Now let's see if we can select and get and have a look on all the accounts that exist within this table
so let's see if we can query the database and read the information stored in the accounts table to do
that.
We're going to first need to know the column names of the columns that exist within this table because
if you look at the way we're using our statement we're doing unioned select column name from a table.
So we still don't know what columns exist in accounts.
Now we can try and guess that there is a username and password but sometimes they could be different
names.
So I'm going to show you how you can select the columns for a certain table.
The command is going to be very similar to the tables come on and the only difference is instead of
table name we're going to say column names and instead of selecting it from the information schema tables
we're going to select this from information schema those columns
and we're going to say where at the table name
is equal to accounts because we're interested into the accounts table if you want to get columns for
another table then you just substitute this with the table or with the contact with the table that you
want.
So our company is going to be union select one column name from the information schema or those columns
where the table name is the table that we're interested in which is the accounts and this should show
us all the columns that exist within the accounts table.
So let's run this command
and purrfect same columns that we've seen before and see ID username password.
My signature is Aardman.
Now let's take this one step further and select the user names and passwords from the account table.
So again the command is going to be very similar to what we're running at the moment.
We're going to be selecting.
And we're going to select user name
and I'm going to select the passwords for number two and for number three we're going to select the
is admin.
Now remember I can't select anything instead of number one and number five because they don't they're
not they're never displayed for me on screen.
The only thing that I see was number two three and four which were displayed here two three and four.
So therefore I want to substitute in values for two three and four.
And we're going to select that from my count
and we're not going to need the word.
So I'm going to delete the word.
So very simple statement.
We're selecting username password is oddment from the accounts.
And this should return all the usernames and passwords that exist within the current table that exist
in the accounts table.
And I have an extra quote here that I'm going to delete and as you can see we've got all these rules
and passwords we have the admin and their password is our impasse.
We have other users and we have their passwords.
And it also tells us whether they are admins or not.
This is very useful because in most websites when you log in as admin you have so much more privileges
than a normal person.
And then you'll be able to upload ph Rochelle's or backdoor viruses whatever you want to do really.
And then further exploit the system.
So at the moment I can actually log in with a username admin and a password and Prowse and this can
accept that because it's correct.
So no matter how complicated the password was we're just going to be able to read it because we're reading
it straight from the database.