SQL Injection - Walking through walls.

[MrBeno696]

you are not going to find any websites that have that bad of scripting anymore.

[tyleraverette]

Is there a space between the ' and or and then is there a space after or?

[jrhelgeson]

@tyleraverette - if it is not working, then the site may not be vulnerable (yet) :)

' or 1=1 --

[tyleraverette]

@jrhelgeson Thanks man, one more thing when you typed the website in since you'd be viewing it offline how did u get the next pages web address?

[jrhelgeson]

@tyleraverette - there was no next page address that I entered or modified. It was already part of the existing page.

[leoyt123]

@ToarBlur Use a proxy while hacking lol

[canlandaswitchflip]

thats thuper hardcore

[ToaRBlur]

could you get traced if you hack a school webite???????? please anser

[jrhelgeson]

@ToaRBlur - yes, I will hunt you down personally :)

[ToaRBlur]

@jrhelgeson what you mean, you a pedo are somethink!

[jrhelgeson]

@ToaRBlur - no, I'm a forensics investigator where I help track hackers down and put them in Jail. You asked: "could you get traced if you hack a school webite????????", my answer was "yes, [that] I would hunt you down personally". The :) meaning that I was joking around.

[ToaRBlur]

@jrhelgeson oh i was gonna say, have you ever tracked any hackers down?

[tyleraverette]

@jrhelgeson lulz drop him in your botnet. That's what I would do personally.

[Brittany797091]

how are you editing the page source??

[jrhelgeson]

@Brittany797091 - Notepad

[Brittany797091]

@jrhelgeson lol yeah i figured it out shortly after i asked the question

[chica476]

might i ask what educational background you have, good sir?

[jrhelgeson]

@chica476 - Self-Taught, no college.

[InTenSecondsFlat]

Diabolical

[silverman119]

does anybody know a site to practice this on

[jrhelgeson]

@silverman119 - There are a few resources, WebGoat, Hackme Bank, Hackme Travel, etc. Google them.

[pharoah246]

Is it even possible to still SQL inject this way? I mean editing source code seams to be a little old-hat for web applications, especially with today's security.

[jrhelgeson]

@pharoah246 True - however, this video was created in 2005.

[jrhelgeson]

@pharoah246 - Talk to Anonymous about that - this is still how they are hacking into sites - the classic SQL injection.

[ToastyToast71]

@HaveAScream

Hacking a site is extremely illegal unless you own it or are hired to test it's security (like this guy.)

[Royalllllll]

@ToastyToast71 or u can hack and say for admin that there is an isue and need to be fixed.

[mode123rocks]

What do u do after 0:58 view source.. do u save the view source in notepad?

[jrhelgeson]

@mode123rocks - View source is in notepad, so yes, I am saving it in notepad.

[HaveAScream]

Alright so I hacked a website and edited some gallery pictures and some other stuff. (I am loged in as admin) But what if I want to edit the html scripts, I mean like edit the writings and homepage etc? Help anyone :)

[bboranist]

great, excellent

[joemolot]

your an actual legend :D

[htmlmm]

Nice ...Now try the same, if the SQL-string was built using parameter binding...

[ThePunisherNWO]

Hackers = fucking win

I'll always speak out for hackers :).

[TheZhery]

hacking every website

emad-iraq dot CO dot CC

[TheZhery]

hacking every website

emad-iraq  dot CO dot CC

[StepbyStepTutorials]

It wouldn't let me save as c:\hacked.html. It came up with an error message, saying you aren't allowed to save in this location.

[BBQTeach]

@StepbyStepTutorials

Just open your C drive in my computer and save it there (or anywhere to be honest)!

Depending on your OS you should just be able to double click on the file (save it to your desktop and double click it) and it should run in your default browser.

[rapblack2]

good idea take soucers and change what ever u want

[zace2k9]

3:13 beboooop

[ToasterAssassin]

If only websites could still be hacked using SQL injections...

Ahh....how I miss the good ol' days...

[jrhelgeson]

@ToasterAssassin They can be, and are. I suggest you Google the hack on HBGary Federal. The entire company got p0wn3d last month from a SQL injection attack. Pretty serious stuff, even a top security company gets it wrong sometimes.

[Synith]

@ToasterAssassin They still can, dude. Not all are patched. ;)

[htmlmm]

@ToasterAssassin A lot of people use escaping from ' char for securing the DB. I can not remember the exact method, but it is hackable via SQL-injection. Parameter binding is not.

[Axidento]

@ToasterAssassin Sony got hacked with sql injection showing 120 users information in plaintext!!

this happend 4th june 2011!

[RonBurgundy161]

@ToasterAssassin Sony...

[AllisonDDJ]

can you do this on a vista?

[ToasterAssassin]

@AllisonDDJ It's not the operating system that matters. It's whether you have the knowledge of doing this or not.

[jacksawild]

server side validation is a must, along with parameterised queries and specific user privileges.

But if they have your passwords, its all pointless.

[Deathreaper091]

LULZ thank you that was all to helpful

[jrhelgeson]

@Septagotius LOL!

[Septagotius]

@jrhelgeson Just messing around.

[trinidad143]

Bullshit.. just waste of time... SQL injection aint workin on 95% websites nowadays... OLD SKOOL SHIT.

[Howcast26]

yay! jrhelgeson is evil!! hoorah!

[pilotman123321]

what is the coad?

[jeni105]

my homework right there! yes, our professor wants us to hack a website!T.T

[xmangosaintx]

@jeni105 woohoo! i love your lecturer!^_^

[SaggyBawlz]

Not a bad video. Too bad this only works on the most simple, weak sites. Who in their right mind would use javascript to authenticate?

[woonix]

This kind of exploit is the equivalent of Obi-wan Kenobi's Jedi Mind trick. It only works against weak-minded web programmers.

[blsoccer327]

can you please post what the codes are like the thing that was ' 101 something

[crazynoob3]

fantastic dude, subscribed

[pilkingtoez09]

yer man i like it,

im trying really hard to crack sql,

seems like a myth

peace

[ericcub7]

I am having trouble with the last part.

Any Tips? Help

FIVE STARS

[asvvampire]

lol firefox is the best browser for hacking. this isnt really how a hacker works, its much more complicating. oh and javascript can be disabled from the browser and there is no need for copying the code and erasing the javascript

[vb6help]

you probably don't know how a proper hacker works, you might know how a web hacker works.. not a real one

[Xtagon]

Um, why not just disable JavaScript in your web browser and reload the page? There's no need to delete all the JavaScript by hand on a local copy. That's ridiculous.

Also, why is this video tagged "Java"? There's no Java involved here.

[jrhelgeson]

1) The whole point of the video is to illustrate how an improperly designed web application can be used against you. 2) Yes, while javascript can be disabled in the browser to bypass the validation script, the rest of the site requires the use of javascript. Disabling it entirely would prevent all access to the site.

[PhuckEverything]

@Xtagon You got owned.

[CoolstorytroII]

This is not "Hacking" this is kitty scripting.

White had should note demene themselves to this shit.

This is petty crap....

I'm sure this guy thinks what he is doing is pathetic....

So why does he do it?

He's payed too..

Why?

Idiots.

That's why

[jrhelgeson]

The whole point of this video is to illustrate how easy it is to bypass authentication on a poorly written web application. And do it all in a way that non-technical management can understand. So many technicians have tried to get management to understand the importance or severity of these simple hacks, but unless they see it, they don't get it.

Is it an easy hack? Of course! It also makes a perfect example of how not to do things.

[headstrong440]

how did you get on the page if you were offline???

[jrhelgeson]

I wasn't offline. I simply saved the page to my hard drive, modified it, opened it back up in my browser, then used that modified page to submit information back to the web server.

[rfksna]

i need more than 10 field so i will do...11 ahahahaha

great job by the way...

[MasterCrackAdmin]

i cant edit the code ... can someone help me??

[jrhelgeson]

View the source, save it to disk, open it up in notepad... Or reconfigure your browser to view the source using notepad as default.

[joshua99999999]

my god :P- i always thought omg u how is the basic way to get pat sec passes , :) great job man :P - also just a question - with all the injection - is there a way to put a specific username in but use the sql injection code to put any pass in but u get the account name you put in? this may seem nerdish or wanting but tbh i have 2 virus vids :/ - n spose - i play ogame (hence the comment may seem bit nerdish :P)

[Wolffheartt]

you need regular internet explorer, not google chrome or (maybe) firefox

[RMimz]

10 spaces isnt enough, I'm going to need a LOT more than 10... so I'll change this to 11

[didine3131]

pff html hacking hahahaha lol

[SmartZX]

sql injection brute force and bypass

[superbarnie]

cool ss numbers!!!! let me sharpen that image a little.........

[chucktaylor974]

when i try to save it say i cant save it as c:/hackedhtnl in the name

[beni5wolfie]

it isn't hackedhtnl it is hacked.html

good luck you sneeky hacker you

[metalhead3ecr]

so if i do this and it works will it affect the real webpage? or just get me logged in.

and will i be caught? PLEASE RESPOND

[ultimateownage2]

Not if you use a proxy. And no one will really care if you just hack a site. If you managed to hack a bank then yes, but they have a complex system. Or if you hack like a multi-million dollar site and deface it but it is very unlikely u can

[SinistraD32]

You can use any fkin proxy you gonna be caught. Every proxy makes a log about which IP visited which site on which date, and if they are asked to provide this information, believe me, they gonna do it. So don't rely on them so much. But you can use an internet cafe or a free web-host provider where they won't log your IP.

[pokerstud001]

Not if you're a programmer and you make your own proxy based on the source code of a high - level real one. That's safer :)

[sckryde]

no it wont ..

just site access is all your granted..

i think he was testing..

[TheGuyWithTheCards]

holy ****

[NiGhtMarEs0nWax]

nice, i never really considered javascript to be so flawed, now i think about it, it was dumb not to. thanks.

[hammerogod]

Knowing how to do it is one thing...TELLING EVERY ASSWIPE ON YOUTUBE HOW TO DO IT is another thing.

[ModernModr]

knowledge=power=freedom

refusing ppl the right to knowledge is a form of oppression.

[Myladypeace7]

@ModernModr yes but does that mean that power = knowledge? i think not sir

[rainbowbuttmonkey7]

how do you modify the source? it wont let me!!! grrrrr!

[ShaezyShae]

This is an example of how easy it is to bypass client-side security checks and hack your way in. Unless you're testing security on your OWN site, you should not be doing this anywhere else.

[SinistraD32]

or testing others site on request

[ShaezyShae]

Not sure why you responded to me, but good luck.

[NiGhtMarEs0nWax]

its a text document, he clearly showed.

[mostskilfull]

notice he is not modifying the sites source.... he's modifying the source of his offline site ;)

[pokerstud001]

But once he logs in, you can see in the address bar changes from the file to the actual web page

[rainbowbuttmonkey7]

wow that is sooooo awsome thanks five stars ***** =]

[SwampyRaven]

how come when i do view page source it wont let me edit the text document little help thanks

[jrhelgeson]

Exactly... it isn't exactly rocket surgery.

[faircheater]

that girl could be watching this now!

[CLAYON19]

this is vile... whatever!

[IOPhaser]

it would work in the generality of web pages, it surely wouldnt work in php easily, because php uses escaping as default

[iuiz]

bullshit

that is just wrong

[fenoman666]

yeah this would get you expelled.. For sure lol. I know a dude that got expelled and is not allowed go to any it in europe for doing something similar to this.. A little more extreme tho :)

[KlezHunter1]

any decent web programmer would use a serverside authentication system so this wouldnt work. they also would probably use a function (depending on the web programming language) to strip out any illeagal characters so the sql injection wouldnt work either.

[sl1nger1337]

You're a quick typer O.O

[t1449947]

yikes.

[xeniton]

nice :)

[jabcbass]

please make it more easy!

[dashmatticks]

easier than what? this is literally the most basic you're going to see it.

[IOPhaser]

i think youre curious why this works this way, but nobody will tell you why, guess why, you have to try it

[ofdata]

Nice，Maybe it is too easy

[cwade12c]

Yeah um... no, it's not easy, these are beginning tips. Try doing this on grid networked databases.

Good tutorial though.

[froggyhell]

nice nice...do you have any tips on how to learn that stuff..im learning but its been a month and its taking longer than i want it to i mean going for a course yould be faster..and more educational..

[rbal4]

that's gd but mostly the person at the computer help desk is monitoring you do that so you would be busted by trying that password let a loan changing java script

[trinidadnomad]

aka "how to get expelled from your college" awesome though

[Raven4511]

That strategy is hard to be done in a website which has an excellent security.

[realmusic629]

lol if i was creating it i would make a fake first person :D

[realmusic629]

NICEEE :D

[adesattftl]

wow thats me times 100 when i grow up

[ScottishWookiee]

...you are going to be a sex offender that is at least 300 pounds?

[DJPJR8462]

just dont be the first name and ur safe XD

[avwos]

OMG soo dull!!

[dumbworld]

I dont get it??!?! How can you edit the source, then save it on your PC.And then get access on the server from that file??Can somebody explain???

[jonnyhackercake]

You just go to view -> page source. You select all of it and save it in blah.html file on your desktop (or however you want to name it as long as the extension tells your computer it is an html file - normally .html or .htm). He just removes the validation javascript (most likely length validation, etc.) After that, he isn't restricted by the length so he can input whatever he wants. They don't use any filters before submitting a query, so he can make it right no matter what.

[Ragelom]

if you get on message me.

[ThEthUnDErWiLLrOLL]

follow the vid step-by-step, its what i do..xD

[snuffsan]

This can be disabled by few lines of code :P

[shaneiadt]

whoever who's javascript to validate anything on there web page for user input is an idiot.....server-side scripting for user input validation is a must!!!

[filipfie]

too much power!

[cholokun]

I liked what you did. this is nice

[jonnyhackercake]

When attempting an SQL injection, you really shouldn't count on using the injection in the password form. The reason for this is that most sites use md5 hashing when comparing passwords. So, when doing that, your injection won't be parsed. I would personally just use something really simple, like, ' or 1=1-- for the username and laksdjflkasjf for the password. If they are vulnerable and you want a specific username, you could type, usernameyouwant'-- as the username and blabal as the pass.

[kklloopp]

all the colleges are protected now right????? cuz i dont want ppl messing with my grades and stuff.

[DiscoBiscuit06]

OSHI-

[drummerforpeace]

isn't that illegal?

[jrhelgeson]

Only if I did it without permission. I state in the video that I was contracted to perform a security audit on their website.

[drummerforpeace]

i missed that part. whoops.

[jrhelgeson]

My video is meant to be educational to illustrate why it is important to validate user input on the server side, as opposed to on the client. -- Most developers have now learned to validate and sanitize their inputs and it appears the website you're trying to hack is properly built.

[CYCLOPSONE]

This only works on select websites.

Anybody know anything about accessing password protected websites?

[minntc]

This is a password-protected website. jrhelgeson made only one mistake in his verbal description of his activities; in modifying and saving the source code for that website, he did not disable "all authentication", he disabled input validation. The input validation was only performed on the client side (in-browser), which is a huge no-no.

As an aside to jrhelgeson, this is a good demonstration, but labelling it as "college networks" instead of "a website", you miss a wider audience...

Cheers!

[Th3Hamm3r]

This is all well and good, but any sysadmin worth their salt will have patched a SQL injection exploit. Unless they are very, VERY stupid, as it's the first thing most people try.

[jrhelgeson]

Funny thing is, there isn't a generic patch against SQL injections. It all depends on the website programmer sanitizing their inputs from the SERVER SIDE not the client side, as was done here.

[LegendofHalo117]

Ok when it got to the part where he searched for the Hacked.html what exactly did he enter in the address bar was it this: file:mc:/hacked.html

[jrhelgeson]

file:///c:/hacked.html

I could have accomplished the same thing by using file|open and selected the file, or just double-clicking the file and having it open in the web browser. I just wanted to keep it all in the browser window and the text editor so that non-techies could follow what I was doing without switching between applications.

[Quiltfish]

Did he just call it a "sequel injection technique"??

[JamesCappoa]

part of what he did was SQL injection

[Quiltfish]

SQL(Ess,Cue,El), Sequel...Different. Not important, just annoying IMO

[mtfujiface]

Yeah, n00bs pronounce it Ess Cue El

It's sequel

[kelow4234]

can u do this on any website?

[pimpinallmyhoes]

what do i put in for when your viewing it offline

[pimpinallmyhoes]

is their some different stuff i have to do if its on another website and how can you tell what to put in when you so you could view it offline

[crackzsl]

Only .asp pages are allowed to run SQL inject?

[jrhelgeson]

The only thing you need to make SQL injections work is a SQL compliant database (which is just about all of them) that has a web server front-end.

[plasmaswordguy]

hhm this will certainly help me with a website of an evil person

[CYCLOPSONE]

Hello Joel I have a question.

A very detailed question.

You have email address?

[skatehead0000]

lol "oh she was born in 74'"

[amanjsingh]

I think you could do this because the authentication system was based on JavaScript which is a client side script anyways. If the authentication is done on server itself then its difficult.

[paulwoody]

Actually the authentication was server based using a SQL type database.

The javascript was just basic validation on the HTML textfields prior to being sent to the database.

What the site designer / programmer should also have done was validate the text supplied from the form prior to posting to the database.

Checking for characters such as ', = and -- should be checked for to prevent an SQL injection which is what this video demonstrated.

[AflatoonAflatoon]

jrhelgeson; good work, Highly Informative Video.. do you use msn/yahoo? I need to talk to you and ask a few things regarding security.. i'm a student of BCS (Bachelors of Computer Sciences); cheers.

[Ulldal]

O.O Poor poor Alison D:

[hackerwannabe95]

u have just teach me how to do it on other sites

[hackerwannabe95]

man i am going to try it on an other page

[autobahnguy]

Men with your inherant abilities should work for the Feds. I've heard that they pay well...

[denz9709]

man youre good... for the page source can you show me how cause i couldn't see very well .

[jrhelgeson]

Try squinting...

[gredangeo]

Is it just me? but doesn't his voice patterns sound like Michael Moore.

[jrhelgeson]

Dangit, You found me out! Don't tell anybody. :)

[gredangeo]

Ha, as if I'm talking to Michael Moore on youtube, What a laugh, Keep it coming!!

[tagentx7]

hey guyz can anybody explain what he changed to what.

[bonedghost]

awesome stuff

[zantozmed]

GREAT....

[kaiomatico]

awesome stuff :)

[xSpinner]

i Think in the source it says that he was blocked from accessing this page when he clicked "Loggin" so he editted the source?