Now, let's see if we can select and get and have a look on all the accounts that exist within this
table, so let's see if we can query the database and read the information stored in the accounts table.
To do that, we're going to first need to know the column names of the columns that exist within this
table, because if you look at the way we're using our statement, we're doing union select column name
from a table.
So we still don't know what columns exist in accounts.
Now, we can try and guess that there is a username and password, but sometimes they could be different
names.
So I'm going to show you how you can select the columns for a certain table.
The command is going to be very similar to the tables command.
And the only difference is, instead of table name, we're going to say Collum name.
And instead of selecting it from the information at the tables, we're going to select, it's from information
schema, those columns.
And we're going to say where the table name.
Is equal to accounts because we're interested into the accounts table, if you want to get columns for
another table, then you just substitute this with the table or with the column that with the table
that you want.
So our command is going to be union select one column name from the information schema, those columns
where the table name is the table that we are interested in, which is the accounts.
And this should show us all the columns that exist within the accounts table.
So let's run this command.
And perfect same columns that we've seen before, and it's Sidis username, password, my signature
and is Admon.
Now, let's take this one step further and select the usernames and passwords from the account table.
So, again, the document is going to be very similar to what we're running at the moment, we're going
to be selecting and we're going to select username.
And I'm going to select the passwords for number two.
And for number three, you were going to select the is Adnan.
Now, remember, I can't select anything instead of number one and number five, because they don't
they're not they're never displayed for me on screen.
The only thing that I see you was number two, three and four, which were displayed here, two or three
and four.
So therefore, I'm only substituting values for two, three and four.
And we're going to select that from accounts.
And we're not going to need the word, so I'm going to delete the word.
So very simple statement we're selecting username, password is Admon from the accounts, and this should
return all the usernames and passwords that exist within the current table that exist in the accounts
table.
And I have an extra quote here that I'm going to delete.
And as you can see, we got all the user names and passwords, we have the admin and their passwords
admin plus we have other users and we have their passwords.
And it's also telling us whether they are admins or not.
This is very useful because in most websites, when you log in as admin, you have so much more privileges
than a normal person and then you'd be able to upload specials or bacteria, viruses, whatever you
want to do, really.
And then further exploit the system.
So at the moment, I can actually log in with a username Admon.
And a password admin pass, and it's going to accept that because it's correct.
So no matter how complicated the password was, we're just going to be able to read it because we're
reading it straight from the database.