Instructor: Now let's see if we can select
and get and have a look on all of the accounts
that exist within this table.
So let's just see if we can create the database
and read the information stored in the accounts table.
To do that, we're going to first need
to know the column names of the columns
that exist within this table,
'cause if you look at the way we're using our statement,
we're doing union select column name from a table.
So we still don't know what columns exist in accounts,
now we can try and guess
that there's a username and a password,
but sometimes they could be different names.
So I'm gonna show you how you can select the columns
for a certain table.
The command is gonna be very similar to the table's command
and the only difference is instead of table name
we're gonna say column name.
And instead of selecting it
from the information schema.tables,
we're gonna select it from information schema.columns.
And we're gonna say where the table name
is equal to accounts
'cause we're interested into the accounts table.
If you wanted to get columns for another table,
then you just substitute this with the table
or with the column that, with the table that you want.
So our command is gonna be union select one, column name
from the information schema.columns
where the table name is the table that we're interested in,
which is the accounts.
And this should show us all the columns
that exist within the accounts table.
So let's run this command.
And perfect, same columns that we've seen before
and its cid, username, password,
my signature, and is admin.
Now let's take this one step further
and select the usernames and passwords
from the account table.
So again, the command is gonna be very similar
to what we're running at the moment.
We're gonna be selecting
and we're gonna select username.
And I'm gonna select the password for number two
and for number three you are going to select the is admin.
Now remember I can't select anything instead of number one
and number five because they're never displayed
for me on screen.
The only thing that I see was number two, three, and four
which were displayed here two, three, and four.
So therefore I'm only substituting values
for two, three, and four.
And we're gonna select that from accounts.
And we're not gonna need the where,
so I'm gonna delete the where.
So very simple statement, we're selecting username,
password, is admin from the accounts.
And this should return all the usernames and passwords
that exist within the current table,
that exist in the accounts table.
And I have an extra quote here I'm gonna delete.
And as you can see we got all the usernames and passwords,
we have the admin and their password is adminpass.
We have other users and we have their passwords
and it's also telling us whether they are admins or not.
This is very useful because in most websites
when you log in as admin
you have so much more privileges than a normal person.
And then you'd be able to upload PHV shells,
or backdoors, viruses, whatever you wanna do really
and then further exploit the system.
So at the moment I can actually log in
with the username admin and a password adminpass.
And it's gonna accept that because it's correct.
So no matter how complicated the password was,
we're just gonna be able to read it
because we're are reading it straight from the database.