-: Okay, so now we know our target database 2 2
is called owasp10. 3 3
Let's try and discover the tables 4 4
that exist in that database. 5 5
So this is our select statement, 6 6
it's a union select 1 and we have these things. 7 7
So I'm gonna leave this or change these to null. 8 8
'Cause I only wanna select one thing now 9 9
and I'm gonna set this to null as well. 10 10
And in number two, we're going to select 11 11
table name 12 12
from. 13 13
Now we're gonna select this from 14 14
a database called Information Schema. 15 15
Now I said this in the first video of SQL, 16 16
that information schema is a default database 17 17
created by MySQL and it contains information 18 18
about all other databases. 19 19
So what we're doing now, 20 20
we're selecting the table name from information 21 21
schema dot, and after the dot, you put the table. 22 22
So basically we're selecting a table 23 23
called tables from a database called information schema. 24 24
And the column that we're selecting is called table name. 25 25
So we're selecting table name from the database 26 26
that's called information schema from the table tables. 27 27
Let's execute this and see if we can get all the tables 28 28
that exist in owasp10 database. 29 29
So we can see we got 237 records. 30 30
And you can see all the tables that we have, 31 31
so these are all the tables 32 32
that we have access to. 33 33
So again, I said, we were logged in as Root, 34 34
therefore we can actually see tables from 35 35
other web applications, such as The Tiki Wiki. 36 36
But in real life scenarios you'll only see tables 37 37
related to your current database, 38 38
which is Mutillidae. 39 39
So what I'm going to do is, I'm going to use a where clause 40 40
and I'm gonna say where the table 41 41
schema is equal to 42 42
owasp10. 43 43
So owasp10 was what we got when we executed, 44 44
when we selected the database, so we got owasp10, 45 45
which is our current database that Mutillidae is working on. 46 46
So we are using the same statement, 47 47
we're selecting the table name 48 48
from information schema tables, 49 49
where the table schema 50 50
is owasp10. 51 51
So I'm gonna copy that. 52 52
And execute it here. 53 53
And as you can see now, we have so much less tables, 54 54
and we only have the ones that we're interested in. 55 55
So we have the accounts, the blogs, captured data, 56 56
credit cards, hitlog and the pen test tools. 57 57
Now if you remember, in the first or the second video, 58 58
in the SQL injection videos, 59 59
I showed you what's the content of the OWASP table was. 60 60
And it was these tables of the OWASP database.