Instructor: Now let's see if we can select 2 2
and get and have a look on all of the accounts 3 3
that exist within this table. 4 4
So let's just see if we can create the database 5 5
and read the information stored in the accounts table. 6 6
To do that, we're going to first need 7 7
to know the column names of the columns 8 8
that exist within this table, 9 9
'cause if you look at the way we're using our statement, 10 10
we're doing union select column name from a table. 11 11
So we still don't know what columns exist in accounts, 12 12
now we can try and guess 13 13
that there's a username and a password, 14 14
but sometimes they could be different names. 15 15
So I'm gonna show you how you can select the columns 16 16
for a certain table. 17 17
The command is gonna be very similar to the table's command 18 18
and the only difference is instead of table name 19 19
we're gonna say column name. 20 20
And instead of selecting it 21 21
from the information schema.tables, 22 22
we're gonna select it from information schema.columns. 23 23
And we're gonna say where the table name 24 24
is equal to accounts 25 25
'cause we're interested into the accounts table. 26 26
If you wanted to get columns for another table, 27 27
then you just substitute this with the table 28 28
or with the column that, with the table that you want. 29 29
So our command is gonna be union select one, column name 30 30
from the information schema.columns 31 31
where the table name is the table that we're interested in, 32 32
which is the accounts. 33 33
And this should show us all the columns 34 34
that exist within the accounts table. 35 35
So let's run this command. 36 36
And perfect, same columns that we've seen before 37 37
and its cid, username, password, 38 38
my signature, and is admin. 39 39
Now let's take this one step further 40 40
and select the usernames and passwords 41 41
from the account table. 42 42
So again, the command is gonna be very similar 43 43
to what we're running at the moment. 44 44
We're gonna be selecting 45 45
and we're gonna select username. 46 46
And I'm gonna select the password for number two 47 47
and for number three you are going to select the is admin. 48 48
Now remember I can't select anything instead of number one 49 49
and number five because they're never displayed 50 50
for me on screen. 51 51
The only thing that I see was number two, three, and four 52 52
which were displayed here two, three, and four. 53 53
So therefore I'm only substituting values 54 54
for two, three, and four. 55 55
And we're gonna select that from accounts. 56 56
And we're not gonna need the where, 57 57
so I'm gonna delete the where. 58 58
So very simple statement, we're selecting username, 59 59
password, is admin from the accounts. 60 60
And this should return all the usernames and passwords 61 61
that exist within the current table, 62 62
that exist in the accounts table. 63 63
And I have an extra quote here I'm gonna delete. 64 64
And as you can see we got all the usernames and passwords, 65 65
we have the admin and their password is adminpass. 66 66
We have other users and we have their passwords 67 67
and it's also telling us whether they are admins or not. 68 68
This is very useful because in most websites 69 69
when you log in as admin 70 70
you have so much more privileges than a normal person. 71 71
And then you'd be able to upload PHV shells, 72 72
or backdoors, viruses, whatever you wanna do really 73 73
and then further exploit the system. 74 74
So at the moment I can actually log in 75 75
with the username admin and a password adminpass. 76 76
And it's gonna accept that because it's correct. 77 77
So no matter how complicated the password was, 78 78
we're just gonna be able to read it 79 79
because we're are reading it straight from the database.