Okay.
As you remember from one of the previous modules.
We were able to find SQL injection
in get parameter named ID,
and we were able to fetch the
banner. So and I just want
to continue from that point.
And show you how you can do more powerful things. So my
last command was like this, right?
So I'm just going to continue my previous demo, right?
And now instead of banner. I'm going to
put dash dash dump. That's the
only difference right? So I'm still in the very same
place.
And yeah, let's click enter.
Yeah, and you see all this
kind of fetching the database table entries
is happening in real time in front
of your eyes. I wasn't even able to
finish one or two sentences and this
two automatically fetched a lot
of data from database. Let's take a look here. We see
here. The database is training. We've got some table like
item six entries. What's
what's here? We've got some firewall then
description is by a firewall lock by lock. It's
not interesting from security point of view. So
let's go up and find something more
interesting. Yeah, we've got something like
this. Let's take a look here. There's a table
users and in this table, we've got
something beautiful.
Here we've got logins of different people
like admin seller one seller to David Michael
nice and some passwords. Nice
like super secure password.
Look at that super secure password is
the password of admin, right?
and now
we've got some p4ss.
Zero Rd is is the password actually of seller
2 very nice. So now
you can see.
How easily you can fetch this data from the
database, right?
So this tool is
really really powerful
and now you can actually see how powerful
it is. So you don't have to do everything manually
this tool will do it.
For you and now one very very important remark. This
tool is very powerful. But remember
that you are not allowed to
do this kind of of attack
if you don't have a clear permission, right? So if
you are doing a penetration test, you need to
have a clear permission.
From your clients to do this kind of
attack, right? So without clear
permission never ever do do
this kind and a thing, but
now this is an education. I want to
show you what is possible or what is not possible?
But you always have to obey the
rules and remember you always need
to have a permission to this kind of testing and never
ever do it without permission. So
this is just a remark for you because I don't want
you to end up with problems, right? Okay, that's great.
We are and we are done with dumping database
table entries so we can go to
the next module.