OK so now let's try and determine how many columns are being selected into this page.
So how much information are being selected and displayed on this page so to do that we're going to use
the order by command.
So we did order by one and that returned something that was acceptable and order by one hundred thousand
devils on error.
So let's try and do order by 10.
And we still get an error.
So I'm gonna do an order by 5:00 and that works.
So let's try to do an order by 6:00.
And that gives an error.
So by doing this we know that there is five columns or are being selected from a certain table.
And it's the accounts table and displayed on this page.
So let's try and build our own SELECT statement and get it to be executed on the target computer so
let's come here and try to build it there.
So at the moment this statement is select star from accounts where your unit is equal to Zaid and we're
doing an order by 1.
So let's see if we can fix that and get it to select something that we like so the normal way to select
stuff is using this format but because we are trying to do multiple select and we're trying to do it
from the URL we're going to have to use a union first and then we're going to say select then we need
to imagine what's happening on this application so in this web application we know that there are five
records being selected.
So there are five columns that are being selected.
So we're doing one two three four five and we got that from the order by command.
So let's run this and see what happens
and I spilled union wrong
and as you can see now the selection was right and we got the first selection so the first selection
that this line does has been done.
And then it did the union.
So it's it combined that selection with another selection and it showed us something else.
And as you can see here we're only seeing two three and four.
And what that means is whatever value you put in number two or three or four whatever you want to select
if you put it in there it's going to be displayed in this page.
In this particular location and you can see that here you have results for two.
So whatever you put into would also be shown in here
so let's try to see our database.
So instead of number two I'm gonna say database and instead of number three I'm going to say user name
or user and instead of number four I'm gonna do a version and this will select the current database
the current the user privileges that we have and the version of the database.
So let's see if this gets executed and then we'll talk about it.
Okay.
Cool.
So the user name is showing up as I was 10 and that's that was number two.
So that is the database that we're looking for.
So the database is ours then the current user that we're logged in as is root at local hosts.
So we're the root user and and the signature of this.
So this stuff I actually don't mean anything.
We're only concerned about this and what we injected and we injected the version and we can see this
is the version of my SDL so it's five point zero point five one.
So at the moment we know that our database that we're connected to is our and usually in most real life
scenarios each database is assigned to a certain user.
So usually you're only able to select stuff tables columns data that is located in this current database
at the moment who are logged in as root.
So this web application has been connected to the database as root so therefore we can actually access
other databases but this doesn't really happen in real life scenarios.
Usually each user has their own their own database so when they connect a web application to a database
they connect connected to one database and therefore you want to be able to access other databases.
So we're going to consider that we're going to assume that we only have access to our Stan which is
our current database for this current Web site and that the user name is Root at local Post and the
next videos we'll see how we can further exploit this and do more powerful select statements.