And this lecture and the next few lectures we're going to be talking about a popular type of vulnerability
is called SQL injections.
Before we start talking about how this occurs and how to exploit it, let's first learn what SQL is.
Now for if you're getting a pen test on a certain website, chances are this website is a little bit
bigger than smaller websites, so it's probably using a database.
Most websites other than very simple websites use databases, and the databases are used to store data.
So they're there store usernames, passwords, news articles, blog posts, pictures, anything that
anything that happens on the website literally is stored on a database and the web application queries
the database and then displays the data to you or to the users on screen.
When the users do something, it'll either update, delete or modify the data that exist in the database.
This interaction between the web application and the database happens using a language called SQL.
So let me show you what I mean by a database.
This is just an example.
I'm not hacking anything.
I'm literally just going to log in to the database that is installed on our Metasploit table machine,
and then we're just going to see what's being stored on it.
So I'm not doing any hacking.
There is nothing here then, nothing fancy, just logging into my SQL and then I'm putting the username
root and my the metasploit table doesn't use a password for the root, which is really bad, but obviously
it's a vulnerable system.
So I'm just going to log in and I'm not hacking anything.
I'm not doing any SQL injections.
This is just the terminal for my SQL, which the web application would use to interact with the database.
So I'm just trying to show you what I mean by databases and what's saved in there.
So the first thing I'm going to do is I'm just going to type in show databases.
And that will show us the databases that exist on our target server and we can see that we have the
information schema.
This is a default database that holds default information information about all the other databases.
So this one gets gets installed by default when you install my SQL.
The rest have been installed for each web application.
So we can see we have one for TK Wiki, we have one for OWASP ten and that's for this one with all day.
We also have one called MySQL.
We have one called Metasploit and one for DB RWA, which is the one that we've been using the web application.
So you can see for each web application we actually have a database and this database holds the information
that is used by that web application.
Let me show you what's in there.
So I'm going to use.
The US.
Ten database.
So this is the one that is.
Again, this is the one for me today for this Web application, and we can see the table.
So each database has a table tables and in the tables there is information.
So I'm going to say show tables to see the tables that we have.
And you can see we have a table for accounts.
So you can assume that this table has information about the usernames, passwords and information about
the users.
We have a table for blogs, so probably has the blog inputs, the posts and the comments in there.
You can see captured data.
Credit cards.
So there's a table that contains credit cards.
Now, this is huge for shopping websites.
They actually would have credit cards table and the information for the credit cards would be stored
there.
Basically, the database will store everything, all the data that is used on the website because they
don't get stored on files, it's not efficient.
So let's have a look on the accounts.
And if I just say select.
So this is exactly how the web application would be retrieving information from the database.
It will be selecting stuff, updating or delete them.
So I'm doing a select statement here.
Again, this is not hacking.
I'm not doing anything, just selecting stuff and I'm going to select Star, which means everything
from accounts.
Apostrophe.
And as we can see, we can get we have the account ID, the username, the password, and then the signature
for the person and if that person is an admin.
Now these columns depend on the table.
So it's actually the person who designs the database, designs the tables, the columns as well, and
then the data gets inserted by the web application.
So we can see that we have a user called admin and their password is admin pass.
We can see we have a user called Adrian and their password is some password.
So.
This is just to show you what databases look like and just to get a feel on it, because in the future
videos, we're going to try to exploit these databases and have access similar to this.
So this I just logged in with the username and password.
Now usually you wouldn't have access like this, only the web admin would have that access.
In the future videos.
We're going to try to run some attacks in order to gain access similar to this so that we'll have full
control over the database so that we can read stuff and see if we can write or modify things.