We know that databases are methods for us to be able to store large amounts of information.
We generally associate a database with a database server, but that's not always the case
because there are local versions of databases that are out there. For instance, inside of Windows
itself, there are a couple of them, some of them native to Windows on the actual install itself,
and some of them with third-party applications. I'm going to show you a couple of examples
so we can get a full idea of where and when you might run into a database. Because as a pen tester,
yes, it's always good to fish out in SQL servers and try to exploit them the best way possible,
but also understanding that you can use some of those same techniques and understandings for local
workstations themselves goes a long way because you can apply some of the same tactics as well.
Now, we're going to be taking a look at inside of our lab and also inside of our regular workstation,
so bear with me for just a second. Now, what I have up here is a file explorer pointing to
C Drive Windows Software Distribution Data Store. I have the code for this below, the actual file
path location, and also the tools that we're going to be using for this portion of our skill to get
an idea of what's going on. Ready? This particular database right here stores information pertaining to
local updates installed to the actual Windows operating system. So, it's a database within a
local workstation that could be the target of manipulation for one reason or another. Now,
if you'll notice as I zoom in for you that this is in EDB format. Now, that is not necessarily
a format that we're going to be working with a lot of the times because we're primarily using,
looking to do SQL database, the actual SQL server itself like by Microsoft to as a form of attack,
but this is what's known as a JetBlue database. No, not that one. The actual JetBlue database
is a different type of formatting for databases. Now, it is possible that you could see this along
with different other types. Just know that when we say database, it's a collection of large amounts
of data. Now, in order to view this, you'll need what's called an ESD viewer, and I have that
and the link for it down below. And inside of our actual viewer, as you can see right here,
I have this in C drive on the actual Hyper-V host itself. When you go into the lab, C drive ESD
viewer, and you can see here as I zoom in for us that we have a lot of information along with
the actual data points that it has collected for the overall data set. Now, a lot of this
isn't really going to make sense until you actually start getting into the actual name
of everything that's going on. So, as you scroll through here, you'll see a lot of information that
may come into play later on for you. Now, this skill is not about going in and actually going
through and manipulating this particular database. Remember, we're just trying to familiarize
ourselves with SQL theory and get it into a little bit of finger scratching with SQL injection as a
practice. So, we're just taking a look at this right here just to understand what's inside and
what it actually looks like. Now, this may honestly look like gobbledygook, but this all relates to
different points of information within the operating system itself to correlate this particular
update needs to go to this particular software, et cetera, et cetera, et cetera. And you can go
through here along with, and I'll show you zoomed in, that there are multiple columns. Now, this
doesn't really make a lot of sense, but don't you worry, I'm going to clear that up here momentarily.
But this isn't the exactly the only place that you could take a look at a database.
And I should clarify database on an actual workstation as I am now moving in my personal
file explorer from what we're recording on right now. And this is in C drive. I have the
in the code box below C drive users, your username, and then app data, local Google
Chrome user data. What we're taking a look at here is the actual folder of installation for
part of the installation for Google Chrome. And you'll notice that I have multiple profiles here,
profile one through skip a few 16. And each one of these profiles relates to something like when
you open up Chrome and ask which user you want to log into one of those. And the reason that I want
to point this out is, is that as you go into an actual profile itself, you can actually go through
into the profile and find the database or that particular Chrome profile setting. Now you may
notice there's a lot of folders in here and there's a lot of different log files and also
lock files. But as you were to browse through this inside of your own workstation, you could see where
a lot of this actually has databases installed inside of it. For instance, I'm just in the shared
photo DB folder, and you can see here that we have LDB. And if we move to the right, you see that
that's already associated because I have Microsoft access installed with access. So is it a large
database? No, but it's big enough to where it exceeds the boundaries of reasonable inside of
Excel or just a regular spreadsheet to be able to keep track of all the data on it or within your
Chrome profile. As we continue throughout the course and start getting into some of those
Active Directory tools and tactics that we are looking forward to, you'll start to see that
there are different SQL servers out there and also the expansion of more databases.
But I also know what you're asking. Hold on one second.