-: Okay, so now we know our target database
is called owasp10.
Let's try and discover the tables
that exist in that database.
So this is our select statement,
it's a union select 1 and we have these things.
So I'm gonna leave this or change these to null.
'Cause I only wanna select one thing now
and I'm gonna set this to null as well.
And in number two, we're going to select
table name
from.
Now we're gonna select this from
a database called Information Schema.
Now I said this in the first video of SQL,
that information schema is a default database
created by MySQL and it contains information
about all other databases.
So what we're doing now,
we're selecting the table name from information
schema dot, and after the dot, you put the table.
So basically we're selecting a table
called tables from a database called information schema.
And the column that we're selecting is called table name.
So we're selecting table name from the database
that's called information schema from the table tables.
Let's execute this and see if we can get all the tables
that exist in owasp10 database.
So we can see we got 237 records.
And you can see all the tables that we have,
so these are all the tables
that we have access to.
So again, I said, we were logged in as Root,
therefore we can actually see tables from
other web applications, such as The Tiki Wiki.
But in real life scenarios you'll only see tables
related to your current database,
which is Mutillidae.
So what I'm going to do is, I'm going to use a where clause
and I'm gonna say where the table
schema is equal to
owasp10.
So owasp10 was what we got when we executed,
when we selected the database, so we got owasp10,
which is our current database that Mutillidae is working on.
So we are using the same statement,
we're selecting the table name
from information schema tables,
where the table schema
is owasp10.
So I'm gonna copy that.
And execute it here.
And as you can see now, we have so much less tables,
and we only have the ones that we're interested in.
So we have the accounts, the blogs, captured data,
credit cards, hitlog and the pen test tools.
Now if you remember, in the first or the second video,
in the SQL injection videos,
I showed you what's the content of the OWASP table was.
And it was these tables of the OWASP database.