So now that we know that
our target is definitely vulnerable.
We're definitely able to select data using this statement in here
and we can put whatever value we want in this location.
The next goal is to actually start selecting data from useful tables.
So hopefully from a users table that contains user names and passwords.
Now you could try to guess that.
So you could simply just without even knowing that there is a table that is called.
Users. You could just do select union, select for example user name and just say from
users, you could just try that and you could get lucky first of all,
I don't like guessing and in many cases you could have
things that precede or go after the user in here.
So you could have for example, table
whatever users and then you'll never be able to guess the table name and you'll never
be able to get your data from the users even though you have an SQL injection.
Therefore you should get a list of all of the tables in
the target database and that varies depending on the target database engine.
But what I show in my courses is my SQL and this time we have pasta SQL but
as you can see the way that you could
retrieve data based content is very very similar.
So you could do select star from information schema tables to get
a list of all of the possible tables on the target database.
So basically information schema tables,
it's a default table that exists on the database and this table is designed
to contain the names of all of the other tables in the current database.
That's why you could always select data from it and you'll
always be able to get the table names from it.
So there's no guessing in here.
So we're trying to get the tables now so we're gonna try to select the table name
from information
schema dot tables
and that's all we need. We're gonna close it
and let's go ahead and run it.
And perfect as you can see,
we've got a list of all of the possible tables on the current
database and as you can see some of them start with P.
G.
Some of them might start with other things that cannot be guessed
and therefore it's much smarter to actually do that instead of just
trying to guess the name of the users table or the name
of the credit card tables or whatever that you're trying to get.
So if you look closely you'll actually find a users table which is right here.
So you could have guessed it.
But the point is I want to show you how to list all of the
tables because like I said in many cases you might not be able to guess
the names of the interesting tables or there might be
interesting tables that you don't even know that they exist.
So you can't even think of their name.
Now,
the next thing you wanna do is get the columns and
again if you go to the cheat sheet you'll see how you
can get the columns but it's very similar to my SQL So
all you have to do is instead of saying table name,
we're gonna say we want to select the column name
from information, schema dot columns
where
the table name is users.
So we're trying to know the column names in the user table because
our statement usually works by saying select column name from table name.
So this is usually the format that we do we do select
call them name
from table name.
So we know that the table name is users
but we don't know what to select from it. Now.
Again you could guess that you want to select the user
name and that you will be right if you do that.
But I just want to show you how you could select the columns as well.
So basically what we're saying is we want to
select the column name from information schema columns.
So this is another default table that exists within the database
that lists all of the column names on the database.
But we're saying we want to select the columns only where the table name is users.
So where we have the interesting table that we're looking for.
So we're gonna copy this.
We're gonna go back here
and let's paste it
and if you scroll down you can see we have
a column called user name and a column called password.
So you were right in guessing that.
But I just wanted to show you how you could actually
get the right names for the column names without guessing.
So now that we know we have a user name and
a password our statement is going to be very very simple.
So going back to our one we can select a user name
from instead of information schema dot tables from. Users
copy this,
put it here
and perfect you can see we have a user name called Carlos
and we have winner and we have administrator.
Now we could also select the password instead of the user name
and here we go. We have all of the passwords for the users.
Now we don't know which password corresponds to which user.
So again we can use the word statement similar to
what we used it when we were selecting the column.
So we're doing union, select the password from users and we're gonna say where
the user name is equal to administrator because
that's the user name that we've seen earlier.
He'd enter
and we have the admin password in here.
So you could go ahead now and log in with the user name and the
password of the admin without having to discover an SQL injection in the admin.
And you're not really gonna be hacking the admin login page.
You're basically logging in with his own credentials.
So essentially we are exploiting the web application that
was designed to only load data for products,
for users to load the admin and their password.