In our challenge we were seeing if we can identify the number of columns within a table inside of our local MySQL database.
Now as you can see up top I have MySQL Workbench open up and I'm going to identify what we're talking about here.
So for instance, we're taking a look at the Chinook database and I have expanded the actual tables.
So everything within there is a table for data to be stored in.
And within each of those tables are columns of different pieces of information that are required or can be filled in.
So for instance, I'm taking a look at the actual columns within the album section or the albums table.
Now as you can see below the columns we have album ID, title, and artist ID.
So there are three columns within the album table.
Now that's how to do it through the GUI and actually looking at the database.
Let's take a look at it from SQL Map inside of Kali.
Now SQL Map, and I'll have the syntax for this below the video.
It's a program or exploit program inside of Kali that comes natively installed that allows us to be able to try and map out an actual database for reconnaissance purposes.
And once we get in that database through exfiltration and threat vectoring and privilege escalations,
we'll be able to go in and take a look at the actual number of columns within a table.
So as you can see up here I am inside of the terminal and I'm using sudo to run this elevated for a SQL Map.
And I have it identified as the actual username and password as well in that string of text.
Now you could not put the password in there and do a dash P and it will go ahead and execute but then ask you for a password.
But at this particular point, we already know because we've done previous skills to where we've actually gone through and cracked that password or seen it in use somewhere else.
So I'm SQL mapping to the host VM that you get into for the lab.
And I'm also connecting slash or excuse me semicolon 3306 for that single port slash the actual database that's in there and then identifying the dash T for tables.
I said album.
And as you can see, I have three columns within the album table inside of our actual database.
So this gives us an idea of what the actual field is and the data type that it takes for us to be able to potentially exploit later on.
Now, I know we're probably going to be coming back to SQL injection and other practices later.
Once we get into the more server related side of this course.
I just wanted to be able to go through and explain what SQL is and the exploration of its actual function inside of a either standalone system or on a server.
This was more of a familiarization for us as we start to get into server applications and pin testing against those actual servers.
I hope this has been informative for you and I'd like to thank you for viewing.