That is that you want to look at a real database and see what it actually looks like under the hood.
I have that answer for you because on our lab here as you can see, I have MySQL installed.
I have a link for MySQL download because it's a workstation compatible program
that allows you to be able to basically run a miniature SQL server on your own workstation.
It can also be used in server platforms as well too.
I recommend going with an actual dedicated SQL server if that's how you want to do it.
But what we're taking a look at here is a database that I've downloaded for you
in the actual virtual lab itself so that way you can take a look at the practice database.
The link for that database is actually down below and this is something that's
completely made up that you could take a look at just as a bit of practice.
Now we will be zooming in and out here because I want to show you here real quick.
First that if you log in or get into the lab you open up MySQL.
I have the icon right there on the top left by the way.
And you want to open up this particular database.
It's under schemas and it's right here to the right of the administration tab.
So if you log in you don't see this right away.
Don't be afraid to click on schemas and here you get the basic information.
Now MySQL will allow us to be able to look at the actual index columns and tables and all that
different stuff because it allows us to understand the vastness of the data collected inside of a
database.
Now I want to go into indexes here real quick and these are all the tables that are within
this particular database, our practice database.
You can see here that we have albums,
artists, customer, employee, all sorts of different information.
A lot of information that may provide value to a hacker that was actually able to get
into something like this for the purposes of getting PII or financial information.
Because PII would be under let's say customer info in here and then credit and card information
will be down let's say invoices because you got to be able to track how and who to pay.
So if I go in and just double click on the first customer right and then this pops up
it's all the columns within that particular table and I'll zoom in for you here and show you
that this is going to link in the real world to a website or an application that is going
to request data from a form submission type to be able to fill the data.
So it goes let's say from a website that says enter your customer info name,
first name, last name, etc, etc.
When you hit submit it's going to populate that data inside of a database.
This one as an example.
So you have first name, last name, company address, city, state, etc, etc.
And this is starting to sound really familiar with that PII risk if this data or information
gets exposed inadvertently.
So this is just something for you to be able to go through and take a look at and understand
how a database is actually structured and the vastness again of how much information
can be stored within a database.
It would be kind of difficult to keep all of this information inside of one particular
spreadsheet and this allows us to be able to categorize data as well too.
But there's one more thing.
We're taking a look at that database offline.
And in previous skills like directory traversal, file inclusion, cross-site scripting, and
a couple of others, we've learned how we can take actual files and send them to a remote
system.
For instance, the one that we pin test on.
How is that important you might ask?
Well, think about it.
We use MySQL to open up that database that's stored locally on our system.
If we were to be able to break into a let's say SQL server and do a database dump through
file inclusion, we wouldn't have to spend all day on the server using network activity
to potentially get us caught.
We can bring it to our own system and spend our own time browsing through it with something
like MySQL or SQLite just as an example.
But this is a way for us to be able to get familiar with what's actually in the database
and without even getting into the injection part just yet, being able to go through and
exfiltrate data that might provide more use to us inside of that pin testing environment.
But don't worry.
We're about to get into part two of this skill, which is actually going into a little bit
of SQL injection practice.
I wanted to get the basics out of the way to make sure that we understand basically
the five W's of what a SQL or a database is and what it means to us as those pin testers.