Now let's try to filter the tables to the tables that are only in our database and DWI.
So we're going to use the workflows the same way that we were using it before.
So we're going to say where?
Table schema equals.
VW can enter.
And we got an error.
And again, the error is complaining about the quotes.
So the website probably uses some sort of security that does not allow us to put quotation marks in
the URL and we try to bypass that using percentage 27 before.
And as you see in, we couldn't bypass that.
We couldn't it was still detected.
So we need to think of a way to write the database name and put it after the equal without putting the
quote marks right here.
So we need to say DWI without the quote marks, and we can't really do that by writing the database
name as text.
So what we're going to do now, we're going to use burp suit and we're going to use the decoder part
of it to convert the text DV W to hex.
Now the decoder is really useful in burp.
Now remember when I was saying that the code for the quote is 20% age 27 and the code for the hash tag
is percentage 23.
Now you can just type it in here and then go to encode as and pick http URL.
Sorry.
And you'll see that the code for the hash tag is percentage 23.
You can get a code for any text you want.
Really.
For example, if you put a code, you get a percentage.
27.
Now what we want to do is we want to convert the text in here so that we don't have to write it between
quotes.
So we actually have to convert it to digits.
And what we're going to do is we're going to convert the text of the VWA to hex using the decoder part
of Burp.
So I'm going to go here.
And type DV W-A.
That's the database name.
And we're going to.
Encoded as.
Hex.
And we're going to use this as after the equal mark.
So we're going to use it instead of typing w.
So I'm going to remove this.
And I'm going to type in zero x now.
Everything written in hex has to start with zero x, so I type in zero X at the start to tell the database
that whatever that's going to come after these two characters is going to be Hex.
Therefore, I don't need to use quotation marks for it, and then I'm going to put the code that I got,
which is 6476, seven, seven, six one.
And that's it.
So we converted the database name to Hex.
I'm going to copy this.
Exploit paste it in here.
Hit Enter.
And I forgot to remove the single quote from the start because this is the medium level.
We don't need the quote.
And here we go.
It's working.
We got the tables that's only related to our current database, which is DWI.
And the tables are guest book and users.
Now, every time you need to use a word clause, you need to use it the same way that we did it.
Now, by converting the name that comes in after the word to hex and use zero x without the quotes.
And that way you'll be able to execute to select the columns using the this statement right here.
Just make sure you remove the single quote.
And it's going to work for you now because the tables, the select table statement work, then this
statement will work because they're pretty much the same statement.
The only difference is that this one select users and the other ones select based on the database name.
So in this lecture, we see how we can bypass some difficulties.
We can see with SQL injections, and we did that by converting the text to Hex and by playing around
with the injection parameter.
So try and set it, add a quote, remove a quote, maybe try to encrypt it, use percentage 27 or stuff
like that.
Basically just play around with the parameters until you get it to work.