‫of options because I have done this before. 131 00:05:23,841 --> 00:05:27,123 ‫So I'm just gonna go ahead and search for this. 132 00:05:29,411 --> 00:05:31,380 ‫And here you go. 133 00:05:31,380 --> 00:05:32,670 ‫I believe there is something wrong 134 00:05:32,670 --> 00:05:34,740 ‫with my internet connection, but yeah, 135 00:05:34,740 --> 00:05:35,880 ‫here you go. 136 00:05:35,880 --> 00:05:39,060 ‫So we have a lot of results. 137 00:05:39,060 --> 00:05:41,400 ‫I'm going to open every one of them 138 00:05:41,400 --> 00:05:43,290 ‫not every one of them, well actually 139 00:05:43,290 --> 00:05:45,090 ‫but a couple of them at least, 140 00:05:45,090 --> 00:05:46,830 ‫so that we can see 141 00:05:46,830 --> 00:05:50,542 ‫and compare what kind of things we should use. 142 00:05:50,542 --> 00:05:52,620 ‫So for the first one, 143 00:05:52,620 --> 00:05:54,360 ‫I have a false list. 144 00:05:54,360 --> 00:05:58,290 ‫You don't need to go for the same repository with me 145 00:05:58,290 --> 00:06:00,330 ‫by the way, I'm just going one 146 00:06:00,330 --> 00:06:03,480 ‫by one and trying to figure out the best one. 147 00:06:03,480 --> 00:06:08,480 ‫I can share this SQL injection payloads with you later on. 148 00:06:08,820 --> 00:06:10,500 ‫So, let's see. 149 00:06:10,500 --> 00:06:12,754 ‫Yep, this one's no good. 150 00:06:12,754 --> 00:06:14,954 ‫This one is actually a little bit complicated, 151 00:06:14,954 --> 00:06:18,450 ‫so I'm not gonna go for that one. 152 00:06:18,450 --> 00:06:20,190 ‫Yeah, let's see. 153 00:06:20,190 --> 00:06:21,450 ‫Yeah, here we go. 154 00:06:21,450 --> 00:06:24,663 ‫This is just one liner, I'm not looking for that one. 155 00:06:26,531 --> 00:06:29,310 ‫Let's see this one, one entry, 156 00:06:29,310 --> 00:06:31,230 ‫okay, one entry. 157 00:06:31,230 --> 00:06:33,411 ‫I'm looking at that one. 158 00:06:33,411 --> 00:06:35,190 ‫And there is something called quick voice. 159 00:06:35,190 --> 00:06:36,780 ‫Here we go. 160 00:06:36,780 --> 00:06:38,040 ‫So in the quick fuzz, 161 00:06:38,040 --> 00:06:40,230 ‫there is a TXT file and I, 162 00:06:40,230 --> 00:06:41,760 ‫as far as I can see 163 00:06:41,760 --> 00:06:43,710 ‫this is not only SQL injection, 164 00:06:43,710 --> 00:06:45,570 ‫but there are so much more 165 00:06:45,570 --> 00:06:48,060 ‫but there is also SQL injection as well. 166 00:06:48,060 --> 00:06:48,893 ‫Here you go. 167 00:06:48,893 --> 00:06:50,460 ‫This is a good list. 168 00:06:50,460 --> 00:06:51,293 ‫Why not? 169 00:06:51,293 --> 00:06:52,440 ‫We use it, right? 170 00:06:52,440 --> 00:06:55,440 ‫As you can see, these are not related 171 00:06:55,440 --> 00:06:56,790 ‫with this SQL injection 172 00:06:56,790 --> 00:06:59,430 ‫but I believe it starts right here. 173 00:06:59,430 --> 00:07:02,853 ‫So I'm just gonna copy and paste this stuff into a txt. 174 00:07:04,050 --> 00:07:05,130 ‫Of course, again, 175 00:07:05,130 --> 00:07:06,600 ‫if you couldn't find this 176 00:07:06,600 --> 00:07:08,880 ‫of course you can just post the video and just 177 00:07:08,880 --> 00:07:11,190 ‫write the URL on your own, 178 00:07:11,190 --> 00:07:14,130 ‫like manually and just come to that file 179 00:07:14,130 --> 00:07:16,860 ‫and copy what I'm copying right now. 180 00:07:16,860 --> 00:07:21,860 ‫But I will just share it with the resources of this lecture. 181 00:07:22,170 --> 00:07:26,580 ‫So I'm copying this equal injection part 182 00:07:26,580 --> 00:07:31,580 ‫and I'm just gonna paste it to a Txt file on my desktop. 183 00:07:32,880 --> 00:07:35,010 ‫And if you're using Mac, 184 00:07:35,010 --> 00:07:37,020 ‫you can open the terminal 185 00:07:37,020 --> 00:07:40,020 ‫and go to desktop, like this CD desktop, 186 00:07:40,020 --> 00:07:41,940 ‫and just write touch 187 00:07:41,940 --> 00:07:45,540 ‫something like SQL injection dot txt. 188 00:07:45,540 --> 00:07:49,410 ‫Okay? It will create a file for you so that you can just 189 00:07:49,410 --> 00:07:51,270 ‫open it and paste the things. 190 00:07:51,270 --> 00:07:52,890 ‫Here you go. 191 00:07:52,890 --> 00:07:54,630 ‫Now this has been saved for me. 192 00:07:54,630 --> 00:07:57,810 ‫Of course, if you're using Windows, just create a txt file 193 00:07:57,810 --> 00:07:59,040 ‫like right click and say 194 00:07:59,040 --> 00:08:02,403 ‫new txt file or new tax file. 195 00:08:03,510 --> 00:08:04,470 ‫So far so good. 196 00:08:04,470 --> 00:08:06,720 ‫So I'm gonna open the Burb Suite, and by the way 197 00:08:06,720 --> 00:08:10,080 ‫I could have just pasted over here, but I had to save it so 198 00:08:10,080 --> 00:08:13,560 ‫that I can share it with you later on. 199 00:08:13,560 --> 00:08:15,870 ‫Since I have pasted this list, 200 00:08:15,870 --> 00:08:18,120 ‫I can deselect this url 201 00:08:18,120 --> 00:08:20,247 ‫encode these characters, 202 00:08:20,247 --> 00:08:22,290 ‫I believe. 203 00:08:22,290 --> 00:08:25,830 ‫And since I saw that, I remembered we are still 204 00:08:25,830 --> 00:08:27,270 ‫in the sniper, 205 00:08:27,270 --> 00:08:29,370 ‫so we cannot do that. 206 00:08:29,370 --> 00:08:32,160 ‫I'm just gonna go for the bettering gram. 207 00:08:32,160 --> 00:08:35,790 ‫As I said before, it'll just try this simple list 208 00:08:35,790 --> 00:08:38,130 ‫for the both of the parameters. 209 00:08:38,130 --> 00:08:41,370 ‫If we had chosen pitchfork like we did before 210 00:08:41,370 --> 00:08:43,980 ‫then we would have provided two lists. 211 00:08:43,980 --> 00:08:47,169 ‫But right now I just want one list and I want them 212 00:08:47,169 --> 00:08:50,430 ‫to try it on the both of the parameters. 213 00:08:50,430 --> 00:08:53,340 ‫Okay? That's why I have chosen battering gram. 214 00:08:53,340 --> 00:08:57,420 ‫So I'm gonna deselect this URL called these characters, 215 00:08:57,420 --> 00:08:59,400 ‫and that's about it. 216 00:08:59,400 --> 00:09:01,440 ‫So what I'm going to do 217 00:09:01,440 --> 00:09:04,260 ‫I'm just going to start this attack, 218 00:09:04,260 --> 00:09:07,230 ‫and of course we are gonna have to wait a little bit. 219 00:09:07,230 --> 00:09:08,070 ‫And as you can see 220 00:09:08,070 --> 00:09:09,737 ‫we're getting 500's, 221 00:09:09,737 --> 00:09:10,570 ‫403's. 222 00:09:11,610 --> 00:09:13,563 ‫We are going to wait a little bit. 223 00:09:15,018 --> 00:09:16,833 ‫And since it has only 107, 224 00:09:18,780 --> 00:09:21,180 ‫107 possibilities, 225 00:09:21,180 --> 00:09:23,220 ‫I believe it's gonna not 226 00:09:23,220 --> 00:09:27,240 ‫it's not gonna be as long as we have waited before 227 00:09:27,240 --> 00:09:31,230 ‫so that we can see the requests and responses immediately. 228 00:09:31,230 --> 00:09:34,953 ‫And again, we are just trying the sequel injections. 229 00:09:36,209 --> 00:09:38,820 ‫And if you have watched web pen testing course 230 00:09:38,820 --> 00:09:41,700 ‫then now you have another way 231 00:09:41,700 --> 00:09:45,807 ‫to tri SQL injection rather than SQL Map as well. 232 00:09:45,807 --> 00:09:48,164 ‫But if you're watching the Mobile 233 00:09:48,164 --> 00:09:50,926 ‫Mobile Ethical Hacking course 234 00:09:50,926 --> 00:09:54,240 ‫then you might wonder the logic behind this. 235 00:09:54,240 --> 00:09:58,350 ‫Again, I suggest you take my complete ethical hacking course 236 00:09:58,350 --> 00:09:59,820 ‫and watch it from here, 237 00:09:59,820 --> 00:10:01,560 ‫or weapon testing course 238 00:10:01,560 --> 00:10:05,925 ‫or you can just do a like a real quick research in Google 239 00:10:05,925 --> 00:10:10,860 ‫because it's not very related to mobile ethical hacking. 240 00:10:10,860 --> 00:10:14,670 ‫That's why I didn't put so much information 241 00:10:14,670 --> 00:10:17,659 ‫or like a wide section inside of it. 242 00:10:17,659 --> 00:10:19,950 ‫But over here, 243 00:10:19,950 --> 00:10:22,920 ‫now we needed to take a look at it. 244 00:10:22,920 --> 00:10:25,230 ‫So that's what we are doing. 245 00:10:25,230 --> 00:10:28,890 ‫And by the way, I have just looked at a response 246 00:10:28,890 --> 00:10:31,140 ‫and the response over here is 247 00:10:31,140 --> 00:10:35,130 ‫that it says you have an error in your sequels in text. 248 00:10:35,130 --> 00:10:39,903 ‫Check the manual that corresponds to your My SQL server. 249 00:10:40,740 --> 00:10:41,573 ‫Great. 250 00:10:42,870 --> 00:10:47,100 ‫So some of the responses say that 251 00:10:47,100 --> 00:10:50,070 ‫not some of the responses saying incorrect 252 00:10:50,070 --> 00:10:51,960 ‫but some of the responses 253 00:10:51,960 --> 00:10:54,630 ‫saying different things. 254 00:10:54,630 --> 00:10:57,000 ‫I believe we have to wait 255 00:10:57,000 --> 00:10:58,530 ‫until this is finished 256 00:10:58,530 --> 00:11:02,010 ‫and then we can just analyze everything. 257 00:11:02,010 --> 00:11:03,270 ‫Here you go. 258 00:11:03,270 --> 00:11:05,250 ‫Everything seems to be finished for me. 259 00:11:05,250 --> 00:11:07,887 ‫I just post the video, obviously in order to wait 260 00:11:07,887 --> 00:11:09,630 ‫for it to be finished, 261 00:11:09,630 --> 00:11:12,180 ‫but after it's finished 262 00:11:12,180 --> 00:11:14,430 ‫I can just sort it according 263 00:11:14,430 --> 00:11:17,901 ‫to their status code and see the responses. 264 00:11:17,901 --> 00:11:19,620 ‫Okay? 265 00:11:19,620 --> 00:11:21,690 ‫We have come across in a situation 266 00:11:21,690 --> 00:11:25,110 ‫where we get some different messages 267 00:11:25,110 --> 00:11:27,960 ‫like different syntax saying 268 00:11:27,960 --> 00:11:30,903 ‫just find your own syntax or something like that. 269 00:11:32,764 --> 00:11:33,597 ‫So as you can see, 270 00:11:33,597 --> 00:11:35,880 ‫there is a length column as well. 271 00:11:35,880 --> 00:11:39,960 ‫And we have two 89's and two 95's. 272 00:11:39,960 --> 00:11:42,194 ‫So different lengths different, 273 00:11:42,194 --> 00:11:43,572 ‫even though the different 274 00:11:43,572 --> 00:11:46,050 ‫we have the same status code, 275 00:11:46,050 --> 00:11:48,120 ‫we have different responses. 276 00:11:48,120 --> 00:11:51,870 ‫And over here, some of the responses actually 277 00:11:51,870 --> 00:11:54,698 ‫give us an authentication key 278 00:11:54,698 --> 00:11:56,730 ‫like this. 279 00:11:56,730 --> 00:12:00,840 ‫So even though we have the same status code, 280 00:12:00,840 --> 00:12:04,590 ‫sometimes we might take a look at the length 281 00:12:04,590 --> 00:12:07,020 ‫of this responses as well 282 00:12:07,020 --> 00:12:09,660 ‫to see different kind of things 283 00:12:09,660 --> 00:12:11,490 ‫different kind of responses. 284 00:12:11,490 --> 00:12:14,041 ‫So I'm just gonna send one of these to repeater. 285 00:12:14,041 --> 00:12:15,180 ‫Okay? 286 00:12:15,180 --> 00:12:19,470 ‫So this was the one where we got the success. 287 00:12:19,470 --> 00:12:22,410 ‫It means that we got it, okay? 288 00:12:22,410 --> 00:12:26,070 ‫It means that we have used SQL injection 289 00:12:26,070 --> 00:12:29,520 ‫and I'm gonna have to turn off the interception. 290 00:12:29,520 --> 00:12:33,420 ‫We used SQL injection to get into the database 291 00:12:33,420 --> 00:12:38,040 ‫without even knowing username and password. 292 00:12:38,040 --> 00:12:39,570 ‫So I can copy this, 293 00:12:39,570 --> 00:12:40,757 ‫okay, 294 00:12:40,757 --> 00:12:41,850 ‫I can copy this authentication key 295 00:12:41,850 --> 00:12:43,946 ‫or I can copy this payload 296 00:12:43,946 --> 00:12:45,720 ‫from here, 297 00:12:45,720 --> 00:12:48,720 ‫and just paste it in the postman 298 00:12:48,720 --> 00:12:51,120 ‫like this for the username, 299 00:12:51,120 --> 00:12:52,830 ‫this and for the password 300 00:12:52,830 --> 00:12:56,640 ‫this and the single quotation marks are important. 301 00:12:56,640 --> 00:12:58,470 ‫So beware of that. 302 00:12:58,470 --> 00:12:59,310 ‫Here you go. 303 00:12:59,310 --> 00:13:02,760 ‫Once I send this, I get the authentication key. 304 00:13:02,760 --> 00:13:06,510 ‫Now, if I go to get secret and send this 305 00:13:06,510 --> 00:13:09,240 ‫because I already have the authentication key. 306 00:13:09,240 --> 00:13:10,073 ‫Here you go. 307 00:13:10,073 --> 00:13:11,853 ‫We got the flag back. 308 00:13:12,930 --> 00:13:13,923 ‫Now again, 309 00:13:15,305 --> 00:13:16,380 ‫this lecture was not 310 00:13:16,380 --> 00:13:20,400 ‫about SQL injection, like SQL injection 1 0 1. 311 00:13:20,400 --> 00:13:23,700 ‫This lecture was about finding a quick way to see 312 00:13:23,700 --> 00:13:28,470 ‫if we have a SQL injection vulnerability inside of the API. 313 00:13:28,470 --> 00:13:30,120 ‫So I hope you liked it. 314 00:13:30,120 --> 00:13:31,800 ‫Let's stop here and continue 315 00:13:31,800 --> 00:13:34,023 ‫within the next lecture together.