Now let's see if we can select and get and have a look on all the accounts that exist within this table.
So let's see if we can query the database and read the information stored in the accounts table.
To do that, we're going to first need to know the column names of the columns that exist within this
table.
Because if you look at the way we are using our statement, we're doing union select column name from
a table.
So we still don't know what columns exist in accounts.
Now we can try and guess that there is a username and a password, but sometimes they could be different
names.
So I'm going to show you how you can select the columns for a certain table.
The command is going to be very similar to the tables command.
And the only difference is, instead of table name, we're going to say column name.
And instead of selecting it from the information schema tables, we're going to select it from information
schema dot columns.
And we're going to say where the table name?
Is equal to accounts.
Because we're interested into the accounts table.
If you wanted to get columns for another table, then you just substitute this with the table or with
the column that with the table that you want.
So our command is going to be union select one column name from the information schema dot columns where
the table name is the table that we're interested in, which is the accounts.
And this should show us all the columns that exist within the accounts table.
So let's run this command.
And perfect same columns that we've seen before.
And it's ssid username password my signature and is admin.
Now let's take this one step further and select the usernames and passwords from the account table.
So again, the the command is going to be very similar to what we're running at the moment.
We're going to be selecting and we're going to select username.
And I'm going to select the password for a number to.
And for number three, you are going to select the as admin.
Now, remember, I can't select anything instead of number one and number five, because they don't
they're not they're never displayed for me on screen.
The only thing that I see was number two, three and four, which were displayed here two, three and
four.
So therefore, I'm only substituting values for two, three and four, and we're going to select that
from accounts.
And we're not going to need the word, so I'm going to delete the word.
So very simple statement we're selecting username password is admin from the account and this should
return all the usernames and passwords that exist within the current table that exist in the accounts
table.
And I have an extra quote here that I'm going to delete.
And as you can see, we've got all the usernames and passwords, we have the admin and their password
is admin pass.
We have other users and we have their passwords and it's also telling us whether they are admins or
not.
This is very useful because in most websites when you log in as admin you have so much more privileges
than a normal person and then you'd be able to upload PHP shells or backdoors, viruses, whatever you
want to do really, and then further exploit the system.
So at the moment I can actually log in with the username admin.
And a password admin pass.
And it's going to accept that because it's correct.
So no matter how complicated the password was, we're just going to be able to read it because we're
reading it straight from the database.