WEBVTT

1
00:00:00.080 --> 00:00:02.720
<v Speaker 1>Imagine for a moment, you're at your computer doing something

2
00:00:03.200 --> 00:00:08.080
<v Speaker 1>completely normal, checking emails or maybe browsing a website. Now,

3
00:00:08.240 --> 00:00:12.199
<v Speaker 1>what if someone somewhere could actually see every single key

4
00:00:12.199 --> 00:00:15.519
<v Speaker 1>stroke you type, or even worse, turn on your webcam

5
00:00:15.720 --> 00:00:18.960
<v Speaker 1>that you ever knowing it was happening. It sounds like

6
00:00:18.960 --> 00:00:20.559
<v Speaker 1>something pulled straight from a spy movie.

7
00:00:20.640 --> 00:00:21.480
<v Speaker 2>It really does.

8
00:00:22.160 --> 00:00:25.920
<v Speaker 1>But for ethical hackers, understanding these incredibly powerful capabilities isn't

9
00:00:25.960 --> 00:00:29.839
<v Speaker 1>really about invasion. It's the very first step in building

10
00:00:29.920 --> 00:00:31.440
<v Speaker 1>robust defense and protection.

11
00:00:31.760 --> 00:00:32.359
<v Speaker 2>Exactly.

12
00:00:32.759 --> 00:00:35.479
<v Speaker 1>Welcome to the deep dive, where we impact complex topics

13
00:00:35.520 --> 00:00:38.840
<v Speaker 1>and help you quickly become truly well informed. Today we're

14
00:00:38.880 --> 00:00:42.520
<v Speaker 1>plunging into the fascinating world of ethical hacking, exploring what's

15
00:00:42.520 --> 00:00:46.600
<v Speaker 1>often described as well the playbook of a genius. Our

16
00:00:46.600 --> 00:00:48.520
<v Speaker 1>mission for you, our listener, is to extract the most

17
00:00:48.520 --> 00:00:51.759
<v Speaker 1>important nuggets of knowledge from this material, helping you understand

18
00:00:51.799 --> 00:00:54.679
<v Speaker 1>not just what these powerful systems and tools do, but

19
00:00:54.759 --> 00:00:57.520
<v Speaker 1>crucially how they actually work and why they matter.

20
00:00:57.840 --> 00:01:01.640
<v Speaker 2>And it's vital to remember this isn't about teaching you

21
00:01:01.679 --> 00:01:04.959
<v Speaker 2>to be malicious. It's fundamentally about learning how to defend

22
00:01:05.000 --> 00:01:08.200
<v Speaker 2>against those who are Did you know that many major

23
00:01:08.239 --> 00:01:12.159
<v Speaker 2>companies like Facebook actually run what are called bug bounty.

24
00:01:11.760 --> 00:01:13.719
<v Speaker 1>Programs, right, I've heard of those.

25
00:01:13.879 --> 00:01:17.000
<v Speaker 2>Yeah, they offer substantial rewards sometimes, you know, tens of

26
00:01:17.040 --> 00:01:21.239
<v Speaker 2>thousands of dollars for individuals who responsibly discover and disclose

27
00:01:21.319 --> 00:01:25.439
<v Speaker 2>vulnerabilities they find. It really highlights the immense value placed

28
00:01:25.480 --> 00:01:29.359
<v Speaker 2>on this kind of expertise, demonstrating that understanding these techniques

29
00:01:29.480 --> 00:01:32.879
<v Speaker 2>is a highly sought after skill for building stronger digital defenses.

30
00:01:33.120 --> 00:01:36.599
<v Speaker 1>Okay, so to start cracking, open this playbook. Let's talk

31
00:01:36.599 --> 00:01:40.480
<v Speaker 1>about building your secure sandbox. This sounds like the absolute

32
00:01:40.560 --> 00:01:43.239
<v Speaker 1>foundation for any ethical hacking exploration.

33
00:01:43.760 --> 00:01:46.719
<v Speaker 2>It absolutely is. Before you even think about engaging with

34
00:01:46.760 --> 00:01:49.760
<v Speaker 2>a real network or system, an ethical hacker creates a

35
00:01:49.799 --> 00:01:54.439
<v Speaker 2>completely safe, isolated environment. Think of it as a virtual lab. Okay,

36
00:01:54.480 --> 00:01:58.200
<v Speaker 2>we're talking about creating computers within your computer using virtualization

37
00:01:58.319 --> 00:02:02.079
<v Speaker 2>software like virtual box. This setup ensures that you can

38
00:02:02.159 --> 00:02:05.920
<v Speaker 2>experiment to your heart's content, break things, fix them, and

39
00:02:06.040 --> 00:02:09.840
<v Speaker 2>learn fearlessly, all without any risk to your own operating

40
00:02:09.879 --> 00:02:14.400
<v Speaker 2>system or critically anyone else's. It's a completely contained space.

41
00:02:14.800 --> 00:02:18.039
<v Speaker 1>And within this virtual lab, you typically set up what

42
00:02:18.199 --> 00:02:20.879
<v Speaker 1>three main machines, that's the common setup. Yeah, first you

43
00:02:20.919 --> 00:02:24.159
<v Speaker 1>have Kully Linux, which acts as your primary attacking machine.

44
00:02:24.479 --> 00:02:27.439
<v Speaker 1>It's a specialized operating system that comes preloaded with just

45
00:02:27.520 --> 00:02:31.919
<v Speaker 1>an incredible array of penetration testing tools packed full. Then

46
00:02:32.039 --> 00:02:35.360
<v Speaker 1>you'd add Metasploitable another Linux machine, but this one is

47
00:02:35.560 --> 00:02:38.000
<v Speaker 1>like deliberately designed to be vulnerable exactly.

48
00:02:38.039 --> 00:02:40.680
<v Speaker 2>It's literally built to be the perfect practice target, makes

49
00:02:40.759 --> 00:02:41.520
<v Speaker 2>learning safe.

50
00:02:41.639 --> 00:02:44.719
<v Speaker 1>And finally, you'd include a standard Windows machine just to

51
00:02:44.759 --> 00:02:48.240
<v Speaker 1>simulate real world user scenarios, giving you a realistic target

52
00:02:48.280 --> 00:02:50.719
<v Speaker 1>for say, client side attacks.

53
00:02:50.840 --> 00:02:53.879
<v Speaker 2>Right, and one of the most brilliant features for learning

54
00:02:53.919 --> 00:02:57.360
<v Speaker 2>in a virtual lab is the power of snapshots. Oh yeah,

55
00:02:57.560 --> 00:03:00.800
<v Speaker 2>imagine being able to hit save game or your entire

56
00:03:00.840 --> 00:03:04.719
<v Speaker 2>computer system. If you're experimenting and you break something or

57
00:03:05.199 --> 00:03:08.719
<v Speaker 2>mess up a configuration, no problem, you can instantly revert

58
00:03:08.759 --> 00:03:12.719
<v Speaker 2>to a previous working state. This makes the learning process

59
00:03:12.840 --> 00:03:16.240
<v Speaker 2>incredibly practical, and it sort of removes the fear of

60
00:03:16.280 --> 00:03:19.159
<v Speaker 2>irreversible mistakes because you always know you can go back

61
00:03:19.199 --> 00:03:20.080
<v Speaker 2>to a clean slate.

62
00:03:20.240 --> 00:03:22.599
<v Speaker 1>That's like having an infinite undo button for your entire

63
00:03:22.680 --> 00:03:25.520
<v Speaker 1>operating system. That's amazing pretty much. Yeah, So, once your

64
00:03:25.599 --> 00:03:27.840
<v Speaker 1>lab is up and running, you'll spend a lot of

65
00:03:27.879 --> 00:03:30.759
<v Speaker 1>time within klie Linux. Now, while it does have a

66
00:03:30.759 --> 00:03:36.039
<v Speaker 1>familiar graphical interface for aspiring ethical hackers, interacting with the

67
00:03:36.080 --> 00:03:39.840
<v Speaker 1>command line is absolutely central, Oh absolutely Essentially, you'll become

68
00:03:39.960 --> 00:03:43.919
<v Speaker 1>very familiar with fundamental commands like LS to list files,

69
00:03:44.319 --> 00:03:47.919
<v Speaker 1>CD to change directories, and PWD to show your current location.

70
00:03:48.319 --> 00:03:49.120
<v Speaker 2>The basics.

71
00:03:49.360 --> 00:03:52.080
<v Speaker 1>And there's a secret weapon, the man command to get

72
00:03:52.080 --> 00:03:55.080
<v Speaker 1>help for any command, and the tab button for autocomplete,

73
00:03:55.199 --> 00:03:57.319
<v Speaker 1>which seriously saves a ton of typing.

74
00:03:57.360 --> 00:04:00.520
<v Speaker 2>Tab complete is your best friend. A's finitely And one

75
00:04:00.599 --> 00:04:03.800
<v Speaker 2>crucial detail often overlooked when first setting up is how

76
00:04:03.840 --> 00:04:08.319
<v Speaker 2>you connect to wireless networks for hacking purposes. Your laptop's

77
00:04:08.319 --> 00:04:11.280
<v Speaker 2>built in Wi Fi isn't typically enough for the advanced attacks.

78
00:04:11.319 --> 00:04:15.000
<v Speaker 2>Why is that, Well, you need external USB wireless adapters

79
00:04:15.039 --> 00:04:19.160
<v Speaker 2>that specifically support monitor mode and packet injection. These aren't

80
00:04:19.199 --> 00:04:22.120
<v Speaker 2>just technical terms. They describe the ability to listen to

81
00:04:22.199 --> 00:04:25.360
<v Speaker 2>all wireless traffic, not just what's intended for your computer,

82
00:04:26.000 --> 00:04:28.959
<v Speaker 2>and to send custom wireless packets, which is essential for

83
00:04:29.079 --> 00:04:33.879
<v Speaker 2>more sophisticated network attacks like cracking Wi Fi passwords. Standard

84
00:04:33.879 --> 00:04:35.680
<v Speaker 2>cards simply aren't designed to do that.

85
00:04:36.319 --> 00:04:40.079
<v Speaker 1>Got it? So, with our secure Virtual Labs set up

86
00:04:40.120 --> 00:04:42.720
<v Speaker 1>and ready to go. The next crucial step in this

87
00:04:42.759 --> 00:04:46.160
<v Speaker 1>ethical hackers playbook is reconnaissance. Before you can even think

88
00:04:46.199 --> 00:04:50.240
<v Speaker 1>about defense, you need to understand your target, truly unmasking.

89
00:04:49.720 --> 00:04:54.199
<v Speaker 2>The network, and that understanding begins with network identities, specifically

90
00:04:54.399 --> 00:04:55.279
<v Speaker 2>MAC addresses.

91
00:04:55.360 --> 00:04:57.000
<v Speaker 1>Right, it's a physical address exactly.

92
00:04:57.199 --> 00:04:59.959
<v Speaker 2>Every network card, whether it's in your phone, laptop, or route,

93
00:05:00.560 --> 00:05:04.680
<v Speaker 2>has a unique physical media access control address assigned by

94
00:05:04.680 --> 00:05:08.480
<v Speaker 2>its manufacturer. Think of it like a permanent physical serial

95
00:05:08.560 --> 00:05:11.519
<v Speaker 2>number etched directly onto the device's network hardware.

96
00:05:11.800 --> 00:05:16.839
<v Speaker 1>But here's an interesting twist For anonymity. During penetration testing,

97
00:05:17.199 --> 00:05:20.480
<v Speaker 1>a crucial step is being able to change your MSS address.

98
00:05:21.040 --> 00:05:23.600
<v Speaker 1>While it's a physical address, you can actually alter this

99
00:05:23.759 --> 00:05:26.040
<v Speaker 1>on the fly using software you can.

100
00:05:26.240 --> 00:05:29.879
<v Speaker 2>It's a basic but essential technique to avoid being easily

101
00:05:29.959 --> 00:05:33.800
<v Speaker 2>traced back during your testing. Okay, so once we understand

102
00:05:33.839 --> 00:05:37.800
<v Speaker 2>basic network identities, we move into active intelligence gathering the

103
00:05:37.839 --> 00:05:41.319
<v Speaker 2>eyes of the ethical hacker, so to speak. We can

104
00:05:41.319 --> 00:05:44.319
<v Speaker 2>start with simple tools like net discover, which quickly sweep

105
00:05:44.360 --> 00:05:47.879
<v Speaker 2>a network, revealing connected devices along with their IP and

106
00:05:48.000 --> 00:05:51.160
<v Speaker 2>m MAT addresses. Pretty straightforward, but if you want to

107
00:05:51.240 --> 00:05:53.920
<v Speaker 2>really dig deep, the go to tool is n MAP.

108
00:05:54.199 --> 00:05:57.160
<v Speaker 2>Often called the Swiss Army Knife for network scanning, and

109
00:05:57.240 --> 00:05:57.959
<v Speaker 2>for good reason.

110
00:05:58.240 --> 00:05:59.680
<v Speaker 1>So once we have a list of who's on the

111
00:05:59.720 --> 00:06:02.560
<v Speaker 1>network work with their m mass addresses, how do we

112
00:06:02.600 --> 00:06:06.040
<v Speaker 1>start to understand what these devices actually are, what services

113
00:06:06.040 --> 00:06:08.480
<v Speaker 1>are running, and maybe what might be open to attack.

114
00:06:08.800 --> 00:06:12.319
<v Speaker 2>That's exactly where n MAP shines. It uses different scam profiles,

115
00:06:12.360 --> 00:06:14.720
<v Speaker 2>like a ping scan just to find active devices, or

116
00:06:14.759 --> 00:06:18.079
<v Speaker 2>maybe a quick scam plus to go much deeper. What's

117
00:06:18.079 --> 00:06:21.319
<v Speaker 2>truly powerful about NMP is its ability to uncover not

118
00:06:21.399 --> 00:06:25.399
<v Speaker 2>just active devices, but they're open ports, the specific services

119
00:06:25.439 --> 00:06:27.839
<v Speaker 2>running on those ports, like a web server or a

120
00:06:27.879 --> 00:06:31.600
<v Speaker 2>file sharing service, and even the versions of the software.

121
00:06:31.639 --> 00:06:32.680
<v Speaker 1>Ah, the versions are key.

122
00:06:32.720 --> 00:06:36.360
<v Speaker 2>You absolutely key that granular detail is crucial for finding

123
00:06:36.399 --> 00:06:40.480
<v Speaker 2>specific vulnerabilities. For example, a quick scan plus might tell

124
00:06:40.480 --> 00:06:44.720
<v Speaker 2>you a device is running Apache http Server version two

125
00:06:44.800 --> 00:06:47.319
<v Speaker 2>point two point eight on Linux, right, and that instantly

126
00:06:47.399 --> 00:06:50.199
<v Speaker 2>narrows down potential exploits you could look for and try.

127
00:06:50.319 --> 00:06:54.560
<v Speaker 1>Okay, So, once you've unmasked the network, the next significant

128
00:06:54.560 --> 00:06:56.879
<v Speaker 1>move in the playbook often involves man in the middle

129
00:06:57.319 --> 00:07:01.800
<v Speaker 1>or MITM attacks. This is all about intercepting network traffic.

130
00:07:01.839 --> 00:07:02.639
<v Speaker 2>Hey get in the middle.

131
00:07:02.720 --> 00:07:06.920
<v Speaker 1>The core concept is deceptively simple. You redirect all network

132
00:07:06.959 --> 00:07:09.639
<v Speaker 1>traffic between a client like a user's laptop and a

133
00:07:09.680 --> 00:07:12.399
<v Speaker 1>gateway like their router through your own device.

134
00:07:12.560 --> 00:07:12.800
<v Speaker 2>Right.

135
00:07:12.879 --> 00:07:15.279
<v Speaker 1>This effectively puts you right in the middle of their conversation,

136
00:07:15.399 --> 00:07:18.680
<v Speaker 1>allowing you to read, modify, or even just drop packets entirely.

137
00:07:18.399 --> 00:07:22.160
<v Speaker 2>And tools like ARPSPOOF and MITMF are used to facilitate this.

138
00:07:22.240 --> 00:07:24.519
<v Speaker 2>They perform something called ARP poisoning.

139
00:07:25.079 --> 00:07:27.000
<v Speaker 1>ARP poisoning, Okay, what's the fout?

140
00:07:27.439 --> 00:07:31.120
<v Speaker 2>To put it simply, ARP, or Address resolution protocol, is

141
00:07:31.160 --> 00:07:34.360
<v Speaker 2>like a directory service that tells devices on a local

142
00:07:34.399 --> 00:07:37.439
<v Speaker 2>network which m querre belongs to which IP address.

143
00:07:37.480 --> 00:07:37.759
<v Speaker 1>Okay.

144
00:07:38.199 --> 00:07:42.240
<v Speaker 2>ARP poisoning essentially tricks devices into thinking your computer is

145
00:07:42.279 --> 00:07:45.160
<v Speaker 2>the router, and also tricks the router into thinking your

146
00:07:45.160 --> 00:07:46.759
<v Speaker 2>computer is the target device.

147
00:07:47.000 --> 00:07:47.480
<v Speaker 1>Huh.

148
00:07:47.519 --> 00:07:50.199
<v Speaker 2>It's like putting up a false road sign that diverts

149
00:07:50.240 --> 00:07:53.199
<v Speaker 2>all traffic through your own property. You can even see

150
00:07:53.199 --> 00:07:56.199
<v Speaker 2>this visually when the MIA address entries on the target's

151
00:07:56.199 --> 00:07:57.879
<v Speaker 2>network table actually changed to yours.

152
00:07:57.879 --> 00:08:00.519
<v Speaker 1>Wow. Okay, So, with literally in the middle of the

153
00:08:00.560 --> 00:08:05.600
<v Speaker 1>network conversation, sniffing credentials become shockingly straightforward for unencrypted or

154
00:08:05.800 --> 00:08:07.199
<v Speaker 1>HTTP websites.

155
00:08:07.279 --> 00:08:08.040
<v Speaker 2>Yeah, very easy.

156
00:08:08.040 --> 00:08:11.040
<v Speaker 1>Then attackers can easily capture user names and passwords as

157
00:08:11.079 --> 00:08:14.680
<v Speaker 1>they are transmitted. But what about secure sites HTTPS?

158
00:08:14.759 --> 00:08:19.040
<v Speaker 2>That's where bypassing HTTPS becomes the challenge. Tools like SSL

159
00:08:19.120 --> 00:08:23.759
<v Speaker 2>strip attempt to downgrade these secure HTTPS connections to unencrypted

160
00:08:23.879 --> 00:08:25.720
<v Speaker 2>HTTP for interception.

161
00:08:25.319 --> 00:08:27.560
<v Speaker 1>Right force it back to HDTP exactly.

162
00:08:27.920 --> 00:08:30.959
<v Speaker 2>However, it's critical to note that modern security features like

163
00:08:31.160 --> 00:08:35.000
<v Speaker 2>HTTP Strict Transport Security or HSTS are far more robust.

164
00:08:35.840 --> 00:08:36.000
<v Speaker 1>Yeah.

165
00:08:36.120 --> 00:08:39.679
<v Speaker 2>HSTS essentially tells a browser, hey, for this website only

166
00:08:39.720 --> 00:08:44.159
<v Speaker 2>ever connect using HTTPS. Major sites like Facebook and Google

167
00:08:44.200 --> 00:08:48.519
<v Speaker 2>have HSTS pre hard coded in browsers, okay, making these

168
00:08:48.559 --> 00:08:51.799
<v Speaker 2>downgrade attacks much much more difficult for newer browsers to

169
00:08:51.840 --> 00:08:54.000
<v Speaker 2>fall for. It's a great example of how defenses are

170
00:08:54.000 --> 00:08:55.000
<v Speaker 2>constantly evolving.

171
00:08:55.200 --> 00:08:59.559
<v Speaker 1>That makes sense. So beyond passwords, there's another powerful session

172
00:08:59.720 --> 00:09:03.399
<v Speaker 1>high Why bother trying to guess or steal credentials if

173
00:09:03.399 --> 00:09:06.000
<v Speaker 1>you can just steal the key to an already.

174
00:09:05.639 --> 00:09:07.440
<v Speaker 2>Active session right steal the token.

175
00:09:07.639 --> 00:09:11.039
<v Speaker 1>Yeah. By stealing authentication cookies using tools like Ferret and Hamster,

176
00:09:11.600 --> 00:09:14.240
<v Speaker 1>an attacker can log into accounts, say on a site

177
00:09:14.279 --> 00:09:16.799
<v Speaker 1>like you to Me, without ever needing the user's password.

178
00:09:17.159 --> 00:09:21.039
<v Speaker 1>It's a very effective way to bypass traditional authentication, very effective.

179
00:09:21.080 --> 00:09:23.559
<v Speaker 2>And then there's DNS spoofing. This is where you take

180
00:09:23.559 --> 00:09:26.320
<v Speaker 2>control of how domain names resolve to IP addresses.

181
00:09:26.360 --> 00:09:29.080
<v Speaker 1>Okay, so you control where the name points exactly.

182
00:09:29.600 --> 00:09:33.759
<v Speaker 2>Imagine being able to redirect www dot Google dot com

183
00:09:33.799 --> 00:09:35.879
<v Speaker 2>to a fake website running on your own server.

184
00:09:36.120 --> 00:09:37.360
<v Speaker 1>Oh boy, you could use.

185
00:09:37.240 --> 00:09:40.559
<v Speaker 2>This to serve malicious files, push fake updates, or even

186
00:09:40.679 --> 00:09:44.080
<v Speaker 2>trick users into revealing credentials on a convincing but fake

187
00:09:44.200 --> 00:09:48.039
<v Speaker 2>login page. The possibilities for deception really are extensive.

188
00:09:47.600 --> 00:09:51.120
<v Speaker 1>And MITMF, that powerful man in the middle framework we

189
00:09:51.200 --> 00:09:54.559
<v Speaker 1>mentioned earlier, also offers some rather nasty plugins I gather

190
00:09:54.840 --> 00:09:55.399
<v Speaker 1>it does.

191
00:09:55.919 --> 00:09:59.320
<v Speaker 2>There are things like screenshot keyloggers, which capture images of

192
00:09:59.360 --> 00:10:02.279
<v Speaker 2>the target's screen every few seconds, giving you a visual

193
00:10:02.320 --> 00:10:06.200
<v Speaker 2>log of their activity. And there's a JS key lagger,

194
00:10:06.440 --> 00:10:10.080
<v Speaker 2>which injects a JavaScript keylogger to record keystrokes directly in

195
00:10:10.120 --> 00:10:13.840
<v Speaker 2>the browser. These tools give an attacker and frankly alarming

196
00:10:13.879 --> 00:10:15.799
<v Speaker 2>amount of insight into what the user is doing.

197
00:10:15.879 --> 00:10:17.759
<v Speaker 1>Yeah, that's that's quite invasive.

198
00:10:18.799 --> 00:10:21.679
<v Speaker 2>Finally, in this segment, we need to talk about wire shark.

199
00:10:21.600 --> 00:10:22.720
<v Speaker 1>Right, the packet analyzer.

200
00:10:22.879 --> 00:10:26.480
<v Speaker 2>Yes, but It's important to understand this clearly. Wireshark itself

201
00:10:26.519 --> 00:10:30.080
<v Speaker 2>is not a hacking tool. It's a powerful network protocol

202
00:10:30.159 --> 00:10:35.080
<v Speaker 2>analyzer designed for network administrators and ethical hackers to analyze

203
00:10:35.120 --> 00:10:37.799
<v Speaker 2>traffic flowing through their own network interface.

204
00:10:38.200 --> 00:10:39.759
<v Speaker 1>So it's for analysis, not attack.

205
00:10:40.000 --> 00:10:44.159
<v Speaker 2>Precisely, its true power in penetration testing really comes after

206
00:10:44.200 --> 00:10:46.080
<v Speaker 2>an MITM attack is established.

207
00:10:46.159 --> 00:10:48.879
<v Speaker 1>Ah, because then the traffic is flowing through your machine.

208
00:10:48.919 --> 00:10:52.360
<v Speaker 2>Exactly, Since all the victims traffic is now flowing through

209
00:10:52.399 --> 00:10:56.000
<v Speaker 2>your machine, wireshark can capture and analyze all of it.

210
00:10:56.000 --> 00:10:58.320
<v Speaker 2>It's like having X ray vision for network packets.

211
00:10:58.519 --> 00:11:01.159
<v Speaker 1>So if we connect this to the bigger picture, wire

212
00:11:01.200 --> 00:11:05.240
<v Speaker 1>shark allows for incredible practical use. You can filter packets,

213
00:11:05.240 --> 00:11:11.720
<v Speaker 1>say for just HTTP traffic, examine individual packet details like source, destination, protocol,

214
00:11:11.759 --> 00:11:15.120
<v Speaker 1>and content, and even identify suspicious patterns like a pre

215
00:11:15.240 --> 00:11:18.879
<v Speaker 1>packet storms or duplicate IP address warnings, which are strong

216
00:11:18.919 --> 00:11:20.919
<v Speaker 1>indicators that a hack might be in progress.

217
00:11:21.000 --> 00:11:24.600
<v Speaker 2>Absolutely, it's an invaluable diagnostic tool for both attackers trying

218
00:11:24.600 --> 00:11:27.360
<v Speaker 2>to understand the network and defenders looking for anomalies.

219
00:11:27.639 --> 00:11:31.440
<v Speaker 1>Okay, now that we've unmasked the network, let's shift gears.

220
00:11:31.440 --> 00:11:35.159
<v Speaker 1>And explore the next chapter in this playbook, gaining deeper

221
00:11:35.200 --> 00:11:39.039
<v Speaker 1>control and establishing a persistent presence. This is where things

222
00:11:39.039 --> 00:11:42.399
<v Speaker 1>get really impactful, moving beyond just observation.

223
00:11:42.759 --> 00:11:45.159
<v Speaker 2>We begin with server side attacks, which are all about

224
00:11:45.200 --> 00:11:49.360
<v Speaker 2>gaining control of computer systems by exploiting misconfigurations or built

225
00:11:49.399 --> 00:11:52.720
<v Speaker 2>in vulnerabilities and programs and services running on target machines.

226
00:11:52.879 --> 00:11:54.919
<v Speaker 1>And that could be anything right, a laptop, a.

227
00:11:54.919 --> 00:11:58.240
<v Speaker 2>Server, anything from a personal laptop to a complex web server.

228
00:11:58.639 --> 00:12:01.600
<v Speaker 2>We've seen classic examples of gaining full control over a

229
00:12:01.639 --> 00:12:08.039
<v Speaker 2>metasploitable machine through surprisingly simple misconfigurations like allowing anonymous.

230
00:12:07.480 --> 00:12:09.879
<v Speaker 1>FTP log in just leaving it open.

231
00:12:09.759 --> 00:12:12.480
<v Speaker 2>Yeah, or leaving default or log in credentials where the

232
00:12:12.559 --> 00:12:15.600
<v Speaker 2>username is root and the password is tour. It's surprisingly

233
00:12:15.639 --> 00:12:18.639
<v Speaker 2>common to find systems left with such easy entry points.

234
00:12:18.720 --> 00:12:22.039
<v Speaker 1>Wow. And when it comes to exploiting these vulnerabilities, the

235
00:12:22.080 --> 00:12:25.000
<v Speaker 1>metaplate framework is often an ethical hackers powerhouse.

236
00:12:25.039 --> 00:12:25.720
<v Speaker 2>Oh definitely.

237
00:12:25.840 --> 00:12:28.320
<v Speaker 1>This open source framework isn't just a collection of tools.

238
00:12:28.399 --> 00:12:33.440
<v Speaker 1>It represents a fundamental shift in how vulnerabilities are cataloged

239
00:12:33.480 --> 00:12:38.120
<v Speaker 1>and exploited, essentially democratizing advanced penetration testing. What does it

240
00:12:38.159 --> 00:12:38.799
<v Speaker 1>allow you to do?

241
00:12:39.000 --> 00:12:41.799
<v Speaker 2>Well. It provides a console MSFF console where you can

242
00:12:41.879 --> 00:12:45.480
<v Speaker 2>quickly select and launch exploits. You use basic commands like

243
00:12:45.759 --> 00:12:49.679
<v Speaker 2>used to select and exploit, set rhos to define your target.

244
00:12:49.559 --> 00:12:51.879
<v Speaker 1>Ra meaning remote host remote host.

245
00:12:51.679 --> 00:12:55.399
<v Speaker 2>Exactly, and then exploit or run to initiate the attack.

246
00:12:55.639 --> 00:12:58.120
<v Speaker 2>For example. The sources cover how it's used to exploit

247
00:12:58.200 --> 00:13:02.480
<v Speaker 2>vulnerabilities like a backdoor found INFTPD and FTP service okay,

248
00:13:02.879 --> 00:13:06.159
<v Speaker 2>or a remote code execution flaw in Samba like the

249
00:13:06.240 --> 00:13:10.200
<v Speaker 2>user map script vulnerability. These techniques can ultimately grant full

250
00:13:10.240 --> 00:13:12.080
<v Speaker 2>command line access to the target.

251
00:13:11.840 --> 00:13:15.919
<v Speaker 1>System, full control. Beyond manually launching exploits, there are also

252
00:13:16.000 --> 00:13:20.519
<v Speaker 1>automated vulnerability scanning tools you mentioned Metasploit Community or MSFC right.

253
00:13:21.000 --> 00:13:25.919
<v Speaker 2>MSFC provides a web based graphical interface for metasploit. It

254
00:13:26.039 --> 00:13:30.600
<v Speaker 2>streamlines the process of finding open ports, identifying services, and

255
00:13:30.720 --> 00:13:34.799
<v Speaker 2>mapping them to known exploits. You can even launch exploits

256
00:13:34.879 --> 00:13:37.159
<v Speaker 2>directly from its dashboard. Makes it a bit.

257
00:13:37.039 --> 00:13:38.559
<v Speaker 1>Easier, a bit more user friendly.

258
00:13:38.679 --> 00:13:43.080
<v Speaker 2>Yeah, and then there's Nexpose, another comprehensive vulnerability management tool

259
00:13:43.120 --> 00:13:47.440
<v Speaker 2>from Rapid seven, Metasploit's creator. Okay, what's truly compelling about

260
00:13:47.519 --> 00:13:50.679
<v Speaker 2>expos is that it's designed more from a defender's perspective.

261
00:13:51.120 --> 00:13:54.519
<v Speaker 2>It detects a much broader range of vulnerabilities, discovering hundreds

262
00:13:54.559 --> 00:13:56.639
<v Speaker 2>where MSFC might find only tens.

263
00:13:56.840 --> 00:13:58.600
<v Speaker 1>Wow, big difference. Yeah.

264
00:13:58.600 --> 00:14:03.200
<v Speaker 2>More importantly, it provides d tailed risk assessments, categorizes vulnerabilities

265
00:14:03.240 --> 00:14:06.200
<v Speaker 2>by the skill level required to exploit them, and offers

266
00:14:06.240 --> 00:14:10.399
<v Speaker 2>concrete remediation advice. It's truly a tool for organizations to

267
00:14:10.480 --> 00:14:13.960
<v Speaker 2>understand exactly what an attacker might see and crucially, how

268
00:14:14.000 --> 00:14:14.480
<v Speaker 2>to fix it.

269
00:14:14.679 --> 00:14:17.840
<v Speaker 1>So it helps you prioritize your defenses exactly. Okay, moving

270
00:14:17.879 --> 00:14:20.399
<v Speaker 1>from serv let's talk about client side attacks. This is

271
00:14:20.399 --> 00:14:22.279
<v Speaker 1>really the art of deception aim to the user.

272
00:14:22.080 --> 00:14:24.679
<v Speaker 2>Isn't it very much? So social engineering often plays a

273
00:14:24.679 --> 00:14:25.120
<v Speaker 2>big part.

274
00:14:25.519 --> 00:14:29.440
<v Speaker 1>Veil evasion is a tool used for generating undetectable back doors.

275
00:14:29.639 --> 00:14:30.399
<v Speaker 1>How does that work?

276
00:14:30.519 --> 00:14:33.960
<v Speaker 2>It works by creating payloads that's the malicious code that

277
00:14:34.120 --> 00:14:37.679
<v Speaker 2>establish reverse connections. Verse connections, Yeah, where the target computer

278
00:14:37.759 --> 00:14:40.759
<v Speaker 2>connects back to the attackers machine. This is a smart

279
00:14:40.840 --> 00:14:44.399
<v Speaker 2>technique because it often helps bypass firewalls and anti virus

280
00:14:44.440 --> 00:14:47.600
<v Speaker 2>software as the connection is outbound from the victim's perspective,

281
00:14:47.840 --> 00:14:51.799
<v Speaker 2>which often looks less suspicious. Ah clever and veil even

282
00:14:51.879 --> 00:14:55.559
<v Speaker 2>lets you tweak parameters like processors and sleep time within

283
00:14:55.600 --> 00:14:59.000
<v Speaker 2>the payload itself. These adjustments can make the back door

284
00:14:59.039 --> 00:15:03.039
<v Speaker 2>appear less suspicion to antivirus software, increasing its chances of

285
00:15:03.080 --> 00:15:04.600
<v Speaker 2>going undetected.

286
00:15:04.200 --> 00:15:06.320
<v Speaker 1>So you can tune it to be stealthier exactly.

287
00:15:06.960 --> 00:15:09.919
<v Speaker 2>You can then test these generated backdoors using tools like

288
00:15:10.120 --> 00:15:13.879
<v Speaker 2>no distribute, which checks them against common antivirus programs to

289
00:15:13.879 --> 00:15:14.879
<v Speaker 2>see if they get flagged.

290
00:15:14.960 --> 00:15:19.360
<v Speaker 1>Okay, now here's a brilliant, almost sneaky play in the

291
00:15:19.399 --> 00:15:22.320
<v Speaker 1>realm of deception. Deceptive file extensions.

292
00:15:22.360 --> 00:15:24.679
<v Speaker 2>Tell me about this, right, This is a clever social

293
00:15:24.720 --> 00:15:28.639
<v Speaker 2>engineering technique. It uses a special Unicode character called the

294
00:15:28.720 --> 00:15:30.600
<v Speaker 2>right to left override character in.

295
00:15:30.600 --> 00:15:33.039
<v Speaker 1>A file name right to leftoveride. Yeah.

296
00:15:33.440 --> 00:15:36.679
<v Speaker 2>This character can make an executable file. For example, invoice

297
00:15:36.720 --> 00:15:41.320
<v Speaker 2>dot ex appear as a harmless image like invoicer alogpj

298
00:15:41.480 --> 00:15:45.559
<v Speaker 2>dot ex might display as invoiceeq dot jpg.

299
00:15:45.840 --> 00:15:48.039
<v Speaker 1>WHOA, so it looks like a JPEG, but it's actually

300
00:15:48.080 --> 00:15:49.879
<v Speaker 1>an ex Exactly.

301
00:15:50.240 --> 00:15:53.360
<v Speaker 2>It visually hides the true nature of the file while

302
00:15:53.440 --> 00:15:56.559
<v Speaker 2>still allowing it to run when clicked. It's a subtle

303
00:15:56.600 --> 00:15:59.159
<v Speaker 2>but highly effective trick that can fool many users into

304
00:15:59.240 --> 00:16:00.480
<v Speaker 2>running something they sh shouldn't.

305
00:16:00.679 --> 00:16:04.320
<v Speaker 1>That is sneaky. Okay. So, once initial access is gained,

306
00:16:04.399 --> 00:16:07.720
<v Speaker 1>you typically landed a interpreter session, which is a powerful

307
00:16:07.759 --> 00:16:11.399
<v Speaker 1>interactive shell within metasploit. This is your initial foothold, correct,

308
00:16:11.480 --> 00:16:14.320
<v Speaker 1>How do you ensure that fur hoold isn't lost if, say,

309
00:16:14.600 --> 00:16:17.080
<v Speaker 1>the user closes the program you initially exploited.

310
00:16:17.159 --> 00:16:19.440
<v Speaker 2>That's where the migrate command comes in. You can use

311
00:16:19.480 --> 00:16:21.919
<v Speaker 2>it to move your active interpreter session from the initial

312
00:16:21.960 --> 00:16:24.799
<v Speaker 2>exploited program, which might be unstable or temporary, to a

313
00:16:24.840 --> 00:16:28.440
<v Speaker 2>more stable, always running process on the target like explore

314
00:16:28.480 --> 00:16:31.240
<v Speaker 2>dot exe, the Windows Graphical interface.

315
00:16:31.240 --> 00:16:32.759
<v Speaker 1>Jump into a core process.

316
00:16:32.919 --> 00:16:35.639
<v Speaker 2>Right. This prevents you from losing access if the original

317
00:16:35.639 --> 00:16:36.519
<v Speaker 2>program closes.

318
00:16:36.679 --> 00:16:36.879
<v Speaker 1>Right.

319
00:16:37.039 --> 00:16:40.519
<v Speaker 2>Even more robust is the persistence module first. Yeah, this

320
00:16:40.559 --> 00:16:43.679
<v Speaker 2>installs a back door that automatically reconnects to your calling

321
00:16:43.799 --> 00:16:47.360
<v Speaker 2>machine every few seconds, even if the target computer restarts.

322
00:16:48.159 --> 00:16:51.360
<v Speaker 2>This ensures continuous access. It's much harder to get rid of.

323
00:16:51.600 --> 00:16:54.480
<v Speaker 1>Okay, that's serious. So from this interpreter session you have

324
00:16:54.559 --> 00:16:56.919
<v Speaker 1>extensive control over the target's filesystem. Right.

325
00:16:57.200 --> 00:17:03.720
<v Speaker 2>Oh, yes, there are commands to navigate directories, PWDLSTS, read files, cat,

326
00:17:03.919 --> 00:17:07.440
<v Speaker 2>download sensitive data, upload your own tools, and execute programs

327
00:17:07.480 --> 00:17:12.000
<v Speaker 2>on the victim's machine. It's essentially full remote control of their.

328
00:17:11.839 --> 00:17:13.839
<v Speaker 3>System, and I assume you can also see what they're

329
00:17:13.839 --> 00:17:14.720
<v Speaker 3>doing absolutely.

330
00:17:15.079 --> 00:17:18.880
<v Speaker 2>Interpreter plugins also enable key logging and screenshots. You can

331
00:17:18.920 --> 00:17:22.240
<v Speaker 2>log every keystroke the target makes, every single one, every

332
00:17:22.240 --> 00:17:24.880
<v Speaker 2>single one, and capture screenshots of their desktop, giving you

333
00:17:24.920 --> 00:17:28.039
<v Speaker 2>a full picture of their activity and often revealing sensitive

334
00:17:28.039 --> 00:17:31.079
<v Speaker 2>information like passwords or private communications.

335
00:17:31.359 --> 00:17:33.960
<v Speaker 1>That's powerful and quite scary. So if you're on one

336
00:17:34.039 --> 00:17:38.039
<v Speaker 1>compromised machine, what's the next logical step? If you want

337
00:17:38.039 --> 00:17:40.640
<v Speaker 1>to expand your reach within a larger network, maybe get

338
00:17:40.680 --> 00:17:41.440
<v Speaker 1>to other servers.

339
00:17:41.519 --> 00:17:44.839
<v Speaker 2>That brings us to a really important technique called pivoting. Pivoting, Okay,

340
00:17:45.079 --> 00:17:48.240
<v Speaker 2>you use a compromised machine as a pivot point to

341
00:17:48.359 --> 00:17:51.640
<v Speaker 2>attack other machines on its internal network that you couldn't

342
00:17:51.640 --> 00:17:53.200
<v Speaker 2>reach directly from your own.

343
00:17:53.000 --> 00:17:56.000
<v Speaker 1>Network, So you hop from one machine to the next exactly.

344
00:17:56.039 --> 00:17:59.000
<v Speaker 2>Think of it like gaining access to one room in

345
00:17:59.039 --> 00:18:01.720
<v Speaker 2>a building and then you using that room to unlock

346
00:18:01.839 --> 00:18:04.720
<v Speaker 2>doors to other rooms you couldn't reach from the outside.

347
00:18:04.799 --> 00:18:08.400
<v Speaker 2>The material shows how this is simulated using multiple neat

348
00:18:08.400 --> 00:18:12.400
<v Speaker 2>networks in virtual box to create those isolated segments, mirroring

349
00:18:12.480 --> 00:18:14.720
<v Speaker 2>real world network segmentation.

350
00:18:14.359 --> 00:18:18.119
<v Speaker 3>Right, simulating a corporate network or something precisely Okay. On

351
00:18:18.200 --> 00:18:23.240
<v Speaker 3>the flip side, For defenders, it's about detecting trojans and

352
00:18:23.319 --> 00:18:26.480
<v Speaker 3>other malicious software. How would someone identify if they've been

353
00:18:26.519 --> 00:18:28.519
<v Speaker 3>compromised with these kinds of techniques.

354
00:18:28.720 --> 00:18:31.519
<v Speaker 2>Well, you can perform manual detection by using tools like

355
00:18:31.559 --> 00:18:35.160
<v Speaker 2>Windows Resource Monitor to look for suspicious outbound network connections

356
00:18:35.200 --> 00:18:38.039
<v Speaker 2>to unknown or unusual IP addresses.

357
00:18:37.680 --> 00:18:40.200
<v Speaker 1>Okay, looking for strange connections going out exactly.

358
00:18:40.519 --> 00:18:43.000
<v Speaker 2>You can then use a reverse DNS lookup to see

359
00:18:43.039 --> 00:18:46.319
<v Speaker 2>if a suspicious IP resolves to a legitimate website like

360
00:18:46.359 --> 00:18:50.559
<v Speaker 2>say Facebook server, or something completely unidentifiable and likely malicious.

361
00:18:50.839 --> 00:18:55.440
<v Speaker 2>For more advanced detection, there's sandbox analysis. You upload suspicious

362
00:18:55.440 --> 00:18:59.759
<v Speaker 2>files to online sandboxes like Cuckoo sandbox for automated behavioral

363
00:18:59.759 --> 00:19:02.640
<v Speaker 2>and of those do they run the file in a safe,

364
00:19:02.839 --> 00:19:05.960
<v Speaker 2>isolated environment and watch what it does. These reports can

365
00:19:06.000 --> 00:19:10.319
<v Speaker 2>show if a file suppresses aeroboxes, modifies the registry, tries

366
00:19:10.359 --> 00:19:14.480
<v Speaker 2>to create network connections, all strong indicators of malicious intent.

367
00:19:14.880 --> 00:19:17.519
<v Speaker 1>Very useful. Okay, Now let's dive into our final chapter

368
00:19:17.559 --> 00:19:22.200
<v Speaker 1>in this playbook exploiting the Web from websites to databases.

369
00:19:22.880 --> 00:19:25.480
<v Speaker 1>This is where a huge amount of modern hacking really

370
00:19:25.559 --> 00:19:28.440
<v Speaker 1>takes place, right since so much of our interaction is online.

371
00:19:28.519 --> 00:19:33.200
<v Speaker 2>Absolutely. A crucial distinction here is understanding web application architecture,

372
00:19:33.319 --> 00:19:37.799
<v Speaker 2>particularly client side versus server side languages. Client side languages

373
00:19:37.880 --> 00:19:41.200
<v Speaker 2>like JavaScript execute in your web browser. Server side languages

374
00:19:41.279 --> 00:19:44.519
<v Speaker 2>like PHP, your Python execute on the web server itself.

375
00:19:44.640 --> 00:19:45.839
<v Speaker 1>Good. That distance is key.

376
00:19:46.079 --> 00:19:49.200
<v Speaker 2>It's fundamental because it determines where your attacks will land

377
00:19:49.240 --> 00:19:52.200
<v Speaker 2>and what kind of impact they'll have. If you inject JavaScript,

378
00:19:52.279 --> 00:19:55.200
<v Speaker 2>it affects the user's browser. If you inject Php, it

379
00:19:55.200 --> 00:19:56.640
<v Speaker 2>can affect the server itself.

380
00:19:56.839 --> 00:20:01.240
<v Speaker 1>Makes sense. Then comes web information gathering or digital footprinting.

381
00:20:01.559 --> 00:20:02.559
<v Speaker 1>You start with a who is.

382
00:20:02.559 --> 00:20:06.319
<v Speaker 2>Look up YEP, basic stuff. Discover details about a domains, owner,

383
00:20:06.440 --> 00:20:10.880
<v Speaker 2>creation date, and associated IP addresses and name servers. It's

384
00:20:10.920 --> 00:20:13.359
<v Speaker 2>like looking up public records for a website.

385
00:20:12.920 --> 00:20:14.799
<v Speaker 1>And netcraft that sounds interesting.

386
00:20:15.000 --> 00:20:19.039
<v Speaker 2>Netcraft is an invaluable resource for uncovering the specific technologies

387
00:20:19.079 --> 00:20:22.359
<v Speaker 2>a website uses. Everything from the web server like apatchee

388
00:20:22.359 --> 00:20:26.119
<v Speaker 2>and the operating system like Linux okay, to the programming

389
00:20:26.200 --> 00:20:30.720
<v Speaker 2>languages like Php or JavaScript and even specific web applications

390
00:20:30.839 --> 00:20:36.839
<v Speaker 2>like WordPress. This information is pure gold for identifying known vulnerabilities.

391
00:20:36.000 --> 00:20:38.160
<v Speaker 1>Because if you know a site uses an old version

392
00:20:38.200 --> 00:20:39.480
<v Speaker 1>of WordPress.

393
00:20:38.960 --> 00:20:41.079
<v Speaker 2>You can look up known exploits for that version.

394
00:20:41.000 --> 00:20:46.480
<v Speaker 1>Exactly got it. Tools like robtechs provide comprehensive DNS information,

395
00:20:47.000 --> 00:20:50.400
<v Speaker 1>helping to identify other websites hosted on the same physical server.

396
00:20:50.880 --> 00:20:51.839
<v Speaker 1>Why is that useful?

397
00:20:52.200 --> 00:20:54.599
<v Speaker 2>Well, if one site on a shared server is vulnerable,

398
00:20:54.640 --> 00:20:56.960
<v Speaker 2>there's a good chance others might be too, offering a

399
00:20:57.000 --> 00:21:01.279
<v Speaker 2>broader attack surface. For the ethical hacker, one weekly can expose.

400
00:21:00.920 --> 00:21:03.000
<v Speaker 1>Others right shared hosting risks.

401
00:21:03.279 --> 00:21:06.160
<v Speaker 2>We also look at discovering subdomains using tools like knock

402
00:21:06.200 --> 00:21:10.960
<v Speaker 2>dot poy. Many large websites have unadvertised subdomains like beta dot,

403
00:21:11.000 --> 00:21:14.759
<v Speaker 2>Facebook dot com, or dev dot whatever dot com. These

404
00:21:14.839 --> 00:21:18.960
<v Speaker 2>often run older, less secure, or experimental code, making them

405
00:21:19.039 --> 00:21:22.160
<v Speaker 2>prime targets for discovering vulnerabilities that aren't present on the

406
00:21:22.200 --> 00:21:26.119
<v Speaker 2>main hardened site. H less tested potentially good place.

407
00:21:25.920 --> 00:21:29.200
<v Speaker 1>To poke around and for finding even more hidden gems

408
00:21:29.200 --> 00:21:31.400
<v Speaker 1>on a web server. There's derb. What does that do?

409
00:21:31.720 --> 00:21:34.400
<v Speaker 2>Derb is a tool that brute forces common directory and

410
00:21:34.480 --> 00:21:37.799
<v Speaker 2>file names. It just tries thousands of combinations based on

411
00:21:37.839 --> 00:21:38.720
<v Speaker 2>word lists.

412
00:21:38.480 --> 00:21:40.119
<v Speaker 1>Like admin can fig.

413
00:21:40.359 --> 00:21:44.839
<v Speaker 2>Back up exactly, potentially uncovering sensitive files, configuration data, or

414
00:21:44.880 --> 00:21:48.440
<v Speaker 2>login pages that aren't publicly linked. The source material even

415
00:21:48.480 --> 00:21:51.400
<v Speaker 2>shows how it found files with actual usernames and passwords

416
00:21:51.839 --> 00:21:53.440
<v Speaker 2>just by guessing common locations.

417
00:21:53.480 --> 00:21:55.640
<v Speaker 1>Wow, just left lying around sometimes?

418
00:21:55.720 --> 00:21:55.920
<v Speaker 2>Yes?

419
00:21:56.000 --> 00:21:57.799
<v Speaker 1>Okay, So, once you find a way to upload files

420
00:21:57.799 --> 00:22:01.720
<v Speaker 1>to a vulnerable server, webshells because incredibly powerful. You mentioned

421
00:22:01.720 --> 00:22:02.759
<v Speaker 1>weavely right.

422
00:22:03.319 --> 00:22:05.880
<v Speaker 2>Weavely is a tool used to generate and connect to

423
00:22:05.920 --> 00:22:10.319
<v Speaker 2>a PHP webshell. Once you manage to upload this small

424
00:22:10.359 --> 00:22:14.200
<v Speaker 2>PHP file onto a vulnerable server, this shell gives you

425
00:22:14.240 --> 00:22:18.000
<v Speaker 2>a command line interface directly on the web server itself, so.

426
00:22:17.920 --> 00:22:19.480
<v Speaker 1>You can run commands on the server.

427
00:22:19.480 --> 00:22:24.720
<v Speaker 2>Exactly, execute operating system commands, list files, explore the entire

428
00:22:24.799 --> 00:22:27.279
<v Speaker 2>system as if you were sitting right at the server's console,

429
00:22:27.559 --> 00:22:29.960
<v Speaker 2>all through your web browser connecting to that shell.

430
00:22:30.039 --> 00:22:34.920
<v Speaker 1>Okay, that's serious access. A very common and dangerous vulnerability

431
00:22:35.000 --> 00:22:39.519
<v Speaker 1>is code execution vulnerabilities via a web input. Explain that one, right.

432
00:22:39.599 --> 00:22:42.319
<v Speaker 2>This is where simple web input fields like maybe a

433
00:22:42.359 --> 00:22:46.279
<v Speaker 2>page has a paying an IP address utility for diagnostics.

434
00:22:46.359 --> 00:22:47.000
<v Speaker 1>Yeah, I've seen those.

435
00:22:47.039 --> 00:22:49.480
<v Speaker 2>They can be manipulated by adding a semi call in

436
00:22:49.519 --> 00:22:52.519
<v Speaker 2>followed by an operating system command for example ten point

437
00:22:52.640 --> 00:22:55.319
<v Speaker 2>zero point two point one five. You can trick the

438
00:22:55.319 --> 00:22:59.359
<v Speaker 2>server into executing arbitrary commands like ULLs to list files

439
00:22:59.519 --> 00:23:01.920
<v Speaker 2>and display the results back to you because.

440
00:23:01.640 --> 00:23:04.319
<v Speaker 1>The input isn't properly filtered or sanitized exactly.

441
00:23:04.319 --> 00:23:05.440
<v Speaker 2>It's a classic mistake.

442
00:23:05.599 --> 00:23:08.200
<v Speaker 1>Building on that, you can even achieve a reverse shell via.

443
00:23:08.119 --> 00:23:12.400
<v Speaker 2>Web you can using the same command injection technique, you

444
00:23:12.440 --> 00:23:14.519
<v Speaker 2>can instruct the web server to connect back to your

445
00:23:14.559 --> 00:23:18.359
<v Speaker 2>callie machine using tools like netcat, effectively giving you a

446
00:23:18.400 --> 00:23:22.200
<v Speaker 2>remote shell. An interactive command prompt to the compromised server.

447
00:23:22.160 --> 00:23:24.319
<v Speaker 1>Wow persistent access again.

448
00:23:25.480 --> 00:23:28.279
<v Speaker 2>Then there are file inclusion vulnerabilities, which come in two

449
00:23:28.400 --> 00:23:32.720
<v Speaker 2>main types, local file inclusion LFI and remote file inclusion

450
00:23:32.920 --> 00:23:33.319
<v Speaker 2>r FI.

451
00:23:33.519 --> 00:23:33.759
<v Speaker 1>Okay.

452
00:23:34.319 --> 00:23:39.039
<v Speaker 2>First, LFI exploits web applications that dynamically include files based

453
00:23:39.039 --> 00:23:42.759
<v Speaker 2>on user input. Imagine a URL like example dot com,

454
00:23:42.759 --> 00:23:46.799
<v Speaker 2>index dot php, dot page, contact dot php. If it's vulnerable,

455
00:23:46.839 --> 00:23:50.519
<v Speaker 2>an attacker might change it to page dot et SEDB passwd.

456
00:23:50.160 --> 00:23:52.319
<v Speaker 1>UH traversing directories.

457
00:23:51.759 --> 00:23:54.440
<v Speaker 2>Exactly to read sensitive local files on the server that

458
00:23:54.440 --> 00:23:57.440
<v Speaker 2>they shouldn't have access to, like the system's password file.

459
00:23:57.359 --> 00:23:59.640
<v Speaker 1>And RFI Remote file inclusion.

460
00:23:59.759 --> 00:24:01.839
<v Speaker 2>Rf FFI is generally more severe. This is where the

461
00:24:01.839 --> 00:24:04.519
<v Speaker 2>web server can be tricked into including and executing a

462
00:24:04.559 --> 00:24:07.599
<v Speaker 2>remote file like a malicious PHP webshell hosted on your

463
00:24:07.599 --> 00:24:08.400
<v Speaker 2>Collie machine.

464
00:24:08.440 --> 00:24:10.519
<v Speaker 1>So you tell the server, go fetch this code from

465
00:24:10.519 --> 00:24:11.440
<v Speaker 1>my machine and run it.

466
00:24:11.519 --> 00:24:14.799
<v Speaker 2>Basically, yes, this can grant full control over the server

467
00:24:15.000 --> 00:24:19.720
<v Speaker 2>very quickly. For prevention, it's critical to emphasize strict input validation,

468
00:24:20.160 --> 00:24:23.960
<v Speaker 2>using things like regular expressions to sanitize user input and

469
00:24:24.319 --> 00:24:29.279
<v Speaker 2>crucially avoiding dangerous dynamic inclusion functions in your code. It's

470
00:24:29.359 --> 00:24:33.079
<v Speaker 2>a classic coding mistake that leads to severe vulnerabilities.

471
00:24:33.200 --> 00:24:34.359
<v Speaker 1>Don't trust user input.

472
00:24:34.400 --> 00:24:36.240
<v Speaker 2>Basically, never trust user input.

473
00:24:36.319 --> 00:24:39.839
<v Speaker 1>Okay. Now, perhaps the most infamous and widespread web vulnerability

474
00:24:40.720 --> 00:24:45.400
<v Speaker 1>sqel injection or SQL. What's truly critical to understand here.

475
00:24:45.599 --> 00:24:48.559
<v Speaker 2>SQL is one of the most common and frankly dangerous

476
00:24:48.599 --> 00:24:51.839
<v Speaker 2>web vulnerabilities precisely because it attacks the very heart of

477
00:24:51.880 --> 00:24:54.599
<v Speaker 2>most web applications, the database.

478
00:24:54.240 --> 00:24:55.960
<v Speaker 1>Where all the data lives exactly.

479
00:24:56.200 --> 00:24:58.720
<v Speaker 2>Think of it like a master key that, if mishandled,

480
00:24:58.759 --> 00:25:01.480
<v Speaker 2>can unlock every private room in a hotel, from customer

481
00:25:01.559 --> 00:25:04.640
<v Speaker 2>list to financial records. It's not just about stealing data.

482
00:25:04.680 --> 00:25:07.359
<v Speaker 2>It's about a fundamental breakdown and how the application talks

483
00:25:07.400 --> 00:25:10.680
<v Speaker 2>to its database. It often contains everything from user accounts

484
00:25:10.680 --> 00:25:13.759
<v Speaker 2>and passwords to sensitive data like credit card numbers.

485
00:25:13.960 --> 00:25:16.000
<v Speaker 1>Okay, so how do you find in SQL vulnerability?

486
00:25:16.119 --> 00:25:19.680
<v Speaker 2>You can discover seqally with simple tricks like injecting a

487
00:25:19.720 --> 00:25:23.160
<v Speaker 2>single quote into an input field, maybe a search box

488
00:25:23.240 --> 00:25:26.839
<v Speaker 2>or log in form. If you get a weird database error.

489
00:25:26.599 --> 00:25:27.559
<v Speaker 1>Back, that's a clue.

490
00:25:27.599 --> 00:25:30.799
<v Speaker 2>That's a big clue. Or by using boolean conditions like

491
00:25:31.119 --> 00:25:33.519
<v Speaker 2>orr one to one which is always true and n

492
00:25:33.599 --> 00:25:36.880
<v Speaker 2>one one always falls in the input and observing subtle

493
00:25:36.920 --> 00:25:39.960
<v Speaker 2>changes in page behavior indicating that your input is being

494
00:25:40.000 --> 00:25:41.599
<v Speaker 2>processed by the database.

495
00:25:41.720 --> 00:25:42.039
<v Speaker 1>Okay.

496
00:25:42.359 --> 00:25:45.279
<v Speaker 2>You can also use the order by clause trying different

497
00:25:45.359 --> 00:25:48.559
<v Speaker 2>numbers like order by one, order by two to figure

498
00:25:48.559 --> 00:25:51.680
<v Speaker 2>out the number of columns being returned by the original query.

499
00:25:51.480 --> 00:25:55.680
<v Speaker 1>A reconnaissance within the query itself. Once discovered, the next

500
00:25:55.720 --> 00:26:00.359
<v Speaker 1>step is extracting data. The union select technique sounds important.

501
00:26:00.240 --> 00:26:03.279
<v Speaker 2>It's incredibly powerful. It allows you to combine the legitimate

502
00:26:03.359 --> 00:26:06.720
<v Speaker 2>database query with your own malicious select statement. This lets

503
00:26:06.720 --> 00:26:09.960
<v Speaker 2>you extract information like the database name using database the

504
00:26:10.000 --> 00:26:13.559
<v Speaker 2>current database user with user and even the database software

505
00:26:13.599 --> 00:26:14.880
<v Speaker 2>version using version.

506
00:26:14.720 --> 00:26:17.640
<v Speaker 1>So you're piggybacking on the original query exactly.

507
00:26:18.079 --> 00:26:20.839
<v Speaker 2>You can then discover the actual tables and columns by

508
00:26:20.920 --> 00:26:25.359
<v Speaker 2>querying the databases built in Schema information usually in tables

509
00:26:25.359 --> 00:26:29.440
<v Speaker 2>called information Schema Dot tables and Information Schema Dot columns, so.

510
00:26:29.400 --> 00:26:31.319
<v Speaker 1>You can map out the whole database structure.

511
00:26:31.480 --> 00:26:35.799
<v Speaker 2>You can, and then comes the aha moment. Yeah, reading

512
00:26:35.880 --> 00:26:39.400
<v Speaker 2>actual user credentials directly from tables, for instance, user names

513
00:26:39.440 --> 00:26:42.359
<v Speaker 2>and passwords from an accounts table just by.

514
00:26:42.200 --> 00:26:44.640
<v Speaker 1>Selecting them game over potentially.

515
00:26:44.319 --> 00:26:48.000
<v Speaker 2>Often Yes, some advanced sekla of vulnerabilities can even be

516
00:26:48.039 --> 00:26:51.599
<v Speaker 2>exploited to read files from the service filesystem using load.

517
00:26:51.359 --> 00:26:53.759
<v Speaker 1>File, read files from the database yeah, or.

518
00:26:53.839 --> 00:26:56.799
<v Speaker 2>Write files to the service filesystem using into out file,

519
00:26:56.880 --> 00:27:00.480
<v Speaker 2>potentially allowing for webshell uploads directly via CQL injection.

520
00:27:00.680 --> 00:27:04.359
<v Speaker 1>Wow. Okay, So for prevention, what is the most critical

521
00:27:04.440 --> 00:27:05.720
<v Speaker 1>defense against SQL?

522
00:27:05.880 --> 00:27:09.839
<v Speaker 2>Unequivocally using parameterized statements also known.

523
00:27:09.720 --> 00:27:11.519
<v Speaker 1>As prepared statement parameterized statement.

524
00:27:11.759 --> 00:27:16.319
<v Speaker 2>Yes, This technique fundamentally separates the SQL code from the

525
00:27:16.400 --> 00:27:19.839
<v Speaker 2>user input data. The database knows what is code and

526
00:27:19.880 --> 00:27:24.720
<v Speaker 2>what is data, making injection literally impossible. It's a paradigm

527
00:27:24.759 --> 00:27:29.160
<v Speaker 2>shift in secure coding, far superior to older vulnerable methods

528
00:27:29.200 --> 00:27:33.000
<v Speaker 2>like trying to filter or blacklist bad characters, which attackers

529
00:27:33.000 --> 00:27:34.039
<v Speaker 2>can often bypass.

530
00:27:34.359 --> 00:27:36.759
<v Speaker 1>That sounds like the way to go. It absolutely is okay.

531
00:27:36.759 --> 00:27:39.319
<v Speaker 1>Our final web vulnerability in this playbook is cross site

532
00:27:39.359 --> 00:27:42.680
<v Speaker 1>scripting or XSS. What's the key difference here?

533
00:27:42.799 --> 00:27:45.440
<v Speaker 2>The key difference is that, unlike other web attacks that

534
00:27:45.480 --> 00:27:49.880
<v Speaker 2>target the server, EXSS injects client side scripts, usually JavaScript,

535
00:27:50.039 --> 00:27:52.640
<v Speaker 2>that execute directly in the victim's web browser when they

536
00:27:52.680 --> 00:27:54.039
<v Speaker 2>visit a vulnerable.

537
00:27:53.519 --> 00:27:56.599
<v Speaker 1>Page, so it attacks the user, not the server direct list.

538
00:27:56.799 --> 00:27:59.480
<v Speaker 1>There are two main types, reflected EXSS.

539
00:27:58.920 --> 00:28:02.480
<v Speaker 2>Reflected EXSS, where the injected script isn't stored on the server,

540
00:28:02.640 --> 00:28:05.480
<v Speaker 2>it's reflected back from the server in the response to

541
00:28:05.519 --> 00:28:09.000
<v Speaker 2>a crafted URL. For example, you trick someone into clicking

542
00:28:09.000 --> 00:28:11.319
<v Speaker 2>a link like example dot com for it slash dot

543
00:28:11.400 --> 00:28:15.240
<v Speaker 2>qu script talerxsssscript. That script runs in their browser.

544
00:28:15.559 --> 00:28:18.279
<v Speaker 1>Okay, So it's temporary, relies on the user clicking the

545
00:28:18.359 --> 00:28:19.039
<v Speaker 1>link right.

546
00:28:19.599 --> 00:28:23.680
<v Speaker 2>The more dangers type is persistent or stored XSS.

547
00:28:23.720 --> 00:28:24.279
<v Speaker 1>Persistent.

548
00:28:24.559 --> 00:28:27.279
<v Speaker 2>Here the malicious script is permanently stored on the web server,

549
00:28:27.400 --> 00:28:30.279
<v Speaker 2>perhaps in a guestbook comment, a forum post, or even

550
00:28:30.319 --> 00:28:34.079
<v Speaker 2>someone's profile bio. When any user visits that page, the

551
00:28:34.119 --> 00:28:37.680
<v Speaker 2>malicious script is automatically served by the website and executed

552
00:28:37.720 --> 00:28:41.000
<v Speaker 2>in their browser, no special link clicking required.

553
00:28:41.119 --> 00:28:42.920
<v Speaker 1>That sounds much worse it is.

554
00:28:43.480 --> 00:28:45.839
<v Speaker 2>And here's a clever trick to bypass input limits in

555
00:28:45.839 --> 00:28:49.559
<v Speaker 2>web forms. Maybe a comment box only allows one hundred characters.

556
00:28:50.160 --> 00:28:53.279
<v Speaker 2>You can often inspect the HTML element in your browser's

557
00:28:53.279 --> 00:28:56.599
<v Speaker 2>developer tools and just modify the max length attribute, changing

558
00:28:56.640 --> 00:28:59.640
<v Speaker 2>it from one hundred to say, one thousand. This lets

559
00:28:59.640 --> 00:29:02.359
<v Speaker 2>you in jet much longer EXSS payloads than the web

560
00:29:02.400 --> 00:29:04.279
<v Speaker 2>form originally intended to allow.

561
00:29:04.519 --> 00:29:07.839
<v Speaker 1>Huh huh, circumventing the client side check exactly now. What's

562
00:29:07.880 --> 00:29:10.759
<v Speaker 1>truly powerful here, according to the material, is the potent

563
00:29:10.799 --> 00:29:15.720
<v Speaker 1>combination of XSS with BEEF, the browser exploitation framework. Ah yes, BEEF.

564
00:29:15.759 --> 00:29:18.480
<v Speaker 1>By injecting a BEEF hook url just a small bit

565
00:29:18.519 --> 00:29:23.519
<v Speaker 1>of JavaScript into a persistent EXSS vulnerability, every single person

566
00:29:23.519 --> 00:29:27.519
<v Speaker 1>who visits that compromised web page automatically gets hooked to

567
00:29:27.599 --> 00:29:29.720
<v Speaker 1>your BEEF framework. What does that mean?

568
00:29:29.880 --> 00:29:32.640
<v Speaker 2>It means you get an astonishing level of control over

569
00:29:32.680 --> 00:29:35.559
<v Speaker 2>their browser. BEEF provides a control panel where you can

570
00:29:35.599 --> 00:29:38.279
<v Speaker 2>see all the hooked browsers. From there, you can run

571
00:29:38.359 --> 00:29:41.519
<v Speaker 2>various commands against them, like what like redirecting them to

572
00:29:41.599 --> 00:29:46.200
<v Speaker 2>malicious sites, presenting fake login pages that steal credentials, probing

573
00:29:46.240 --> 00:29:50.240
<v Speaker 2>their internal network, or even triggering backdoor downloads directly to

574
00:29:50.279 --> 00:29:54.440
<v Speaker 2>their machine. It's incredibly powerful for controlling user sessions and

575
00:29:54.519 --> 00:29:55.599
<v Speaker 2>launching further attack.

576
00:29:55.720 --> 00:29:58.240
<v Speaker 1>Wow, that escalates quickly, very quickly.

577
00:29:58.440 --> 00:30:02.319
<v Speaker 2>And finally, for web defenders, there's os zabaf What's that?

578
00:30:02.559 --> 00:30:06.720
<v Speaker 1>Osbzape is a fantastic free, open source tool. It acts

579
00:30:06.759 --> 00:30:09.160
<v Speaker 1>as a local proxy, sitting between your browser and the

580
00:30:09.160 --> 00:30:12.400
<v Speaker 1>web application you're testing. Okay, As you browse the site,

581
00:30:12.640 --> 00:30:16.920
<v Speaker 1>zap actively scans the web application for common vulnerabilities like XSS,

582
00:30:16.920 --> 00:30:20.720
<v Speaker 1>SQL injection, path traversal, and many others. It then categorizes

583
00:30:20.759 --> 00:30:23.720
<v Speaker 1>them by severity to help developers and security teams find

584
00:30:23.759 --> 00:30:27.720
<v Speaker 1>and prioritize fixes. It's a great automated scanner. Excellent tool

585
00:30:27.799 --> 00:30:30.400
<v Speaker 1>for the good guys. Wow, we've journeyed through quite a

586
00:30:30.400 --> 00:30:32.279
<v Speaker 1>bit of the ethical hackers playbook today.

587
00:30:32.319 --> 00:30:33.119
<v Speaker 2>We certainly have.

588
00:30:33.319 --> 00:30:36.240
<v Speaker 1>From setting up a secure virtual lab and understanding network

589
00:30:36.279 --> 00:30:40.599
<v Speaker 1>identities to sophisticated man in the middle attacks, gaining control

590
00:30:40.599 --> 00:30:45.799
<v Speaker 1>over computer systems, establishing persistent presence techniques, and finally diving

591
00:30:45.880 --> 00:30:50.519
<v Speaker 1>deep into web vulnerabilities like code execution, SQL injection, and

592
00:30:50.599 --> 00:30:51.680
<v Speaker 1>cross sites scripting.

593
00:30:52.039 --> 00:30:54.559
<v Speaker 2>It's a lot to cover, and understanding these tools and

594
00:30:54.599 --> 00:30:58.200
<v Speaker 2>methods isn't really about becoming a genius hacker overnight. It's

595
00:30:58.200 --> 00:31:03.519
<v Speaker 2>truly about gaining critic awareness right. This knowledge empowers you,

596
00:31:03.759 --> 00:31:07.240
<v Speaker 2>the listener, to understand the threats that exist, recognize the

597
00:31:07.279 --> 00:31:10.519
<v Speaker 2>vulnerabilities in the digital world around you, and ultimately be

598
00:31:10.559 --> 00:31:13.440
<v Speaker 2>better equipped to protect yourself and your systems from those

599
00:31:13.480 --> 00:31:14.519
<v Speaker 2>who would exploit them.

600
00:31:15.079 --> 00:31:17.359
<v Speaker 1>So what does this all mean for us? With almost

601
00:31:17.359 --> 00:31:20.240
<v Speaker 1>every device now being a computer, I mean from our

602
00:31:20.279 --> 00:31:23.480
<v Speaker 1>phones and TVs to our cars and smart home appliances,

603
00:31:23.880 --> 00:31:26.759
<v Speaker 1>and with more and more of our data constantly flowing online,

604
00:31:26.920 --> 00:31:29.279
<v Speaker 1>the attack surface is just constantly expanding.

605
00:31:29.599 --> 00:31:31.160
<v Speaker 2>It really is. Everything's connected.

606
00:31:31.440 --> 00:31:35.200
<v Speaker 1>How does this ever increasing interconnectedness change the very nature

607
00:31:35.240 --> 00:31:38.160
<v Speaker 1>of security? And what new plays might we see added

608
00:31:38.160 --> 00:31:41.200
<v Speaker 1>to this playbook in the future as even more unexpected

609
00:31:41.200 --> 00:31:44.960
<v Speaker 1>devices become potential targets. The deep dive never truly ends