A lot of the time we'd be interested into more than just hacking into the website.
So at the moment we can read, write, download, modify files on the current web server.
But a lot of the time what actually interests us is data that is stored in the database.
So things like usernames and passwords, you won't see them into files, they'll actually be stored
into the database.
So if you want to see these things, if you want to have access to them, you have to hack into the
database.
Most of the programs, for example, DWI, DWI, Michelle Day and real world programs like WordPress,
they all connect to the database to store stuff in it.
And in order to be able to connect to the database, they do that through a file called config.
So there is usually it will be called config dot php, c, c, f, g dot PHP or something similar to
that.
So the first thing you want to do is you want to locate that file and read its content.
So this is what we're going we're going to do.
This is going to be our step one.
So we are in var w w w dev.
So I'm just going to go to dv wa.
So I'm going to go back once and go to dv wa and then I'm going to list.
And you can see that we have a directory called config.
So we're going to open that directory.
And we're going to list.
And you can see that we have a file called Config dot Inc dot BHP.
So you can read that using the normal cut command.
So you can literally just do cut.
Config dot dot php.
And you'll be able to read the contents.
A lot of the times when you do that, it's not going to work.
So what you want to do is you can do you can use a function that comes in with weebly.
Again, it's called file rate and it allows you to read the file using multiple methods.
So if the normal cut method didn't work for you, you can use that function to read it and let's see
how we can use that function.
So we're just going to do file.
Re it minus h like we always do.
And you can see that we have a number of vectors, so we can do an F on it.
We can do file get and we can get it in base 64.
So again, you can use you can use that similarly to the ways that we were doing it before.
So you just do minus vector.
And we're going to choose file.
And then you select the file that you want to read, which is again, it's called config.
Dot Inc dot php.
And once we read this file, you'll see that it has information about how to connect to the database.
So this file is actually used by the web application itself to connect to the database.
So you always see these four things.
You'll see that the host and you can see that it's set to the local host.
Here you can see the database name.
It's called VWA.
The username is root and the password, and in this case it's blank.
Chances are you won't see a root user and you won't see a blank password.
So you'll probably have like some sort of a name in here and you'll actually have a password in here.
Once you have this information, you can connect to the database using an SQL shell.
So.
If we go back to the help here.
You'll see that we have two SQL modules.
One of them is the SQL console, and this one will basically allow you to have a normal and interactive
SQL console where you can run any SQL statement.
Something similar to what we got with SQL Map.
This will not work in this case because our root user is not using any passwords, so it will just not
connect.
But in normal cases it should work for you.
The second example, which is the more useful example anyway, is the SQL dump.
And this will basically dump the whole database into a file and it'll download the file to your current
computer so that you can open it and read the data.
Normally using a text editor.
So we're going to have a look on this example on the SQL dump.
So using using these modules is very similar to what we've been doing so far.
So the SQL console is very similar to the module anyway, so.
We're going to do a scale dump.
And we're going to do a minus H to see how to use it.
And you can see that the way to use it is you do a SQL dump, you select the database type.
You don't have to do that.
We're not going to do it.
You give it the host, so let's give it the host.
And this is going to be local host.
Again, we're taking this information from here, from the config file.
After the host, you want to give it the URL path and this is where the data is going to be saved in
your local computer.
So let's store it in route.
And we're going to call it v w a data.
Dot txt.
And then you want to select the vector.
So I'm going to leave this the way it is, and we're not going to modify that.
And then you have to select the database.
Again, we'll take this information from here.
So the database is DWA.
Then you have to give it.
The user, so the user is rude.
And my password is blank.
So again, the command is SQL dump given it the host where we want to store the data and then the database
is DWI.
The user is rude.
Password is blank.
Hit enter.
And I did something wrong here.
I forgot to put minus l path in here.
Enter.
And now it's telling us that this method has failed.
So again, when something fails, we go, we try a different vector.
So let's try to use my SQL dump as H.
So we're going to use the same command, but we're going to add minus vector to it.
And this is going to be my SQL dump S-H.
Enter.
And as you can see now, this worked and it's telling us that the data has been stored to route DWA
data to TCD.
So I'm going to go to my file manager and I'm already en route.
And you can see that we have a file here called DV W Data.
The text double click the file.
And right here we can see information about the whole database.
So it might look like gibberish, but it's not.
If you just have a closer look at it, you can see that you have the table structure.
You have a table here called guest book.
You can see that this table has the following columns.
It has a column called Comment ID.
It has a column called Comment and it has a column called Name.
And you can see that the primary key is the comment ID going down.
You'll see that we have a table called users.
You can see the columns are user ID, first name, last name, user password and avatar.
And if you go down, you'll actually see the entries.
So you can see that we have a user called admin and this is their password.
This is their working directory.
Again, you have another user called Gordon.
His second name is Brown and this is his password.
Now the passwords are encrypted, so you can go and try to decrypt these passwords.
But again, this lecture just show you how to gain access to the database and dump the whole database
into a local storage and then browse it the way you want.
These are actual dump files so you can actually import them into PHP my admin.
So if you have a web application background you can go to PHP, my admin, create a new database and
import this file into that database.
It will automatically create a database with these tables and you'll be able to easily navigate through
this and read the data.