OK, so now let's try and determine how many columns are being selected into this page.
So how much information are being selected and displayed on this page?
So to do that, we're going to use the order by command.
So we did order by one that returned something that was acceptable and ordered by one hundred thousand
gave us an error.
So let's try and do order by 10 and we still get an error.
So I'm going to do an order by 5:00.
And that works, so let's try to do an order by six, and that gives an error.
So by doing this, we know that there is five columns or are being selected from a certain table and
it's the accounts table.
And displayed on this page.
So let's try and build our own select statement and get it to be executed on the target computer.
So let's come here and try to build it there.
So at the moment, the statement is select staff from accounts, your username is equal.
To Zayde, and we're doing in order by one, so let's see if we can fix that and get it to select something
that we like.
So the normal way to select stuff is using this format.
But because we are trying to do multiple selects and we're trying to do it from the URL, we're going
to have to use a union first and then we're going to say select.
Then we need to imagine what's happening on this application, so in this Web application, we know
that there are five records being selected.
So there are five columns that are being selected.
So we're doing one, two, three, four, five.
And we got that from the order by command.
So let's run this and see what happens.
And I spelled Union wrong.
And as you can see now, the selection was right and we got the first selection, so the first selection
that this line does has been done and then it did the union.
So it's it combined that selection with another selection and it showed us something else.
And as you can see here, we're only seeing two, three and four.
And what that means is whatever value you put in number two or three or four, whatever you want to
select, if you put it in there, it's going to be displayed in this page, in this particular location.
And you can see that here you have results for you.
So whatever you put into it will also be shown in here.
So let's try to see our database, so instead of number two, I'm going to say database.
And instead of number three, I'm going to say username.
Or user, and instead of number four, I'm going to do a version and this will select the current database,
the current user privileges that we have and the version of the database.
So let's see if this gets executed and then we'll talk about it.
OK, cool.
So the username is showing up as I was 10 and that's that was number two.
So that is the database that we are looking for.
So the database is ours then the current user that were logged in, as is the at local hosts over the
road user and and the signature this so this stuff, I actually don't mean anything.
We're only concerned about this and what we injected and we injected the version and we can see this
is the version of my Ezekial.
So it's five point zero point five one.
So at the moment we know that our database that we're connected to is our top 10.
Usually in most real life scenarios, each database is assigned to a certain user.
So usually you're only able to select stuff, tables, columns, data that is located in this current
database.
At the moment, we are logged in as rude, so this Web application has been connected to the database
as route, so therefore we can actually access other databases.
But this doesn't really happen in real life scenarios.
Usually each user has their own their own database.
So when they connect a Web application to a database, they connect it to one database and therefore
you won't be able to access other databases.
So we're going to consider that.
We're going to assume that we only have access to our top 10, which is our current database for this
current website.
And that the username is rumored at localist.
And the next videos, we'll see how we can further exploit this and do more powerful statements.