The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

280

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 280

---

Absinthe understands how to probe the metadata of each type of database,

as described earlier. This enables it to use the preceding simple steps to

retrieve any desired data from within the database, including the table and

column structure, and the actual data held within any given table. It presents

all of this information in a hierarchical tree format, as shown in Figure 9-2.

Figure 9-2: Absinthe results showing the table structure within 

the database

When Absinthe has gathered all of the data that you require, you can even

export the captured information in XML format, by going to the Download

Records tab. For example:

0wned

admin