Now let's see if we can select and get and have a look on all the accounts that exist within this table.
So let's see if we can query the database and read the information stored in the accounts table to do
that.
We're going to first need to know the column names of the columns that exist within this table because
if you look at the way you were using our statement we're doing union select column name from a table.
So we still don't know what columns exist in accounts.
Now we can try and guess that there is a user name and password but sometimes they could be different
names.
So I'm going to show you how you can select the columns for a certain table the command is going to
be very similar to the tables command and the only difference is instead of table name we're going to
say column name and instead of selecting it from the information schema the tables we're going to select
IDs from information schema those columns
and we're going to say where the table name
is equal to accounts because we're interested into the accounts table if you wanted to get columns for
another table then you just substitute this with the table or with the column that with the table that
you want.
So our command is going to be union select one column name from the information schema those columns
where the table name is the table that we're interested in which is the accounts and this should show
us all the columns that exist within the accounts table.
So let's run this command
and perfect same columns that we've seen before and see I.D. username password my signature and is admin.
Now let's take this one step further and select the usernames and passwords from the account table.
So again the cut at the command is gonna be very similar to what we're running at the moment we're going
to be selecting and we're going to select username
and I'm going to select the passwords for number two and for number three we're going to select the
is adamant.
Now remember I can't select anything instead of number one and number five because they don't they're
not they're never displayed for me on screen.
The only thing that I see was number two three and four which were displayed here two three and four.
So therefore I'm only substituting values for two three and four and we're going to select that from
accounts
and we're not going to need the where.
So I'm gonna delete the where.
So very simple statement.
We're selecting username password is admin from the accounts and this should return all the usernames
and passwords that exist within the current table that exist in the accounts table
and I have an extra quote here that I'm gonna delete.
And as you can see we got all the user names and passwords we have the admin and their password design
admin we have other users and we have their passwords and it's also telling us whether they are admins
or not this is very useful because in most Web sites when you log in as admin you have so much more
privileges than a normal person.
And then you'd be able to upload BHP shells or backdoor as viruses whatever you want to do really.
And then further exploit the system so at the moment I can actually log in with a user name admin and
a password admin pass and this can accept that because it's correct
so no matter how complicated the password was we're just going to be able to read it because we're reading
it straight from the database.