Instructor: Okay, so now let's try and determine
how many columns are being selected into this page.
So how much information are being selected
and displayed on this page.
So to do that, we're going to use the order by command.
So we did order by one
and that returned something
that was acceptable and order by 100,000 gave us an error.
So let's try and do order by 10.
And we still get an error.
So I'm gonna do an order by five.
And that works.
So let's try to do an order by six and that gives an error.
So by doing this, we know that there is five columns
or are being selected from a certain table
and it's the accounts table.
And displayed on this page.
So let's try and build our own select statement
and get it to be executed on the target computer.
So let's come here
and try to build it there.
So at the moment, the statement is select star
from accounts where username is equal to zaid
and we're doing an order by one.
So let's see if we can fix that
and get it to select something that we like.
So the normal way to select stuff
is using this format.
But because we're trying to do multiple selects
and we're trying to do it from the URL,
we're gonna have to use a union first
and then we're gonna say select.
Then we need to imagine
what's happening on this application.
So in this web application,
we know that there are five records being selected.
So there are five columns that are being selected.
So we're doing one, two, three, four, five
and we got that from the order by command.
So let's run this and see what happens.
And I spelled union wrong.
And as you can see now, the selection was right
and we got the first selection,
so the first selection that this line does
has been done and then it did the union.
So it combined that selection with another selection
and it showed us something else.
And as you can see here,
we're only seeing two, three and four.
And what that means is whatever value you put a number two
or three or four,
whatever you want to select,
if you put it in there,
it's going to be displayed in this page
in this particular location.
And you can see that here you have results for two.
So whatever you put in two will also be shown in here.
So let's try to see our database.
So instead of number two,
I'm gonna say database.
And instead of number three,
I'm gonna say username.
Or user.
And instead of number four,
I'm gonna do version.
And this will select the current database,
the current user privileges that we have
and the version of the database.
So let's see if this gets executed
and then we'll talk about it.
Okay, cool.
So the username is showing up as owasp10
and that was number two,
so that is the database that we're looking for.
So the database is owasp10.
The current user that we're logged in as is root@localhost,
so we're the root user.
And in the signature,
so these stuff actually don't mean anything.
We're only concerned about this
and what we injected
and we injected the version
and we can see this is the version of MySQL, so it's 5.0.51.
So at the moment, we know that our database
that we're connected to is owasp10.
Usually in most real-life scenarios,
each database is assigned to a certain user.
So usually you're only able
to select stuff, tables, column, data
that is located in this current database.
At the moment, we're logged in as root.
So this web application has been connected to the database
as root, so therefore,
we can actually access other databases
but this doesn't really happen in real-life scenarios.
Usually, each user has their own database.
So when they connect a web application to a database,
they connect it to one database
and therefore, you won't be able to access other database.
So we're gonna consider that.
We're gonna assume that we only have access
to owasp10, which is our current database
for this current website.
And that the username is root@localhost.
In the next videos,
we'll see how we can further exploit this
and do more powerful select statements.