Instructor: Okay. 2 2
So now let's try and determine 3 3
how many columns are being selected 4 4
into this page so how much information 5 5
are being selected and displayed on this page? 6 6
So to do that, we're going to use the order by command. 7 7
So we did order by one 8 8
and that returned something that was acceptable 9 9
and order by 100,000 gave us an error. 10 10
So let's try and do order by 10. 11 11
And we still get an error. 12 12
So I'm gonna do an order by five. 13 13
And that works. 14 14
So let's try to do an order by six 15 15
and that gives an error. 16 16
So by doing this, 17 17
we know that there is five columns 18 18
or are being selected from a certain table 19 19
and it's the accounts table 20 20
and displayed on this page. 21 21
So let's try and build our own select statement 22 22
and get it to be executed on the target computer. 23 23
So let's come here and try to build it there. 24 24
So at the moment, the statement 25 25
is select star from accounts 26 26
where username is equal to zaid 27 27
and we're doing an order by one. 28 28
So let's see if we can fix that 29 29
and get it to select something that we like. 30 30
So the normal way to select stuff 31 31
is using this format. 32 32
But because we're trying to do multiple selects 33 33
and we're trying to do it from the URL, 34 34
we're gonna have to use a union first 35 35
and then we're gonna say select. 36 36
Then we need to imagine what's happening 37 37
on this application. 38 38
So in this web application, 39 39
we know that there are five records being selected. 40 40
So there are five columns that are being selected. 41 41
So we're doing one, 42 42
two, three, four, five 43 43
and we got that by the order by command. 44 44
So let's run this 45 45
and see what happens. 46 46
And I spelled union wrong. 47 47
And as you can see now, the selection was right 48 48
and we got the first selection 49 49
so the first selection that this line does 50 50
has been done and then it did the union 51 51
so it combined that selection with another selection 52 52
and it showed us something else 53 53
and as you can see here, 54 54
we're only seeing two, three and four. 55 55
And what means is whatever value you put in number two, 56 56
or three or four, 57 57
whatever you want to select, 58 58
if you put it in there, it's going to be displayed 59 59
in this page in this particular location. 60 60
And you can see here you have results 61 61
for two so whenever you put in two 62 62
will also be shown in here. 63 63
So let's try to see our database 64 64
so instead of number two, 65 65
I'm gonna say database, 66 66
and instead of number three, I'm gonna say username 67 67
or user and instead of number four, 68 68
I'm gonna do version. 69 69
And this will select the current database, 70 70
the current user privileges that we have 71 71
and the version of the database. 72 72
So let's see if this gets executed 73 73
and then we'll talk about it. 74 74
Okay, cool so the username is showing up as owasp10 75 75
and that was number two 76 76
so that is the database that we're looking for. 77 77
So the database is owasp10. 78 78
The current user that we're logged in as is root@localhost 79 79
so we're the root user 80 80
and in the signature, so these stuff 81 81
are actually dominating. 82 82
We're only concerned about this 83 83
and what we injected. 84 84
And we injected the version 85 85
and we can see this is the version of MySQL, so it's 5.0.51. 86 86
So at the moment, we know that our database 87 87
that we're connected to is owasp10. 88 88
Usually in most real-life scenarios, 89 89
each database is assigned to a certain user. 90 90
So usually you're only able to select stuff, 91 91
tables, columns, data that is located 92 92
in this current database. 93 93
At the moment we're logged in as root 94 94
so this web application 95 95
has been connected to the database 96 96
as root so therefore we can actually access other databases 97 97
but this doesn't really happen in real-life scenarios. 98 98
Usually each user has their own database. 99 99
So when they connect a web application to a database, 100 100
they're connected to one database 101 101
and therefore you won't be able to access other databases. 102 102
So we're gonna consider that. 103 103
We're gonna assume that we only have access 104 104
to owasp10 which is our current database 105 105
for this current website. 106 106
And that the username is root@localhost. 107 107
In the next videos, 108 108
we'll see how we can further exploit this 109 109
and do more powerful select statements.