1 00:00:00,990 --> 00:00:07,530 So, listen, this will be seeing about the scoring action and Wall Street as well as current actions, 2 00:00:08,010 --> 00:00:12,520 so I'm explaining the basics of scoring action and then we will see a robust reduction. 3 00:00:12,660 --> 00:00:19,230 So in the next two years, we will see the union buser its current actions and will be doing this perhaps 4 00:00:19,230 --> 00:00:19,980 in this video. 5 00:00:20,850 --> 00:00:24,470 So you can see for sure explain the basics of the scoring action. 6 00:00:25,320 --> 00:00:32,460 I have this table in full and it contains three columns already, username and password and only one 7 00:00:32,460 --> 00:00:35,340 arrow and his password fresh, so on. 8 00:00:35,380 --> 00:00:35,530 So. 9 00:00:36,210 --> 00:00:38,850 So these are the contents of the table. 10 00:00:38,900 --> 00:00:39,330 OK. 11 00:00:45,030 --> 00:00:55,860 So in the application that can like BHP Arbi done so the quarry will be like this strictly telecom username 12 00:00:56,430 --> 00:01:05,220 and password thrombin for where it's easy to, uh, to. 13 00:01:06,350 --> 00:01:09,250 So SEMICON, so you get the result, right? 14 00:01:09,610 --> 00:01:10,990 So whenever a 15 00:01:14,680 --> 00:01:22,140 Harlettes user from infor where IATSE calls to. 16 00:01:26,100 --> 00:01:28,580 So here we are getting the username right? 17 00:01:38,660 --> 00:01:48,890 So in no application back in, what you have is it will have the right to use a name or something you 18 00:01:49,220 --> 00:01:51,590 you need to provide in the water. 19 00:01:51,920 --> 00:01:57,810 So it should be like this, like Dharavi. 20 00:01:58,790 --> 00:02:03,890 So whatever you send the letter in the water, it will bring a certain shade of you. 21 00:02:04,550 --> 00:02:06,050 OK, so. 22 00:02:06,260 --> 00:02:11,840 Oh, oh, you should of providing too. 23 00:02:11,940 --> 00:02:14,410 So there will be already one quotation mark. 24 00:02:14,900 --> 00:02:22,940 So what you can do is you can provide that this pool, uh, single code and then what you can do is 25 00:02:23,270 --> 00:02:28,180 uh you can do the true statement. 26 00:02:28,820 --> 00:02:29,670 So like this. 27 00:02:30,980 --> 00:02:39,920 So what this one is first we're uh making sure that it is to and then we are using the order and checking 28 00:02:39,920 --> 00:02:40,850 the list goes on. 29 00:02:41,150 --> 00:02:45,660 So when all discovery has been executed, I will get the same result as this one. 30 00:02:46,460 --> 00:02:47,960 So let me execute this one. 31 00:02:48,620 --> 00:02:50,570 And you can see we got the user name. 32 00:02:51,440 --> 00:02:55,640 Uh, why did we get out more than Flash? 33 00:02:55,640 --> 00:03:06,080 Because this is becoming so that's why the user name column has been internally displaced. 34 00:03:06,410 --> 00:03:10,100 So you can see this input is not filtered correctly. 35 00:03:10,280 --> 00:03:12,020 You can get much more information. 36 00:03:13,520 --> 00:03:14,930 So you can also do. 37 00:03:14,930 --> 00:03:19,510 And so you get only the flash because we are doing that an operation. 38 00:03:19,820 --> 00:03:22,010 So both of these cases should be true. 39 00:03:23,000 --> 00:03:25,570 When I do an operation, it will be this one. 40 00:03:26,330 --> 00:03:30,670 And if I say one is close to two, this is false, true or false. 41 00:03:30,680 --> 00:03:34,210 And then you get this, uh, warranty fresh. 42 00:03:35,060 --> 00:03:41,980 So so how this relates to you can see now this leads to data leakage. 43 00:03:41,990 --> 00:03:54,620 And also if you have like a select username and password are like Seretide sort of info where user name 44 00:03:54,620 --> 00:04:01,170 is equal to Flash and the password is equal to flash. 45 00:04:02,480 --> 00:04:05,120 So now you can see it two. 46 00:04:07,010 --> 00:04:08,150 So now what I can. 47 00:04:17,490 --> 00:04:23,260 So instead of instead of fresh, I don't know I don't know the password. 48 00:04:24,120 --> 00:04:31,290 Let's assume for two, one, three and then here in the input field, what I can do is I can get some 49 00:04:31,290 --> 00:04:37,080 fresh and single code and then I can put comment. 50 00:04:37,200 --> 00:04:46,210 So this will be not and if I return to the same corner and I get the two, even though my password is 51 00:04:46,210 --> 00:04:53,020 the wrong, but this has been commandeered by this other comment. 52 00:04:53,040 --> 00:04:57,080 So in the square you can see, uh, two hyphen are comic. 53 00:04:57,210 --> 00:05:05,180 And also, uh, this phone symbol is also the comment. 54 00:05:05,370 --> 00:05:05,770 OK. 55 00:05:06,810 --> 00:05:14,250 So these two other comments in the school and you can see from this input I have put this on me sorry, 56 00:05:14,880 --> 00:05:16,680 single code and then put the comment. 57 00:05:16,710 --> 00:05:21,450 So this part has been truncated and of course, we got the result. 58 00:05:21,750 --> 00:05:26,430 So you can, uh, bypass the authentication into another user. 59 00:05:26,640 --> 00:05:28,620 So you can also buckfast this pseudonyms. 60 00:05:28,950 --> 00:05:35,880 So you can see from all you do not sort of this input, uh, do so many problems. 61 00:05:36,510 --> 00:05:38,400 So now let's go and do the. 62 00:05:41,940 --> 00:05:45,130 So here they are seeing vulnerability in category theater. 63 00:05:45,540 --> 00:05:47,920 So the reason this is the back, end quote. 64 00:05:48,150 --> 00:05:54,030 So what you can do is you can put this thing in code and this sort of to. 65 00:06:06,300 --> 00:06:14,390 So here's what the court is doing is it is already displaying the range of products sold as accessories 66 00:06:14,880 --> 00:06:17,630 so you can see categories, physical accessories. 67 00:06:18,440 --> 00:06:25,240 So what I can do is I can put the thing in court and, you know, you can see internal server. 68 00:06:25,260 --> 00:06:31,740 That means the entire college team has been, uh, error because of this single. 69 00:06:32,250 --> 00:06:33,560 So that's why it rolls on. 70 00:06:33,930 --> 00:06:43,370 So here's what you can do, is you need to specify Oreja or trustmark. 71 00:06:45,060 --> 00:06:49,140 So here you get the prudential condition, Lubutu. 72 00:06:49,410 --> 00:06:50,850 And you do this every. 73 00:06:54,190 --> 00:07:00,280 So you can see much more information, so you can see congratulations on Sagala. 74 00:07:01,390 --> 00:07:03,190 So here's what you can do, is 75 00:07:05,980 --> 00:07:08,040 that you are incorrect. 76 00:07:08,890 --> 00:07:10,660 So here, first check this. 77 00:07:14,260 --> 00:07:22,670 I checked the water with the senior advocate and see if there is ever so good, just congratulations. 78 00:07:23,430 --> 00:07:32,070 OK, well, you get some obscure rules like international law in this case, but actually you can see 79 00:07:32,070 --> 00:07:33,920 the error on this page. 80 00:07:34,380 --> 00:07:41,820 So in that case, you can put ah and and to see you get much more information like the data leakage. 81 00:07:42,660 --> 00:07:44,070 So that is the first step. 82 00:07:44,370 --> 00:07:47,790 So the next step is pursuing the same. 83 00:07:50,460 --> 00:07:51,680 So I still have. 84 00:08:27,690 --> 00:08:31,920 OK, here to see the world, and let's click on my account. 85 00:08:34,930 --> 00:08:37,120 And now it's 86 00:08:40,060 --> 00:08:49,000 important to note that so the parameters are being sent as a body, so let's call it this. 87 00:08:52,880 --> 00:09:05,380 And based here, so I have already my Barpak, so let's go and sit down and write to him. 88 00:09:08,080 --> 00:09:20,940 And again, I'll send this to Peter so you can see the leaders credentials are being sent to the body 89 00:09:21,520 --> 00:09:25,150 so I can test the parameters. 90 00:09:25,600 --> 00:09:32,400 You put the single code so you can see there is an internal server. 91 00:09:34,120 --> 00:09:39,160 That means this parameter can be prone to a scoring action. 92 00:09:39,760 --> 00:09:47,470 Let's make the true statement or one is close to one and then we are getting the pass. 93 00:09:49,510 --> 00:09:51,040 So I think you need to. 94 00:10:09,110 --> 00:10:18,830 So when need to learn and so we can also use this functionality in the world so you can on this, you 95 00:10:18,830 --> 00:10:23,920 order and you type, so upon typing it will automatically and do you order. 96 00:10:24,200 --> 00:10:28,670 So let's be content and to form. 97 00:10:28,700 --> 00:10:29,840 So here we are. 98 00:10:29,970 --> 00:10:34,600 We are writing to the icon again. 99 00:10:36,200 --> 00:10:40,060 So that means I can just go ahead and say. 100 00:10:44,010 --> 00:10:45,990 And it also put this one. 101 00:10:50,160 --> 00:10:55,560 Or be pushed to a World Series of poker. 102 00:11:10,050 --> 00:11:16,290 So let's go ahead and do this, because the CEOs are talking as much. 103 00:11:19,370 --> 00:11:25,970 You can also post this in the password if you think the username has a separate quality and password 104 00:11:27,020 --> 00:11:30,880 and you can see we are 105 00:11:33,950 --> 00:11:34,180 OK. 106 00:11:35,150 --> 00:11:36,620 So let's close this. 107 00:11:37,010 --> 00:11:43,740 So we have done the pull ups where we used this at the screen. 108 00:11:44,030 --> 00:11:46,900 Now let's go and do it in Python. 109 00:11:46,910 --> 00:11:51,070 So let's see whether we can automate this entire process. 110 00:11:59,450 --> 00:12:01,520 First one news or one news close to one. 111 00:12:12,970 --> 00:12:14,360 The next one is. 112 00:12:21,950 --> 00:12:30,380 So let me try these two Arpels, so I have already writing this script and now Sadun down for the Union 113 00:12:30,380 --> 00:12:34,160 Baesler induction, so will be seeing in our next videos. 114 00:12:35,210 --> 00:12:37,190 So focus on let's. 115 00:12:51,770 --> 00:12:53,480 So it's the final function. 116 00:13:22,190 --> 00:13:34,790 So it's called lifestyle copy this and based here, so are the calls to request first, let's get the 117 00:13:34,790 --> 00:13:35,390 pet. 118 00:13:40,800 --> 00:13:41,350 You are. 119 00:13:44,860 --> 00:13:47,890 So that function, we need to pass this water. 120 00:13:50,380 --> 00:13:58,750 So we need to try every road, so let's go in and do that for a year or parents. 121 00:14:01,020 --> 00:14:02,610 All the windows. 122 00:14:06,070 --> 00:14:09,140 So this gives some more flexibility. 123 00:14:12,880 --> 00:14:16,130 You are helpless, so we need to abandon this. 124 00:14:16,540 --> 00:14:25,060 Our parents are parents of flight, so each time we try to do this, so it will be happening at the 125 00:14:25,360 --> 00:14:31,380 last of the year and we are getting so it's not are not status quo. 126 00:14:31,390 --> 00:14:36,510 So this will tell whether we have a successful response or not. 127 00:14:36,700 --> 00:14:41,110 It's a two hundred eighty four after getting this 128 00:14:44,140 --> 00:14:47,560 indication if we got the 200 then or to print. 129 00:14:51,780 --> 00:14:52,650 Or could. 130 00:14:57,680 --> 00:15:04,290 But it's a fight, so we are telling that we are hoping that this period has been working. 131 00:15:10,690 --> 00:15:17,560 Or we can see you order plus another. 132 00:15:26,420 --> 00:15:29,380 You can also put the Assir. 133 00:15:39,710 --> 00:15:47,480 So that's, I think the search for this or period sort of turned on this. 134 00:15:50,590 --> 00:15:58,170 So you can see both of these have been working successfully, so like this you can automate using the 135 00:15:58,180 --> 00:15:58,660 python.