OK so now let's try and determine how many columns are being selected into this page.
So how much information are being selected and displayed on this page.
So to do that we're going to use the order by command.
So we did order by one and that returned something that was acceptable.
And Order by 100000 was an error.
So let's try and do order by 10 and we still get an error.
So I'm going to do an order by five.
And that works.
So let's try to do an order by six and that gives an error.
So by doing this we know that there is five columns or are being selected from a certain table and it's
the accounts table and displayed on this page.
So let's try and build our own select statement and get it to be executed on the target computer.
So let's come here and try to will do so at the moment.
The statement is select star from accounts where your user name is equal to zayd.
And we're doing an order by one.
So let's see if we can fix that and get it to select something that we like.
So the normal way to select stuff is using this format but because we're trying to do multiple selects
and we're trying to do it from the or else we're going to have to use a union first and then we're going
to say select then we need to imagine what's happening on this application.
So in this web application we know that there are five records being selected.
So there are five columns that are being selected.
So we're doing one two three four five and we got that from the order by command.
So let's run this and see what happens.
And I spilled Union wrong
on as you can see now the selection was right and we got the first election.
So the first election that this line does has been done and then it did the Union.
So it's a combined election with another selection and they chose something else.
And as you can see here we're only seeing two three and four.
And what that means is whatever value you put in number two or three or four whatever you want to select.
If you put it in there it's going to be displayed in this page and this particular location and you
can see that here you have results for two.
So whatever you put into will also be shown in here.
So let's try to see our database.
So instead of number two I'm going to say database and say number three I'm going to say user name or
user and instead of number four I'm going to do a version and this will select the current database
the current user privileges that we have and the version of the database.
So let's see if this gets executed and then we'll talk about it.
Ok cool.
So the username is shown up as a last turn and that's that was number two.
So that is the database that we're looking for.
So the database is a wasp then the current users that were logged in as root at localhost so were the
root user and and the signature.
So this stuff.
I actually don't mean anything we're only concerned about this and what we injected and we injected
the version and we can see this is the version of Manusky L.
So it's five point 0.5 one.
So at the moment we know that our database that we're connected to is was 10.
Usually in most real life scenarios.
Each database is assigned to a certain user.
So usually you're only able to select stuff tables columns data that is located in this current database.
At the moment you are logged in as rude.
So this web application has been connected to the database as root.
So therefore we can actually access other databases but this doesn't really happen in real life scenarios.
Usually each user has their own path their own database.
So when they connect a web application to a database they connect it to one database and therefore you
won't be able to access other databases.
So we're going to consider that we're going to assume that we all have access to all US standard which
is our current database for this current web site and the user name is ruined at local post.
And the next videos we'll see how we can further exploit this and do more power for us like statements.