WEBVTT

1
00:00:00.080 --> 00:00:02.839
<v Speaker 1>Welcome to the Deep Dive. We're the show where we

2
00:00:02.879 --> 00:00:06.440
<v Speaker 1>take a whole stack of sources, you know, articles, books, research,

3
00:00:06.480 --> 00:00:08.400
<v Speaker 1>our own notes, and we really try to pull out

4
00:00:08.439 --> 00:00:10.720
<v Speaker 1>those key bits of knowledge, those insights.

5
00:00:10.839 --> 00:00:14.080
<v Speaker 2>That's right, And today we're diving into a world that

6
00:00:14.160 --> 00:00:17.160
<v Speaker 2>I think fascinates a lot of people how things work,

7
00:00:17.280 --> 00:00:18.920
<v Speaker 2>especially digital things.

8
00:00:19.719 --> 00:00:23.120
<v Speaker 1>And it's a space where curiosity well can sometimes rope

9
00:00:23.160 --> 00:00:24.600
<v Speaker 1>right up against security boundaries.

10
00:00:24.719 --> 00:00:27.679
<v Speaker 2>Yeah, that line is thin, isn't it. The interplay between

11
00:00:27.760 --> 00:00:31.399
<v Speaker 2>wanting to know and the risks involved. That's really our

12
00:00:31.440 --> 00:00:33.359
<v Speaker 2>focus today. We're exploring the world.

13
00:00:33.200 --> 00:00:36.320
<v Speaker 1>Of hacking, but specifically ethical hacking right its role which

14
00:00:36.399 --> 00:00:40.240
<v Speaker 1>maybe isn't always understood in finding vulnerabilities and actually making

15
00:00:40.320 --> 00:00:42.000
<v Speaker 1>our digital world safer.

16
00:00:41.880 --> 00:00:45.880
<v Speaker 2>Exactly making it stronger. So for this deep dive, our

17
00:00:45.960 --> 00:00:49.600
<v Speaker 2>main guide is a book called Hacking the Unlocking of Transparency.

18
00:00:49.679 --> 00:00:52.520
<v Speaker 2>Security is a myth, it's a title, it is. It's

19
00:00:52.520 --> 00:00:55.600
<v Speaker 2>by our Shutosh pertop Singh, who's also known as Joker

20
00:00:55.640 --> 00:00:56.600
<v Speaker 2>of Technical Sepien.

21
00:00:56.920 --> 00:01:00.439
<v Speaker 1>Okay, so our mission here is to really unpack the

22
00:01:00.560 --> 00:01:03.240
<v Speaker 1>key insights from his work, give you a kind of

23
00:01:03.280 --> 00:01:07.400
<v Speaker 1>shortcut to getting up to speed on ethical hacking. We're

24
00:01:07.400 --> 00:01:10.799
<v Speaker 1>hoping for some surprising facts, maybe some explanations that really

25
00:01:10.840 --> 00:01:12.359
<v Speaker 1>click absolutely.

26
00:01:11.959 --> 00:01:13.519
<v Speaker 2>And to really get it, you kind of have to

27
00:01:13.599 --> 00:01:17.840
<v Speaker 2>start with the author himself, a shutash pratopsing his journey

28
00:01:17.840 --> 00:01:19.959
<v Speaker 2>into this whole thing. It started with, believe it or not,

29
00:01:20.120 --> 00:01:22.879
<v Speaker 2>a YouTube video, oh yeah, yeah, one that claimed to

30
00:01:22.920 --> 00:01:25.359
<v Speaker 2>show how you could remotely shut down someone else's computer.

31
00:01:25.840 --> 00:01:28.680
<v Speaker 2>Turned out the video was fake, okay, but the curiosity

32
00:01:28.719 --> 00:01:30.840
<v Speaker 2>it ignited in him that was one hundred percent real.

33
00:01:31.159 --> 00:01:34.959
<v Speaker 1>That's fascinating. So from that that kind of false start.

34
00:01:35.000 --> 00:01:37.959
<v Speaker 2>He just dove in totally headfirst into hacking during a

35
00:01:37.959 --> 00:01:40.480
<v Speaker 2>summer break, and the book is pretty open about it.

36
00:01:40.519 --> 00:01:44.079
<v Speaker 2>He initially went down the black hat path.

37
00:01:43.920 --> 00:01:47.200
<v Speaker 1>Right the illegal side, things like cracking software.

38
00:01:46.879 --> 00:01:49.879
<v Speaker 2>Card carding, spamming, that kind of thing, but he says

39
00:01:49.879 --> 00:01:54.200
<v Speaker 2>he pretty quickly realized, you know, how risky that was unsustainable,

40
00:01:54.319 --> 00:01:57.079
<v Speaker 2>and it really opened his eyes to just how bad

41
00:01:57.120 --> 00:01:58.920
<v Speaker 2>cybersecurity often is out there.

42
00:01:59.159 --> 00:02:01.640
<v Speaker 1>So that was the turning point, seeing the risks and

43
00:02:01.680 --> 00:02:03.959
<v Speaker 1>the well the need for better security.

44
00:02:04.120 --> 00:02:08.719
<v Speaker 2>It seems so that realization was pivotal. By late twenty seventeen,

45
00:02:08.840 --> 00:02:11.599
<v Speaker 2>he made a conscious shift. He decided to focus on

46
00:02:11.639 --> 00:02:14.759
<v Speaker 2>ethical hacking wanting to use those skills. He was developing

47
00:02:14.800 --> 00:02:17.280
<v Speaker 2>for something constructive, something useful.

48
00:02:17.000 --> 00:02:19.199
<v Speaker 1>And that led to technical sapien, that's right.

49
00:02:19.759 --> 00:02:23.560
<v Speaker 2>In January twenty eighteen, he started an Instagram page. The

50
00:02:23.639 --> 00:02:26.919
<v Speaker 2>initial goal was simple, find other people who were interested

51
00:02:26.919 --> 00:02:28.000
<v Speaker 2>in the same things.

52
00:02:27.800 --> 00:02:29.560
<v Speaker 1>A community, building, exercise base.

53
00:02:29.520 --> 00:02:32.800
<v Speaker 2>Exactly, And like any big project, it wasn't smooth sailing

54
00:02:32.840 --> 00:02:35.159
<v Speaker 2>at first. He tried what zapp groups had about five

55
00:02:35.199 --> 00:02:38.879
<v Speaker 2>active ones. Oh wow, yeah, but apparently getting smart people

56
00:02:38.879 --> 00:02:42.840
<v Speaker 2>to cooperate smoothly in that format it was tough. Then

57
00:02:42.879 --> 00:02:45.879
<v Speaker 2>he moved to Telegram, built up this huge community over

58
00:02:45.960 --> 00:02:50.479
<v Speaker 2>eleven thousand members, but faced issues there too, scams, people

59
00:02:50.479 --> 00:02:53.520
<v Speaker 2>you couldn't trust. So ultimately he decided, okay, let's just

60
00:02:53.560 --> 00:02:57.439
<v Speaker 2>focus everything on Instagram, build a more dedicated, reliable community.

61
00:02:57.000 --> 00:02:58.800
<v Speaker 1>There, and that focused approach worked.

62
00:02:59.080 --> 00:03:02.599
<v Speaker 2>It seems to have thought the Instagram community now they

63
00:03:02.599 --> 00:03:05.759
<v Speaker 2>share info daily, help each other with technical problems, even

64
00:03:05.800 --> 00:03:10.800
<v Speaker 2>self development stuff. They make informative posts, stories, guide people

65
00:03:10.840 --> 00:03:11.560
<v Speaker 2>on careers.

66
00:03:11.759 --> 00:03:15.400
<v Speaker 1>Sounds pretty comprehensive. And they actively ask for feedback too, you.

67
00:03:15.360 --> 00:03:20.840
<v Speaker 2>Said, very interactive. They've even run five ethical hacking classes,

68
00:03:21.240 --> 00:03:24.560
<v Speaker 2>trained over five hundred people. Wow, And apparently the demand

69
00:03:24.599 --> 00:03:27.240
<v Speaker 2>for those classes was huge, way more than they had

70
00:03:27.240 --> 00:03:28.840
<v Speaker 2>seats for it. That was actually a big reason he

71
00:03:28.840 --> 00:03:30.439
<v Speaker 2>wrote the book. To get this knowledge out.

72
00:03:30.280 --> 00:03:33.960
<v Speaker 1>To more people makes sense. And the name technical Sapien

73
00:03:34.719 --> 00:03:35.960
<v Speaker 1>it's not just random, is it.

74
00:03:36.120 --> 00:03:38.080
<v Speaker 2>No, there's a philosophy behind it. It plays on a

75
00:03:38.120 --> 00:03:41.479
<v Speaker 2>homo sapien right. The mission, as he puts it, is

76
00:03:41.520 --> 00:03:44.360
<v Speaker 2>to make people really aware of technology, to sort of

77
00:03:44.840 --> 00:03:46.800
<v Speaker 2>convert them into technical humans.

78
00:03:46.919 --> 00:03:48.159
<v Speaker 1>Technical humans. I like that.

79
00:03:48.280 --> 00:03:51.000
<v Speaker 2>Yeah, the idea is helping people learn tech in easier,

80
00:03:51.080 --> 00:03:54.439
<v Speaker 2>faster ways, keeping them current for this digital age. We're

81
00:03:54.479 --> 00:03:58.319
<v Speaker 2>all in. And interestingly, their focus isn't just ethical hacking anymore.

82
00:03:58.319 --> 00:04:00.879
<v Speaker 2>It's broadened out to other tech felss.

83
00:04:00.360 --> 00:04:04.199
<v Speaker 1>Too, so a wider mission for digital literacy overall. Okay,

84
00:04:04.240 --> 00:04:06.520
<v Speaker 1>as a great background, Now let's peel back the layers,

85
00:04:06.560 --> 00:04:10.680
<v Speaker 1>the foundations. What actually is hacking because often we think

86
00:04:10.719 --> 00:04:14.439
<v Speaker 1>of it as purely modern right digital, But the book

87
00:04:14.439 --> 00:04:16.199
<v Speaker 1>says its roots go way back.

88
00:04:16.360 --> 00:04:19.959
<v Speaker 2>They really do. The core idea manipulating systems has been

89
00:04:20.000 --> 00:04:22.480
<v Speaker 2>around for over fifty years. You can even argue the

90
00:04:22.519 --> 00:04:26.800
<v Speaker 2>spirit goes back to like eighteen seventy eight Bell telephone

91
00:04:27.279 --> 00:04:32.759
<v Speaker 2>teenage switchboard operators messing with calls, disconnecting them, misdirecting them,

92
00:04:33.120 --> 00:04:34.519
<v Speaker 2>kind of mischievous hacks.

93
00:04:34.600 --> 00:04:36.160
<v Speaker 1>Huh, never thought of it like that.

94
00:04:36.480 --> 00:04:39.360
<v Speaker 2>But the first sort of authentic computer hackers they showed

95
00:04:39.439 --> 00:04:42.759
<v Speaker 2>up in the nineteen sixties at MIT, students finding clever

96
00:04:42.879 --> 00:04:46.839
<v Speaker 2>programming shortcuts, hacks to make computers do tasks faster, sometimes

97
00:04:46.920 --> 00:04:48.560
<v Speaker 2>even better than the original design.

98
00:04:48.720 --> 00:04:51.680
<v Speaker 1>And that creative shortcut approach led to big things.

99
00:04:51.680 --> 00:04:55.279
<v Speaker 2>Like Unix exactly. The book credits Dennis Ritchie and Ken

100
00:04:55.319 --> 00:04:58.040
<v Speaker 2>Thompson at Bell Labs in nineteen sixty nine they created

101
00:04:58.079 --> 00:05:00.759
<v Speaker 2>you Andix as this open set of rules for running machines,

102
00:05:00.839 --> 00:05:03.560
<v Speaker 2>essentially a really sophisticated creative hack at the time.

103
00:05:03.639 --> 00:05:06.480
<v Speaker 1>Okay, so how do we get from creative shortcuts to

104
00:05:06.519 --> 00:05:08.120
<v Speaker 1>the definition we mostly use today?

105
00:05:08.319 --> 00:05:12.040
<v Speaker 2>Well, that's the crucial evolution. Today. Hacking in the common

106
00:05:12.120 --> 00:05:15.759
<v Speaker 2>sense is mostly about finding those entry points, those vulnerabilities

107
00:05:16.240 --> 00:05:20.199
<v Speaker 2>in a system or network, usually to gain unauthorized access,

108
00:05:20.240 --> 00:05:22.120
<v Speaker 2>maybe steal info, cause harm.

109
00:05:22.279 --> 00:05:24.839
<v Speaker 1>Right, But ethical hacking flips that completely.

110
00:05:24.920 --> 00:05:28.199
<v Speaker 2>Ethical hacking is deliberately doing the same things, but with permission.

111
00:05:28.560 --> 00:05:33.920
<v Speaker 2>You're exploring the weaknesses, testing the defenses, specifically to improve security.

112
00:05:34.360 --> 00:05:40.040
<v Speaker 2>It's also called penetration testing, intrusion testing, red teaming, different

113
00:05:40.120 --> 00:05:41.240
<v Speaker 2>names for the same goal.

114
00:05:41.360 --> 00:05:43.759
<v Speaker 1>Got it. So what motivates people to hack in the

115
00:05:43.759 --> 00:05:46.439
<v Speaker 1>first place? The book covers a pretty wide range, doesn't it.

116
00:05:46.439 --> 00:05:48.560
<v Speaker 2>It really does. It goes from just you know, for

117
00:05:48.639 --> 00:05:52.000
<v Speaker 2>fun or showing off skills all the way to malicious

118
00:05:52.000 --> 00:05:56.759
<v Speaker 2>stuff like stealing information, damaging systems, invading privacy, even extortion.

119
00:05:56.959 --> 00:06:00.519
<v Speaker 1>But it also includes the positive side, like testing security.

120
00:06:00.120 --> 00:06:04.920
<v Speaker 2>Absolutely system security testing, maybe even breaking policy compliance in

121
00:06:04.959 --> 00:06:08.240
<v Speaker 2>a way that highlights a flaw constructively. It's a mixed

122
00:06:08.240 --> 00:06:09.519
<v Speaker 2>bag of motivations, which.

123
00:06:09.439 --> 00:06:12.399
<v Speaker 1>Leads us nicely into different types of hackers. The book

124
00:06:12.439 --> 00:06:13.480
<v Speaker 1>breaks them down by intent.

125
00:06:13.839 --> 00:06:16.399
<v Speaker 2>Yeah, pretty clearly, you've got your white hat hackers. Those

126
00:06:16.399 --> 00:06:20.399
<v Speaker 2>are the ethical security experts, the good guys doing the

127
00:06:20.399 --> 00:06:22.199
<v Speaker 2>penetration testing to protect us.

128
00:06:22.480 --> 00:06:25.600
<v Speaker 1>Then the black hat hackers sometimes called crackers. They're the

129
00:06:25.639 --> 00:06:30.879
<v Speaker 1>ones operating illegally with malicious intent, stealing data, wrecking systems.

130
00:06:31.399 --> 00:06:34.639
<v Speaker 2>And then there's that interesting gray area, the gray hat hackers.

131
00:06:34.800 --> 00:06:38.399
<v Speaker 1>Right, they might bend or break rules, maybe even laws,

132
00:06:39.000 --> 00:06:40.759
<v Speaker 1>but not necessarily with bad intentions.

133
00:06:40.920 --> 00:06:43.279
<v Speaker 2>Often, yeah, their goal might be just to find a

134
00:06:43.319 --> 00:06:46.800
<v Speaker 2>weakness and tell the owner. Maybe hoping for some recognition

135
00:06:46.959 --> 00:06:49.480
<v Speaker 2>or even a bug bounty payment. They operate in that

136
00:06:49.519 --> 00:06:50.480
<v Speaker 2>ambiguous zone.

137
00:06:50.639 --> 00:06:53.560
<v Speaker 1>The book also mentions red hat hackers that's distinct from

138
00:06:53.560 --> 00:06:54.879
<v Speaker 1>the software company right.

139
00:06:54.839 --> 00:06:55.399
<v Speaker 2>Very distinct.

140
00:06:55.480 --> 00:06:55.759
<v Speaker 1>Yeah.

141
00:06:56.079 --> 00:06:59.079
<v Speaker 2>In this context, red hat hackers are described as focusing

142
00:06:59.120 --> 00:07:03.720
<v Speaker 2>specifically on targeting government agencies, top secret data hubs, high

143
00:07:03.800 --> 00:07:04.800
<v Speaker 2>level target Okay.

144
00:07:04.839 --> 00:07:07.519
<v Speaker 1>And then you have the less sophisticated.

145
00:07:06.839 --> 00:07:10.839
<v Speaker 2>Actors right script kitties, people who use hacking tools made

146
00:07:10.879 --> 00:07:15.120
<v Speaker 2>by others without really understanding the underlying principles. And activists

147
00:07:15.199 --> 00:07:19.600
<v Speaker 2>who use hacking techniques like defacing websites or launching denial

148
00:07:19.600 --> 00:07:23.639
<v Speaker 2>of service attacks to promote a social, political, or religious message.

149
00:07:23.720 --> 00:07:26.439
<v Speaker 1>It's a whole ecosystem. Now. Trying to understand all this

150
00:07:26.879 --> 00:07:30.480
<v Speaker 1>requires learning a new language. Almost The book includes a

151
00:07:30.519 --> 00:07:32.560
<v Speaker 1>glossary which seems super.

152
00:07:32.319 --> 00:07:36.199
<v Speaker 2>Helpful, absolutely essential. Understanding these terms is key to unlocking

153
00:07:36.279 --> 00:07:38.959
<v Speaker 2>what the book and the field is all about. And

154
00:07:39.000 --> 00:07:41.639
<v Speaker 2>you'll notice as we go through some how many revolve

155
00:07:41.639 --> 00:07:45.199
<v Speaker 2>around deception. Unauthorized access tells you a lot.

156
00:07:45.319 --> 00:07:48.720
<v Speaker 1>Good point, it's as much about psychology as technology sometimes,

157
00:07:48.959 --> 00:07:51.680
<v Speaker 1>So let's run through a few key ones. Adwere software

158
00:07:51.720 --> 00:07:55.439
<v Speaker 1>that just forces ads on you annoying, sometimes malicious.

159
00:07:55.879 --> 00:07:58.040
<v Speaker 2>An attack is pretty straightforward. The action to get in

160
00:07:58.120 --> 00:08:00.079
<v Speaker 2>or get data a backdoor.

161
00:08:00.040 --> 00:08:03.240
<v Speaker 1>Secret entrance, a hidden way in that bypasses the normal

162
00:08:03.279 --> 00:08:04.120
<v Speaker 1>security checks.

163
00:08:04.199 --> 00:08:08.560
<v Speaker 2>Okay, Bots and botnets. A bot is just an automated program.

164
00:08:08.800 --> 00:08:12.199
<v Speaker 2>A botnet is when an attacker controls a whole network

165
00:08:12.199 --> 00:08:15.120
<v Speaker 2>of infected computers. Those zombie drones we mentioned to do

166
00:08:15.160 --> 00:08:18.959
<v Speaker 2>their bidding, like sending spam or launching massive attacks.

167
00:08:19.120 --> 00:08:21.079
<v Speaker 1>Brute force attack that's.

168
00:08:20.879 --> 00:08:25.360
<v Speaker 2>Just trying every single password combination possible, usually automated until

169
00:08:25.360 --> 00:08:29.959
<v Speaker 2>one works simple, but can be effective against weak passwords.

170
00:08:30.040 --> 00:08:32.879
<v Speaker 1>But for overflow, you described it like pouring too much

171
00:08:32.919 --> 00:08:34.279
<v Speaker 1>water into a glass earlier.

172
00:08:34.480 --> 00:08:38.600
<v Speaker 2>Exactly, you overwhelm a specific memory area, causing data to

173
00:08:38.639 --> 00:08:42.480
<v Speaker 2>spill over, potentially crashing the system or worse, allowing the

174
00:08:42.480 --> 00:08:44.080
<v Speaker 2>attacker to inject their own code.

175
00:08:44.240 --> 00:08:45.559
<v Speaker 1>Clone fishing sounds sneaky.

176
00:08:45.679 --> 00:08:49.159
<v Speaker 2>It is taking a legitimate email, copying it, but changing

177
00:08:49.200 --> 00:08:51.480
<v Speaker 2>the links to point somewhere malicious to trick you.

178
00:08:51.639 --> 00:08:53.279
<v Speaker 1>A cracker versus a hacker.

179
00:08:53.080 --> 00:08:56.000
<v Speaker 2>Often use for someone who modifies software, especially to break

180
00:08:56.039 --> 00:08:58.919
<v Speaker 2>copy protection. Sometimes overlaps with black.

181
00:08:58.639 --> 00:09:01.399
<v Speaker 1>Hat denial of service sandidas.

182
00:09:01.080 --> 00:09:04.240
<v Speaker 2>Making a website or service unusable by flooding it with traffic.

183
00:09:04.600 --> 00:09:08.120
<v Speaker 2>Didas is the distributed version using a botnet to amplify

184
00:09:08.159 --> 00:09:09.120
<v Speaker 2>the attack massively.

185
00:09:09.279 --> 00:09:10.519
<v Speaker 1>Exploit and exploit kit.

186
00:09:10.840 --> 00:09:13.840
<v Speaker 2>An exploit is the specific piece of code or technique

187
00:09:13.840 --> 00:09:17.279
<v Speaker 2>that takes advantage of a vulnerability. An exploit kit is

188
00:09:17.320 --> 00:09:20.360
<v Speaker 2>like a prepackaged toolkit that helps automate finding and using

189
00:09:20.360 --> 00:09:21.120
<v Speaker 2>those exploits.

190
00:09:21.240 --> 00:09:23.120
<v Speaker 1>Firewall the digital bouncer.

191
00:09:23.039 --> 00:09:26.080
<v Speaker 2>YEP filtering traffic trying to keep intruders out.

192
00:09:26.159 --> 00:09:28.679
<v Speaker 1>Dampto quogging malicious.

193
00:09:28.039 --> 00:09:32.399
<v Speaker 2>Software that secretly records everything you type, very dangerous for

194
00:09:32.519 --> 00:09:37.360
<v Speaker 2>capturing passwords, credit card numbers. A logic bomb a piece

195
00:09:37.399 --> 00:09:41.200
<v Speaker 2>of malicious code designed to trigger only under certain conditions,

196
00:09:41.279 --> 00:09:44.440
<v Speaker 2>like on a specific date or if an employee gets fired.

197
00:09:44.440 --> 00:09:47.120
<v Speaker 1>That kind of thing. Malware is the big umbrella.

198
00:09:46.759 --> 00:09:52.720
<v Speaker 2>Term right covers, viruses, worms, trojans, ransomware, any software designed

199
00:09:52.759 --> 00:09:53.320
<v Speaker 2>to be hostile.

200
00:09:53.399 --> 00:09:56.320
<v Speaker 1>Phishing. We all know that one sadly, the fake emails

201
00:09:56.360 --> 00:09:57.519
<v Speaker 1>trying to get personal info.

202
00:09:58.360 --> 00:10:01.720
<v Speaker 2>Freaker is an older term, most for breaking into phone networks.

203
00:10:01.879 --> 00:10:06.639
<v Speaker 2>Rootkit super stealthy malware. It hides itself and other malicious processes,

204
00:10:06.639 --> 00:10:09.720
<v Speaker 2>often giving the attacker the highest level root privileges. On

205
00:10:09.759 --> 00:10:12.080
<v Speaker 2>a system very hard to detect.

206
00:10:12.120 --> 00:10:13.840
<v Speaker 1>Shrink wrap code exploit.

207
00:10:13.679 --> 00:10:16.879
<v Speaker 2>Taking advantage of vulnerabilities in software that hasn't been patched

208
00:10:17.159 --> 00:10:21.679
<v Speaker 2>or is using default insecure configurations, basically exploiting the out

209
00:10:21.679 --> 00:10:22.759
<v Speaker 2>of the box weaknesses.

210
00:10:22.840 --> 00:10:26.120
<v Speaker 1>Social engineering. This one feels different, less technical.

211
00:10:26.320 --> 00:10:29.720
<v Speaker 2>Absolutely, it's the art of manipulation. Tricking people into giving

212
00:10:29.799 --> 00:10:33.799
<v Speaker 2>up information or performing actions they shouldn't. Often involves impersonation.

213
00:10:34.159 --> 00:10:36.840
<v Speaker 2>Pre Texting relies on human psychology.

214
00:10:37.039 --> 00:10:39.679
<v Speaker 1>Spam unwanted email spoofing.

215
00:10:39.279 --> 00:10:42.639
<v Speaker 2>Faking your identity could be your IP address, email address,

216
00:10:42.720 --> 00:10:46.120
<v Speaker 2>caller ID to gain unauthorized access or trick someone.

217
00:10:46.279 --> 00:10:48.960
<v Speaker 1>Spyware gathers info without you knowing.

218
00:10:49.320 --> 00:10:53.919
<v Speaker 2>SQL injection a huge one for web security. Injecting malicious

219
00:10:54.000 --> 00:10:57.039
<v Speaker 2>database commands or into input fields on a website can

220
00:10:57.120 --> 00:10:59.960
<v Speaker 2>let attackers read, chained or delete database comes.

221
00:11:00.559 --> 00:11:01.919
<v Speaker 1>Threat versus vulnerability.

222
00:11:01.960 --> 00:11:05.480
<v Speaker 2>A vulnerability is the weakness itself, the unlocked window. A

223
00:11:05.519 --> 00:11:08.559
<v Speaker 2>threat is the potential danger that could exploit that weakness,

224
00:11:08.879 --> 00:11:10.799
<v Speaker 2>the burglar who might climb through the window.

225
00:11:10.960 --> 00:11:13.440
<v Speaker 1>Trojan horse malware disguises something legitimate.

226
00:11:13.639 --> 00:11:15.840
<v Speaker 2>Yep, you willingly let it in because you think it's

227
00:11:15.879 --> 00:11:16.879
<v Speaker 2>harmless or useful.

228
00:11:17.000 --> 00:11:18.480
<v Speaker 1>Virus versus worm a.

229
00:11:18.519 --> 00:11:21.600
<v Speaker 2>Virus needs to attach itself to another program to spread,

230
00:11:21.919 --> 00:11:26.320
<v Speaker 2>often requiring human action like opening a file. A worm

231
00:11:26.559 --> 00:11:29.559
<v Speaker 2>is self replicating, it can spread across networks on its

232
00:11:29.600 --> 00:11:31.600
<v Speaker 2>own without needing to attach to anything.

233
00:11:31.840 --> 00:11:34.559
<v Speaker 1>Cross sight scripting EXSS.

234
00:11:33.960 --> 00:11:38.519
<v Speaker 2>Injecting malicious scripts usually JavaScript, into a legitimate website so

235
00:11:38.559 --> 00:11:41.879
<v Speaker 2>it runs in the browsers of other visitors. Can steal cookies,

236
00:11:41.960 --> 00:11:44.279
<v Speaker 2>redirect users, deface sites.

237
00:11:44.200 --> 00:11:46.759
<v Speaker 1>And zombie drawn that hijacked computer and a bot.

238
00:11:46.720 --> 00:11:49.759
<v Speaker 2>At exactly doing the attackers dirty work.

239
00:11:49.840 --> 00:11:52.399
<v Speaker 1>Okay, that's a ton of terminology, but really crucial for

240
00:11:52.480 --> 00:11:56.759
<v Speaker 1>understanding the landscape. So once you grasp the language, what

241
00:11:56.840 --> 00:12:00.320
<v Speaker 1>tools does an ethical hacker actually use? The book talks

242
00:12:00.320 --> 00:12:03.480
<v Speaker 1>about starting with physical tools. What does that really mean? Here?

243
00:12:03.639 --> 00:12:05.759
<v Speaker 2>It's more about starting with tools where you can kind

244
00:12:05.759 --> 00:12:08.279
<v Speaker 2>of see the cause and effect more directly. The idea

245
00:12:08.279 --> 00:12:11.759
<v Speaker 2>is to understand the underlying protocols and concepts without getting

246
00:12:11.799 --> 00:12:14.559
<v Speaker 2>lost in complex code right away see the results of

247
00:12:14.600 --> 00:12:15.240
<v Speaker 2>your actions.

248
00:12:15.279 --> 00:12:18.399
<v Speaker 1>Clearly makes sense, and the book highlights some big ones

249
00:12:18.720 --> 00:12:20.320
<v Speaker 1>Metasploid framework. Yeah.

250
00:12:20.480 --> 00:12:25.840
<v Speaker 2>Cornerstone open source penetration testing tool makes exploiting known vulnerabilities

251
00:12:25.919 --> 00:12:29.279
<v Speaker 2>much easier with its library of pre built modules and payloads.

252
00:12:29.279 --> 00:12:33.519
<v Speaker 2>It's incredibly powerful end map network mapper, fantastic tool for

253
00:12:33.600 --> 00:12:37.200
<v Speaker 2>network discovery and security auditing. It finds hosts, scans for

254
00:12:37.240 --> 00:12:41.399
<v Speaker 2>open ports, identifies services running, can even help fingerprint operating

255
00:12:41.440 --> 00:12:45.039
<v Speaker 2>systems and bypass firewalls really versatile.

256
00:12:45.080 --> 00:12:47.360
<v Speaker 1>Wireshark is another famous one packet sniffing.

257
00:12:47.720 --> 00:12:51.240
<v Speaker 2>The go to packet analyzer. It captures network traffic in

258
00:12:51.360 --> 00:12:55.080
<v Speaker 2>real time and lets you inspect individual packets. Essential for

259
00:12:55.120 --> 00:12:59.399
<v Speaker 2>troubleshooting network problems, analyzing protocols, and yes, finding things like

260
00:12:59.519 --> 00:13:02.960
<v Speaker 2>unencrypted passwords if they're flying across the network. Nesis a

261
00:13:03.000 --> 00:13:07.080
<v Speaker 2>popular vulnerability scanner. It checks systems against a huge database

262
00:13:07.120 --> 00:13:11.519
<v Speaker 2>of known vulnerabilities cvees and reports potential weaknesses. Uses its

263
00:13:11.519 --> 00:13:14.840
<v Speaker 2>own scripting language NASL for tests, air.

264
00:13:14.720 --> 00:13:17.159
<v Speaker 1>Cracking sounds Wi Fi specific it is.

265
00:13:17.200 --> 00:13:20.120
<v Speaker 2>It's a whole suite of tools for auditing wireless network security,

266
00:13:20.519 --> 00:13:23.759
<v Speaker 2>monitoring traffic, attacking networks like trying to crack WP and

267
00:13:23.919 --> 00:13:27.360
<v Speaker 2>wpopat two keys, testing Wi Fi cards, the standard for

268
00:13:27.399 --> 00:13:28.399
<v Speaker 2>Wi Fi pen testing.

269
00:13:28.639 --> 00:13:30.360
<v Speaker 1>John the Ripper for passwords.

270
00:13:29.960 --> 00:13:34.200
<v Speaker 2>YEP a fast password cracker primarily known for cracking various

271
00:13:34.240 --> 00:13:37.759
<v Speaker 2>password hash formats, especially good at finding weak Unix passwords,

272
00:13:37.799 --> 00:13:39.279
<v Speaker 2>but supports many others too.

273
00:13:39.559 --> 00:13:42.240
<v Speaker 1>And surprisingly, Google itself is listed as a tool.

274
00:13:42.360 --> 00:13:46.039
<v Speaker 2>Oh yeah, definitely. The book calls it a near real

275
00:13:46.120 --> 00:13:50.759
<v Speaker 2>time vulnerability database. Using specific search queries what's often called

276
00:13:50.759 --> 00:13:54.360
<v Speaker 2>Google dorking, you can find an astonishing amount of sensitive

277
00:13:54.360 --> 00:13:59.120
<v Speaker 2>information that's been accidentally exposed online, misconfigured servers, internal documents,

278
00:13:59.159 --> 00:14:02.080
<v Speaker 2>open network share. It's all about knowing how to search.

279
00:14:02.480 --> 00:14:05.480
<v Speaker 1>That's wild. So you have the tools, but you need

280
00:14:05.519 --> 00:14:08.559
<v Speaker 1>a place to use them safely and effectively. That brings

281
00:14:08.639 --> 00:14:12.440
<v Speaker 1>us to the workplace. Setup Kali Linux Why is Collie?

282
00:14:12.440 --> 00:14:13.000
<v Speaker 1>The standard?

283
00:14:13.200 --> 00:14:17.159
<v Speaker 2>KLLI is basically Debian Linux, specifically rebuilt and pre configured

284
00:14:17.159 --> 00:14:21.600
<v Speaker 2>for penetration testing and digital forensics. It's maintained by Offensive Security,

285
00:14:21.639 --> 00:14:24.960
<v Speaker 2>the folks behind the OSCP certification. It comes bundled with

286
00:14:25.120 --> 00:14:29.440
<v Speaker 2>hundreds of specialized tools metasploid, end map, wire Shark, aircrack,

287
00:14:29.559 --> 00:14:32.159
<v Speaker 2>John the Ripper. They're all usually there. It saves a

288
00:14:32.200 --> 00:14:36.480
<v Speaker 2>ton of setup time and provides a standardized, reliable environment.

289
00:14:36.279 --> 00:14:38.799
<v Speaker 1>And the book recommends setting it up in a virtual

290
00:14:38.840 --> 00:14:40.360
<v Speaker 1>machine like virtual box.

291
00:14:40.519 --> 00:14:44.399
<v Speaker 2>Exactly. Running Collie in a VM creates an isolated sandbox

292
00:14:44.759 --> 00:14:47.759
<v Speaker 2>you can experiment even break things without affecting your main

293
00:14:47.840 --> 00:14:51.320
<v Speaker 2>operating system. It's much safer, especially when you're learning or

294
00:14:51.360 --> 00:14:55.080
<v Speaker 2>dealing with potentially risky tools or exploits. The book gives

295
00:14:55.120 --> 00:14:57.399
<v Speaker 2>step by step instructions for that virtual.

296
00:14:57.080 --> 00:15:00.919
<v Speaker 1>Box setup, covering things like memory allocation, virtual hard disk,

297
00:15:01.000 --> 00:15:02.600
<v Speaker 1>set up, all.

298
00:15:02.399 --> 00:15:05.639
<v Speaker 2>The details right, getting the foundation right, and beyond just

299
00:15:05.679 --> 00:15:10.039
<v Speaker 2>installing Collie. The book covers configuring essential network services within it,

300
00:15:10.240 --> 00:15:12.960
<v Speaker 2>making sure you can connect properly, maybe setting up network

301
00:15:13.000 --> 00:15:14.320
<v Speaker 2>proxies if needed, and.

302
00:15:14.279 --> 00:15:18.360
<v Speaker 1>Enabling SSH secure shell for remote access but.

303
00:15:18.360 --> 00:15:23.360
<v Speaker 2>Securely, crucially securely, Collie disables the default SSH service for safety.

304
00:15:23.720 --> 00:15:26.159
<v Speaker 2>The book explains how to generate unique keys and start

305
00:15:26.200 --> 00:15:27.799
<v Speaker 2>the service properly if you need it.

306
00:15:27.840 --> 00:15:31.559
<v Speaker 1>And keeping Collie updated is paramount, just like ANYOS.

307
00:15:31.519 --> 00:15:36.120
<v Speaker 2>Absolutely critical. The threat landscape changes constantly. The book explains

308
00:15:36.159 --> 00:15:40.480
<v Speaker 2>debian's package management system APT and the commands like appt

309
00:15:40.480 --> 00:15:43.039
<v Speaker 2>get update and app get upgrade or disted upgrade. To

310
00:15:43.120 --> 00:15:45.840
<v Speaker 2>keep Collie and all its tools patched and current. An

311
00:15:45.919 --> 00:15:49.440
<v Speaker 2>outdated hacking toolkit is not very effective or safe.

312
00:15:49.559 --> 00:15:54.240
<v Speaker 1>Okay, environment set tools ready. Now the actual process begins.

313
00:15:54.240 --> 00:15:58.120
<v Speaker 1>The book Hammer's home that reconnaissance or information gathering is

314
00:15:58.480 --> 00:16:00.960
<v Speaker 1>the first and maybe most critical step. It says it

315
00:16:00.960 --> 00:16:03.279
<v Speaker 1>can take up to seventy five percent of the effort.

316
00:16:03.559 --> 00:16:06.519
<v Speaker 2>Why so much because you can't effectively attack what you

317
00:16:06.559 --> 00:16:10.639
<v Speaker 2>don't understand. Recon is about meticulously mapping out your target's

318
00:16:10.679 --> 00:16:13.360
<v Speaker 2>digital footprint. What systems do they have, what software are

319
00:16:13.360 --> 00:16:15.840
<v Speaker 2>they running, who works there, what's their network structure like.

320
00:16:16.559 --> 00:16:18.960
<v Speaker 2>The more info you gather up front, the higher your

321
00:16:19.039 --> 00:16:22.360
<v Speaker 2>chances of finding a viable enter point. Rushing this phase

322
00:16:22.440 --> 00:16:24.960
<v Speaker 2>is a recipe for failure or getting caught, and.

323
00:16:24.919 --> 00:16:28.000
<v Speaker 1>There are two main types of recon, active and passive.

324
00:16:28.320 --> 00:16:32.480
<v Speaker 2>That's right. Passive recon is gathering information without directly interacting

325
00:16:32.519 --> 00:16:37.120
<v Speaker 2>with the target systems. Think public records, social media, news articles, DNS,

326
00:16:37.159 --> 00:16:41.399
<v Speaker 2>lookups from public servers, Google dorking. It's stealthier, lower risk

327
00:16:41.440 --> 00:16:41.960
<v Speaker 2>of detection.

328
00:16:42.279 --> 00:16:46.159
<v Speaker 1>Active recon, then, is when you start probing the target directly.

329
00:16:45.919 --> 00:16:49.559
<v Speaker 2>Exactly things like ports, standing their servers, trying to identify

330
00:16:49.600 --> 00:16:52.360
<v Speaker 2>web server versions, interacting with their systems in ways that

331
00:16:52.399 --> 00:16:55.840
<v Speaker 2>could be logged or detected by intrusion detection systems IDs

332
00:16:56.279 --> 00:17:00.399
<v Speaker 2>or intrusion prevention systems IPS. It yields more detailed info

333
00:17:00.559 --> 00:17:01.720
<v Speaker 2>but carries more risk.

334
00:17:02.200 --> 00:17:05.400
<v Speaker 1>You mentioned DNS lookups. DNS reconnaissance seems like a key

335
00:17:05.440 --> 00:17:05.799
<v Speaker 1>part of this.

336
00:17:06.119 --> 00:17:10.359
<v Speaker 2>It's incredibly valuable DNS. The Internet's phone book holds info

337
00:17:10.400 --> 00:17:15.000
<v Speaker 2>about domain names, mail servers, IP addresses. Analyzing and organization's

338
00:17:15.079 --> 00:17:18.279
<v Speaker 2>DNS records can reveal a surprising amount about their internal

339
00:17:18.319 --> 00:17:21.960
<v Speaker 2>network structure, often without setting off alarms. Because while DNAs

340
00:17:22.000 --> 00:17:23.599
<v Speaker 2>traffic is usually considered normal.

341
00:17:23.720 --> 00:17:26.279
<v Speaker 1>So what are some specific methods the book mentions for

342
00:17:26.359 --> 00:17:28.279
<v Speaker 1>gathering target info footprinting?

343
00:17:28.519 --> 00:17:34.000
<v Speaker 2>Footprinting is that broad initial information gathering, collecting domain names,

344
00:17:34.119 --> 00:17:38.480
<v Speaker 2>IP ranges, network blocks, employee names, and contact details, maybe

345
00:17:38.480 --> 00:17:42.480
<v Speaker 2>even physical locations using tools like who is and slick

346
00:17:42.559 --> 00:17:45.680
<v Speaker 2>up trace route, even just searching online databases.

347
00:17:46.039 --> 00:17:47.519
<v Speaker 1>Fingerprinting sounds more specific.

348
00:17:47.599 --> 00:17:51.880
<v Speaker 2>It is fingerprinting aims to identify the exact operating system, services,

349
00:17:51.880 --> 00:17:56.160
<v Speaker 2>and software versions running on a target system. Active fingerprinting

350
00:17:56.240 --> 00:18:00.799
<v Speaker 2>involves sending specific, sometimes malformed packets and analyze the response

351
00:18:01.200 --> 00:18:06.480
<v Speaker 2>different ozs response slightly differently. Passive fingerprinting involves analyzing network

352
00:18:06.480 --> 00:18:08.400
<v Speaker 2>traffic characteristics without sending.

353
00:18:08.160 --> 00:18:10.119
<v Speaker 1>Anything directly DNS enumeration.

354
00:18:10.319 --> 00:18:13.279
<v Speaker 2>This is actively querying DNS servers to try and discover

355
00:18:13.400 --> 00:18:17.000
<v Speaker 2>all DNS records associated with a domain, host names, subdomains,

356
00:18:17.039 --> 00:18:19.599
<v Speaker 2>server roles. It's like trying to get a complete map

357
00:18:19.599 --> 00:18:21.039
<v Speaker 2>of their digital territory, and.

358
00:18:21.000 --> 00:18:23.960
<v Speaker 1>Tools like the Harvester can automate finding user names and emails.

359
00:18:24.200 --> 00:18:27.000
<v Speaker 2>Yeah, the Harvester is great for passive recon. It's screen

360
00:18:27.119 --> 00:18:31.160
<v Speaker 2>search engines, pgpkey servers, social networks like LinkedIn to gather

361
00:18:31.240 --> 00:18:35.400
<v Speaker 2>email addresses, employee names, subdomains associated with the target domain

362
00:18:35.680 --> 00:18:38.680
<v Speaker 2>very useful for building a picture of the organization.

363
00:18:38.519 --> 00:18:42.920
<v Speaker 1>And finding domain registration details via whis is standard.

364
00:18:42.480 --> 00:18:46.000
<v Speaker 2>Practice absolutely whoiz, dot com or command line whose tools

365
00:18:46.039 --> 00:18:50.160
<v Speaker 2>give you the owner registrar, registration expiry dates, name servers,

366
00:18:50.160 --> 00:18:52.799
<v Speaker 2>contact info sometimes reveals more than.

367
00:18:52.680 --> 00:18:55.640
<v Speaker 1>Intended pingsweep sounds simple.

368
00:18:55.640 --> 00:18:59.480
<v Speaker 2>It is, but effective for basic network mapping sending ICMP

369
00:18:59.640 --> 00:19:02.920
<v Speaker 2>echo requests things to a range of IP addresses to

370
00:19:02.920 --> 00:19:06.400
<v Speaker 2>see which ones respond, indicating live hosts. Tools like flepping

371
00:19:06.559 --> 00:19:08.119
<v Speaker 2>or nmap do this efficiently.

372
00:19:08.319 --> 00:19:10.240
<v Speaker 1>Import scanning checking for open doors.

373
00:19:10.000 --> 00:19:13.319
<v Speaker 2>Precisely systematically probing the ports on a target host to

374
00:19:13.319 --> 00:19:16.240
<v Speaker 2>see which ones are open and listening for connections. Open

375
00:19:16.279 --> 00:19:19.799
<v Speaker 2>ports indicate running services which might be vulnerable. N map

376
00:19:19.839 --> 00:19:22.440
<v Speaker 2>is the king of port Standing all this together builds

377
00:19:22.440 --> 00:19:24.920
<v Speaker 2>that crucial foundation before you even think about.

378
00:19:24.640 --> 00:19:29.519
<v Speaker 1>Exploits, which brings us to actually executing exploits. The book

379
00:19:29.599 --> 00:19:32.519
<v Speaker 1>dives deep into metasploid. Here we doudged on it, but

380
00:19:32.680 --> 00:19:34.839
<v Speaker 1>let's revisit its core components. Right.

381
00:19:35.119 --> 00:19:39.079
<v Speaker 2>Metasploid is modular. You have exploits, which are the code

382
00:19:39.079 --> 00:19:43.400
<v Speaker 2>that takes advantage of a specific vulnerability. You have payloads,

383
00:19:43.440 --> 00:19:45.359
<v Speaker 2>which is the code that runs on the victim machine

384
00:19:45.480 --> 00:19:49.319
<v Speaker 2>after the exploit succeeds, giving you control like a reverse shell.

385
00:19:49.319 --> 00:19:50.160
<v Speaker 1>A shell code.

386
00:19:50.319 --> 00:19:53.039
<v Speaker 2>Often the payload itself is referred to as shell code,

387
00:19:53.279 --> 00:19:55.640
<v Speaker 2>especially if its goal is to give you a command

388
00:19:55.680 --> 00:19:59.039
<v Speaker 2>shell like a command prompt terminal on the victim system.

389
00:19:59.119 --> 00:20:01.279
<v Speaker 1>And modules are the interchangeable parts yep.

390
00:20:01.599 --> 00:20:06.359
<v Speaker 2>Metascloid organizes everything into modules. Exploit modules, payload modules, auxiliary

391
00:20:06.440 --> 00:20:10.599
<v Speaker 2>modules for scanning, fuzzing, et cetera. Post exploitation modules. You

392
00:20:10.640 --> 00:20:13.000
<v Speaker 2>mix and match them. A listener is needed on the

393
00:20:13.039 --> 00:20:16.200
<v Speaker 2>attackers machine to handle the incoming connection from the payload

394
00:20:16.279 --> 00:20:17.240
<v Speaker 2>running on the victim.

395
00:20:17.559 --> 00:20:20.079
<v Speaker 1>The show command helps navigate all this invaluable.

396
00:20:20.279 --> 00:20:23.319
<v Speaker 2>Show exploits, show payloads, show options. It tells you what's

397
00:20:23.319 --> 00:20:25.799
<v Speaker 2>available and what parameters you need. To set for a

398
00:20:25.880 --> 00:20:26.640
<v Speaker 2>chosen module.

399
00:20:26.960 --> 00:20:29.640
<v Speaker 1>You mentioned. Payloads could be staged or single. Can you

400
00:20:29.720 --> 00:20:30.519
<v Speaker 1>unpack that a bit?

401
00:20:30.720 --> 00:20:33.839
<v Speaker 2>Sure? A single payload contains the exploit and the entire

402
00:20:33.880 --> 00:20:36.440
<v Speaker 2>shell code all in one to go fire and forget.

403
00:20:36.839 --> 00:20:40.599
<v Speaker 2>Useful sometimes, but can be large, okay. Staged payloads are

404
00:20:40.640 --> 00:20:43.920
<v Speaker 2>more common, especially for network exploits. They split the payload

405
00:20:43.960 --> 00:20:47.079
<v Speaker 2>into a small stager and a larger stage. The exploit

406
00:20:47.079 --> 00:20:50.440
<v Speaker 2>delivers just the tiny stage or first. The stager's only

407
00:20:50.519 --> 00:20:52.839
<v Speaker 2>job is to connect back to the attackers machine the

408
00:20:52.920 --> 00:20:55.880
<v Speaker 2>listener and download the main stage the rest of the payload.

409
00:20:56.000 --> 00:20:57.839
<v Speaker 1>Ah. So it gets around size limits and makes the

410
00:20:57.839 --> 00:21:00.200
<v Speaker 1>initial exploit smaller and stealthier exactly.

411
00:21:00.359 --> 00:21:03.359
<v Speaker 2>The stager has the attackers IP and port embedded in

412
00:21:03.400 --> 00:21:06.880
<v Speaker 2>it metasploits listener handles serving up the main stage when

413
00:21:06.920 --> 00:21:08.799
<v Speaker 2>the stager connects back. It's quite clever.

414
00:21:09.039 --> 00:21:12.519
<v Speaker 1>The book gives a practical example hacking Windows XP using

415
00:21:12.559 --> 00:21:15.960
<v Speaker 1>an older exploit MS zero three zero two six RPCD

416
00:21:16.119 --> 00:21:19.000
<v Speaker 1>Soka walk us through the metasploid steps conceptually.

417
00:21:19.119 --> 00:21:22.759
<v Speaker 2>Okay, So first you'd launch the metasploit console MSF console.

418
00:21:22.960 --> 00:21:25.680
<v Speaker 2>Then you'd search for the exploit, maybe search d dot com.

419
00:21:25.720 --> 00:21:28.079
<v Speaker 2>You'd find the MS zero three zero two six dy

420
00:21:28.160 --> 00:21:31.480
<v Speaker 2>dot com exploit module and select it using use exploit

421
00:21:31.480 --> 00:21:34.039
<v Speaker 2>Windows d sarch CMS zero three zero two six.

422
00:21:33.960 --> 00:21:35.799
<v Speaker 1>D dot Com, then configure.

423
00:21:35.400 --> 00:21:38.400
<v Speaker 2>It right use show options to see what needs setting.

424
00:21:38.759 --> 00:21:42.119
<v Speaker 2>The main one is RHOS the remote host or target

425
00:21:42.160 --> 00:21:45.920
<v Speaker 2>IP address, so set rhos ten dot on zero, pote

426
00:21:45.920 --> 00:21:48.400
<v Speaker 2>aer point three or whatever the target's IP is. Choose

427
00:21:48.400 --> 00:21:51.519
<v Speaker 2>a payload, yeah, show payloads lists compatible ones. A common

428
00:21:51.599 --> 00:21:54.799
<v Speaker 2>choice is a reverse TCP shell like genericshell reverse at show.

429
00:21:55.160 --> 00:21:58.000
<v Speaker 2>You select it with set payload genericshell.

430
00:21:57.559 --> 00:22:00.000
<v Speaker 1>Reverse dose and tell it where to connect back to exactly.

431
00:22:00.160 --> 00:22:03.680
<v Speaker 2>Set elos the local host, your attacker machines IP, setlos

432
00:22:03.759 --> 00:22:06.599
<v Speaker 2>ten dot a zero tot at six, then just type

433
00:22:06.680 --> 00:22:09.599
<v Speaker 2>exploit and if it works, metasploit will attempt the exploit.

434
00:22:09.839 --> 00:22:12.559
<v Speaker 2>If successful, the payload runs on the target, connects back

435
00:22:12.599 --> 00:22:15.119
<v Speaker 2>to your listener, and you'll likely get a command shell session.

436
00:22:15.359 --> 00:22:17.759
<v Speaker 2>You can interact with it using sessions mine one if

437
00:22:17.759 --> 00:22:20.200
<v Speaker 2>it's session one, and run commands like dirt or ip

438
00:22:20.240 --> 00:22:21.680
<v Speaker 2>canfig on the remote machine.

439
00:22:21.759 --> 00:22:24.759
<v Speaker 1>It really demystifies the process, showing it step by step.

440
00:22:25.319 --> 00:22:29.240
<v Speaker 1>The book also covers hacking Android using metasploit. This involves

441
00:22:29.279 --> 00:22:30.319
<v Speaker 1>a trojan APK.

442
00:22:30.839 --> 00:22:34.240
<v Speaker 2>Yeah, this is more reliant on social engineering. First, you

443
00:22:34.359 --> 00:22:37.559
<v Speaker 2>use a tool like Msvenom or the older MS payload

444
00:22:37.599 --> 00:22:41.160
<v Speaker 2>to create a malicious Android application package dot APK file.

445
00:22:41.960 --> 00:22:46.000
<v Speaker 2>You embed a payload like Android metroprodervers and sippy and

446
00:22:46.079 --> 00:22:50.359
<v Speaker 2>configure it with your lhost IP address. You might disguise

447
00:22:50.400 --> 00:22:53.720
<v Speaker 2>the APK as something harmless like upgrader, dot ap or

448
00:22:53.759 --> 00:22:54.200
<v Speaker 2>a game.

449
00:22:54.480 --> 00:22:56.720
<v Speaker 1>Then you need the victim to actually install it.

450
00:22:56.839 --> 00:22:58.680
<v Speaker 2>That's the tricky part. You need to get that APK

451
00:22:58.839 --> 00:23:01.960
<v Speaker 2>onto their device and convince them to install it bypassing

452
00:23:02.000 --> 00:23:04.400
<v Speaker 2>Android security warnings about unknown sources.

453
00:23:04.519 --> 00:23:05.400
<v Speaker 1>If they do install it.

454
00:23:05.440 --> 00:23:08.599
<v Speaker 2>While they install it, you'd have metasploit running on your machine.

455
00:23:08.799 --> 00:23:12.200
<v Speaker 2>Using the Exploit Multi handler module. This is a generic listener.

456
00:23:12.559 --> 00:23:15.039
<v Speaker 2>You can figure it with the same payload and LHA

457
00:23:15.160 --> 00:23:18.599
<v Speaker 2>you use to create the APK. Start the listener with exploit.

458
00:23:18.960 --> 00:23:21.559
<v Speaker 2>When the victim runs the malicious app, the payloa executes,

459
00:23:21.640 --> 00:23:23.519
<v Speaker 2>connects it back to your listener and boom you get

460
00:23:23.519 --> 00:23:24.839
<v Speaker 2>a interpreter session.

461
00:23:24.640 --> 00:23:26.599
<v Speaker 1>And interpreter gives you a lot of control.

462
00:23:26.759 --> 00:23:30.880
<v Speaker 2>Oh yeah. The book lists commands like fix us, view processes,

463
00:23:31.240 --> 00:23:36.119
<v Speaker 2>webcamsnap take a picture, dump contacts, dump bos geolocate pretty

464
00:23:36.119 --> 00:23:38.319
<v Speaker 2>expensive access to the device's functions and data.

465
00:23:38.960 --> 00:23:42.920
<v Speaker 1>Scary stuff, definitely okay. Shifting gears from OS hacking to

466
00:23:43.039 --> 00:23:48.559
<v Speaker 1>web applications. These are everywhere accessed via browsers. The booknotes

467
00:23:48.640 --> 00:23:52.440
<v Speaker 1>data breaches are constant, often involving web at vulnerabilities.

468
00:23:52.720 --> 00:23:56.319
<v Speaker 2>It's a huge attack surface. Web apps handle sensitive data,

469
00:23:56.359 --> 00:24:00.559
<v Speaker 2>interact with databases, and unfortunately they're often complex, can contain

470
00:24:00.680 --> 00:24:03.799
<v Speaker 2>subtle flaws in how they handle user input or managed sessions.

471
00:24:04.079 --> 00:24:07.319
<v Speaker 2>Even simple coding mistakes can lead to major breaches, and.

472
00:24:07.359 --> 00:24:10.319
<v Speaker 1>SQL injection is one of the biggest culprits mentioned. Remindus

473
00:24:10.359 --> 00:24:10.839
<v Speaker 1>how it works.

474
00:24:11.240 --> 00:24:14.680
<v Speaker 2>Web apps talk to databases using SQL structured query language.

475
00:24:15.160 --> 00:24:18.119
<v Speaker 2>SQL injection happens when the application takes data provided by

476
00:24:18.119 --> 00:24:20.359
<v Speaker 2>a user, like in a search box or log in form,

477
00:24:20.519 --> 00:24:24.119
<v Speaker 2>and includes directly in a SQL query without properly sanitizing

478
00:24:24.200 --> 00:24:25.279
<v Speaker 2>or validating it first.

479
00:24:25.640 --> 00:24:29.279
<v Speaker 1>So the user input becomes part of the database command exactly.

480
00:24:29.599 --> 00:24:32.279
<v Speaker 2>If an attacker crafts their input carefully, they can inject

481
00:24:32.279 --> 00:24:35.440
<v Speaker 2>their own SQL commands. This can trick the database into

482
00:24:35.480 --> 00:24:38.839
<v Speaker 2>doing things it shouldn't like bypassing logins the book's user

483
00:24:38.920 --> 00:24:43.119
<v Speaker 2>name admin example, dumping entire tables of user data, modifying records,

484
00:24:43.160 --> 00:24:46.759
<v Speaker 2>or sometimes even executing commands on the underlying server operating system.

485
00:24:47.079 --> 00:24:49.839
<v Speaker 1>The impact sounds massive, and it's not just SQL.

486
00:24:50.160 --> 00:24:54.319
<v Speaker 2>Other injection types exist too, right LDAP injection, command injection,

487
00:24:54.640 --> 00:24:59.359
<v Speaker 2>X path injection similar principle, different underlying technology being manipulated

488
00:24:59.400 --> 00:25:01.319
<v Speaker 2>through unsaid anetized input.

489
00:25:01.359 --> 00:25:04.200
<v Speaker 1>So prevention is key. What does the book recommend?

490
00:25:04.400 --> 00:25:09.480
<v Speaker 2>Several crucial things. First, always validate untrusted input, preferably using

491
00:25:09.519 --> 00:25:13.440
<v Speaker 2>a strict allow list, only permit expected characters formats. Second,

492
00:25:13.920 --> 00:25:18.920
<v Speaker 2>use parameterized queries also called prepared statements or stored procedures.

493
00:25:19.079 --> 00:25:22.960
<v Speaker 2>These separate the SQL code from the user data, preventing injection. Third,

494
00:25:23.279 --> 00:25:27.279
<v Speaker 2>use well vetted ORM libraries that handle this securely. And fourth,

495
00:25:27.400 --> 00:25:30.119
<v Speaker 2>follow the principle of least privilege. Make sure the web

496
00:25:30.160 --> 00:25:34.079
<v Speaker 2>application's database account only has the minimum permissions it absolutely needs.

497
00:25:34.279 --> 00:25:37.279
<v Speaker 1>The book then shows a practical SEQL injection using tools

498
00:25:37.359 --> 00:25:40.279
<v Speaker 1>like secultiv and sql map. What's the process there?

499
00:25:40.559 --> 00:25:43.640
<v Speaker 2>Siglo can be used with Google dorking to find potentially

500
00:25:43.720 --> 00:25:47.319
<v Speaker 2>vulnerable URLs like pages with item dot PHP, dot ID

501
00:25:47.400 --> 00:25:49.799
<v Speaker 2>in the URL. Once you have a suspect URL, you

502
00:25:49.839 --> 00:25:51.359
<v Speaker 2>hand it over to sqlmap.

503
00:25:50.960 --> 00:25:53.279
<v Speaker 1>And sql map automates the attack pretty much.

504
00:25:53.559 --> 00:25:57.680
<v Speaker 2>You tell sql map the target url, squamap iu targeturle.

505
00:25:58.440 --> 00:26:01.839
<v Speaker 2>Then you can ask it to find database dbs, list

506
00:26:01.880 --> 00:26:05.000
<v Speaker 2>tables within a database, dab to dB name tables, list

507
00:26:05.079 --> 00:26:07.720
<v Speaker 2>columns in a table, dire t table name columns, and

508
00:26:07.759 --> 00:26:11.079
<v Speaker 2>finally dump the data WC column one. Call them to

509
00:26:11.160 --> 00:26:12.759
<v Speaker 2>dump or just dump for the whole table.

510
00:26:13.079 --> 00:26:15.920
<v Speaker 1>And the book shows an example pulling usernames and passwords

511
00:26:16.279 --> 00:26:18.279
<v Speaker 1>from an e commerce site settings table.

512
00:26:18.440 --> 00:26:22.079
<v Speaker 2>Yeah, it illustrates how an attacker could potentially extract sensitive

513
00:26:22.119 --> 00:26:25.200
<v Speaker 2>customer data like loging, credentials or even in some cases,

514
00:26:25.240 --> 00:26:28.839
<v Speaker 2>payment details. It highlights why this technique is so dangerous,

515
00:26:29.079 --> 00:26:30.480
<v Speaker 2>especially for online stores.

516
00:26:30.920 --> 00:26:34.599
<v Speaker 1>Beyond screen, the book mentions cross site scripting EXSS. Again,

517
00:26:34.880 --> 00:26:36.160
<v Speaker 1>how does that work? On a website?

518
00:26:36.240 --> 00:26:39.599
<v Speaker 2>AXSS happens when a web application takes untrusted data, often

519
00:26:39.599 --> 00:26:41.640
<v Speaker 2>from a user, and includes it in a web page

520
00:26:41.640 --> 00:26:44.960
<v Speaker 2>without properly encoding it. This allows an attacker to inject

521
00:26:45.039 --> 00:26:48.960
<v Speaker 2>malicious client side scripts, usually JavaScript, into the page. When

522
00:26:49.000 --> 00:26:52.279
<v Speaker 2>another user visits that page, the malicious script runs in

523
00:26:52.279 --> 00:26:54.880
<v Speaker 2>their browser within the context of the trusted website, so.

524
00:26:54.920 --> 00:26:56.519
<v Speaker 1>The website itself delivers the attack.

525
00:26:56.960 --> 00:27:00.519
<v Speaker 2>Essentially, yes, the attacker leverages the trusted site to attack

526
00:27:00.559 --> 00:27:03.319
<v Speaker 2>its users. This can be used to steal session cookies,

527
00:27:03.480 --> 00:27:07.640
<v Speaker 2>hijacking user accounts, redirect users to phishing sites, deface pages,

528
00:27:07.759 --> 00:27:10.640
<v Speaker 2>or install malware. It's very common in damaging.

529
00:27:10.759 --> 00:27:13.319
<v Speaker 1>Then there's DNS poisoning. We touched on this the Internet's

530
00:27:13.359 --> 00:27:15.839
<v Speaker 1>phone book Analogy. How is it exploited?

531
00:27:15.880 --> 00:27:18.319
<v Speaker 2>Practically, the idea is to corrupt the DNS cache on

532
00:27:18.359 --> 00:27:21.559
<v Speaker 2>a DNS server or even on a user's local machine.

533
00:27:21.640 --> 00:27:24.359
<v Speaker 2>You trick it into storing the wrong IP address for

534
00:27:24.400 --> 00:27:27.160
<v Speaker 2>a legitimate domain name. So when a user tries to

535
00:27:27.240 --> 00:27:31.119
<v Speaker 2>go to say, mybank dot com, the poison DNS cash

536
00:27:31.200 --> 00:27:33.680
<v Speaker 2>tells your browser to go to the attacker's fraudulent IP

537
00:27:33.759 --> 00:27:35.119
<v Speaker 2>address instead.

538
00:27:34.880 --> 00:27:37.160
<v Speaker 1>And they end up on a fake lookalike site.

539
00:27:36.920 --> 00:27:40.160
<v Speaker 2>Often yes, a phishing site designed to steal their credentials.

540
00:27:40.400 --> 00:27:43.240
<v Speaker 2>The book shows a practical example using Ettercap, a tool

541
00:27:43.319 --> 00:27:46.759
<v Speaker 2>for network sniffing and MITM attacks. You can figure edttercaps

542
00:27:46.839 --> 00:27:50.319
<v Speaker 2>edited dot DNS file with fake mappings, gmap Facebook dot

543
00:27:50.319 --> 00:27:52.720
<v Speaker 2>Com to a different IP. Then you run an AARP

544
00:27:52.839 --> 00:27:56.359
<v Speaker 2>poisoning attack to intercept the victims traffic and activate Ttercap's

545
00:27:56.400 --> 00:27:57.359
<v Speaker 2>DN spoof plug in.

546
00:27:57.720 --> 00:28:00.680
<v Speaker 1>So Entercap intercepts the DNS request for fur Facebook and

547
00:28:00.759 --> 00:28:03.200
<v Speaker 1>sends back the fake IP address precisely.

548
00:28:03.599 --> 00:28:07.640
<v Speaker 2>The victim's browser then connects to the wrong server, completely unaware.

549
00:28:07.920 --> 00:28:10.680
<v Speaker 2>It undermines trust in basic internet infrastructure.

550
00:28:10.799 --> 00:28:14.079
<v Speaker 1>Okay, let's move into the wireless realm attacking Wi Fi networks.

551
00:28:14.519 --> 00:28:17.519
<v Speaker 1>The book defines them using the IEA eight H two

552
00:28:17.720 --> 00:28:21.160
<v Speaker 1>point one point one standards, routers, access points.

553
00:28:21.279 --> 00:28:24.880
<v Speaker 2>The key takeaway is flexibility comes at a cost. Wireless

554
00:28:24.920 --> 00:28:28.799
<v Speaker 2>signals radiate outwards, making them inherently easier to intercept than

555
00:28:28.880 --> 00:28:32.319
<v Speaker 2>data flowing through a physical cable. An attacker nearby can

556
00:28:32.359 --> 00:28:36.680
<v Speaker 2>potentially capture packets, especially if the network isn't properly secured, and.

557
00:28:36.640 --> 00:28:39.640
<v Speaker 1>Putting a wireless card into monitor mode is key for this.

558
00:28:39.960 --> 00:28:43.559
<v Speaker 2>Yes, normal Wi Fi cards ignore packets not addressed to them.

559
00:28:43.960 --> 00:28:46.440
<v Speaker 2>Monitor mode tells the card to capture all packets flying

560
00:28:46.440 --> 00:28:49.359
<v Speaker 2>through the air on a specific channel, regardless of destination.

561
00:28:50.039 --> 00:28:53.440
<v Speaker 2>This is essential for sniffing and many Wi Fi attacks.

562
00:28:53.519 --> 00:28:57.559
<v Speaker 1>Sniffing men is just capturing and analyzing those packets right.

563
00:28:57.680 --> 00:29:01.200
<v Speaker 2>Using tools like wire shark or TCP. If the traffic

564
00:29:01.240 --> 00:29:05.160
<v Speaker 2>isn't encrypted like old HTTP, you can potentially see sensitive

565
00:29:05.240 --> 00:29:08.720
<v Speaker 2>data like usernames and passwords and plaintext. The book gives

566
00:29:08.759 --> 00:29:11.880
<v Speaker 2>a clear example of logging into a hypothetical HTTP site

567
00:29:11.880 --> 00:29:14.920
<v Speaker 2>techpana dot org while wire shark is running.

568
00:29:14.599 --> 00:29:18.000
<v Speaker 1>And wireshark just displays the captured post request containing the

569
00:29:18.039 --> 00:29:19.240
<v Speaker 1>log in credentials.

570
00:29:19.000 --> 00:29:23.039
<v Speaker 2>Exactly you filter for HTTP traffic, find the post request

571
00:29:23.079 --> 00:29:25.599
<v Speaker 2>associated with the log in and look at the packet details.

572
00:29:26.240 --> 00:29:29.880
<v Speaker 2>Under line based text data or HTML form URL encoded,

573
00:29:30.160 --> 00:29:33.839
<v Speaker 2>you'll see the submitted variables, often including username and password

574
00:29:33.920 --> 00:29:37.440
<v Speaker 2>in cleartext, a stark reminder of why HTTPS is non

575
00:29:37.440 --> 00:29:38.519
<v Speaker 2>negotiable now.

576
00:29:38.319 --> 00:29:42.400
<v Speaker 1>Definitely, so encryption is crucial. The book discusses WP and

577
00:29:42.519 --> 00:29:45.519
<v Speaker 1>WPP two. WP was the first attempt.

578
00:29:45.160 --> 00:29:49.039
<v Speaker 2>Wired equivalent privacy. The goal was to provide confidentiality similar

579
00:29:49.119 --> 00:29:52.319
<v Speaker 2>to a wired network, but it had fundamental cryptographic flaws

580
00:29:52.359 --> 00:29:55.480
<v Speaker 2>and is considered completely broken now easily crackable in minutes.

581
00:29:55.559 --> 00:29:57.920
<v Speaker 1>So WPAI FI pertated Access replaced it.

582
00:29:58.319 --> 00:30:01.680
<v Speaker 2>Yes, WPA was developed as an interim solution to fix

583
00:30:01.880 --> 00:30:07.440
<v Speaker 2>WP's weaknesses. It introduced TKEAP temporal key integrity protocol which

584
00:30:07.519 --> 00:30:10.559
<v Speaker 2>was better but still had some vulnerabilities.

585
00:30:09.839 --> 00:30:11.920
<v Speaker 1>And WPA two is the current standard.

586
00:30:12.319 --> 00:30:16.240
<v Speaker 2>WP two using AES encryption is the standard for strong security.

587
00:30:16.640 --> 00:30:20.839
<v Speaker 2>The booknotes that if you use a strong unique password passphrase,

588
00:30:21.400 --> 00:30:25.160
<v Speaker 2>WPA two is very difficult bordering on practically impossible for

589
00:30:25.200 --> 00:30:28.880
<v Speaker 2>most attackers to crack via brute force. However, if the

590
00:30:28.880 --> 00:30:32.119
<v Speaker 2>password is weak or common found in dictionary lists, it

591
00:30:32.160 --> 00:30:34.920
<v Speaker 2>can still be cracked using tools that capture the authentication

592
00:30:35.039 --> 00:30:37.000
<v Speaker 2>handshake and try passwords.

593
00:30:36.440 --> 00:30:39.400
<v Speaker 1>Offline patients and computing power needed them and a good

594
00:30:39.400 --> 00:30:39.839
<v Speaker 1>word list.

595
00:30:39.920 --> 00:30:43.839
<v Speaker 2>Yeah, but WPA two with a strong key is generally solid.

596
00:30:44.000 --> 00:30:46.440
<v Speaker 1>The book demonstrates a different kind of Wi Fi attack

597
00:30:46.519 --> 00:30:48.920
<v Speaker 1>using weaf of Fisher. This one sounds more like social

598
00:30:49.000 --> 00:30:50.079
<v Speaker 1>engineering mixed with tech.

599
00:30:50.240 --> 00:30:53.559
<v Speaker 2>It's clever with Fisher automated setting up a rogue access

600
00:30:53.599 --> 00:30:56.920
<v Speaker 2>point AP and performing a phishing attack. First, it creates

601
00:30:56.960 --> 00:31:01.559
<v Speaker 2>a fake AP that mimics the target network's name ss

602
00:31:01.160 --> 00:31:05.559
<v Speaker 2>twin exactly. Then it launches a diauthentication attack against the

603
00:31:05.599 --> 00:31:09.599
<v Speaker 2>real AP, kicking all connected clients off the legitimate network.

604
00:31:09.279 --> 00:31:10.599
<v Speaker 1>So everyone gets disconnected.

605
00:31:10.680 --> 00:31:14.480
<v Speaker 2>Yep, And what do devices usually do when disconnected? They

606
00:31:14.519 --> 00:31:18.039
<v Speaker 2>automatically try to reconnect. Wife of Fisher's fake AP is

607
00:31:18.079 --> 00:31:20.839
<v Speaker 2>sitting there looking identical to the real one, ready to

608
00:31:20.920 --> 00:31:21.960
<v Speaker 2>accept their connections.

609
00:31:22.039 --> 00:31:24.200
<v Speaker 1>Ah okay, so they connect to the fake one.

610
00:31:24.319 --> 00:31:27.000
<v Speaker 2>Then what Once a client connects to the fake AP,

611
00:31:27.319 --> 00:31:31.240
<v Speaker 2>Wife of Fisher redirects their web traffic to a phishing page.

612
00:31:31.279 --> 00:31:34.920
<v Speaker 2>This page usually looks like a legitimate router configuration page

613
00:31:35.160 --> 00:31:37.960
<v Speaker 2>or a network log in portal, often saying something like

614
00:31:38.480 --> 00:31:41.599
<v Speaker 2>firmware update required, Please re enter your Wi Fi password

615
00:31:41.640 --> 00:31:42.839
<v Speaker 2>to continue, And.

616
00:31:42.759 --> 00:31:45.000
<v Speaker 1>If the user falls forward and types in.

617
00:31:44.920 --> 00:31:47.480
<v Speaker 2>Their password, Wife of Fisher captures it and displays it

618
00:31:47.559 --> 00:31:51.160
<v Speaker 2>right there in the attacker's terminal. It bypasses cracking the

619
00:31:51.240 --> 00:31:54.119
<v Speaker 2>encryption entirely by tricking the user into giving up the key.

620
00:31:54.519 --> 00:31:58.359
<v Speaker 2>Requires specific hardware, two Wi Fi cards, one supporting monitor

621
00:31:58.400 --> 00:31:59.839
<v Speaker 2>mode and Callie Linux.

622
00:32:00.039 --> 00:32:03.640
<v Speaker 1>Very sneaky okay. Wrapping up with some miscellaneous attacks. Man

623
00:32:03.680 --> 00:32:06.559
<v Speaker 1>in the Middle MITM explain the concept again.

624
00:32:06.839 --> 00:32:10.319
<v Speaker 2>Three players, victim, the server person they think they're talking to,

625
00:32:10.759 --> 00:32:15.119
<v Speaker 2>and the attacker secretly positioned in between, intercepting and potentially

626
00:32:15.160 --> 00:32:19.240
<v Speaker 2>altering the communication. The victim and the legitimate entity are

627
00:32:19.319 --> 00:32:21.359
<v Speaker 2>usually unaware the attacker is there.

628
00:32:21.759 --> 00:32:24.759
<v Speaker 1>Like an invisible eavesdrop or relaying messages.

629
00:32:24.279 --> 00:32:27.279
<v Speaker 2>And possibly changing them. The book gives a phishing example

630
00:32:28.000 --> 00:32:32.359
<v Speaker 2>fake bank email, e fake website. Attacker intercepts credentials, but

631
00:32:32.440 --> 00:32:33.200
<v Speaker 2>it can happen in.

632
00:32:33.160 --> 00:32:35.359
<v Speaker 1>Other ways too, Like on unsecured Wi Fi.

633
00:32:35.599 --> 00:32:38.079
<v Speaker 2>Yes, that's a common one. Attacker connects to the same

634
00:32:38.079 --> 00:32:42.480
<v Speaker 2>public hotspot, uses techniques like ARP spoofing to redirect the

635
00:32:42.559 --> 00:32:45.720
<v Speaker 2>victim's traffic through their machine, allowing them to intercept data,

636
00:32:46.279 --> 00:32:48.279
<v Speaker 2>or man in the browser attacks where malware on the

637
00:32:48.359 --> 00:32:52.119
<v Speaker 2>victim's computer intercepts data before it even gets encrypted by HTTPS.

638
00:32:52.279 --> 00:32:55.440
<v Speaker 1>The book lists seven types of MITM. Let's recap them quickly.

639
00:32:55.640 --> 00:32:59.200
<v Speaker 2>IP spoofing fake in your source IP address, DNS spoofing,

640
00:32:59.279 --> 00:33:03.319
<v Speaker 2>corrupting DNA to redirect traffic httpspoofing, making a fake site

641
00:33:03.400 --> 00:33:07.039
<v Speaker 2>look secures using similar characters in the domain name. SSL

642
00:33:07.119 --> 00:33:13.039
<v Speaker 2>hijacking intercepting supposedly secure SSLTLS traffic, often by stripping encryption

643
00:33:13.319 --> 00:33:17.279
<v Speaker 2>or presenting fake certificates. Email hijacking gaining access to email

644
00:33:17.319 --> 00:33:21.400
<v Speaker 2>accounts to monitor or send fraudulent messages. Wi Fi eavesdropping,

645
00:33:21.559 --> 00:33:24.960
<v Speaker 2>setting up fake hotspots like with a fisher, but maybe

646
00:33:25.000 --> 00:33:28.519
<v Speaker 2>just for listening stealing browser cookies, capturing session cookies to

647
00:33:28.640 --> 00:33:31.160
<v Speaker 2>hijack logged in sessions. It covers a lot of ground

648
00:33:31.200 --> 00:33:31.799
<v Speaker 2>for interception.

649
00:33:31.960 --> 00:33:35.920
<v Speaker 1>It does next. The Zanta Android app, a mobile pen

650
00:33:36.000 --> 00:33:37.440
<v Speaker 1>testing toolkit.

651
00:33:37.200 --> 00:33:41.039
<v Speaker 2>Yeah for rooted Android devices developed by Zimperium. It lets

652
00:33:41.079 --> 00:33:45.240
<v Speaker 2>you perform network scans, vulnerability checks, and various MITM attacks

653
00:33:45.279 --> 00:33:49.119
<v Speaker 2>right from your phone. Things like MC address spoofing, creating

654
00:33:49.160 --> 00:33:54.359
<v Speaker 2>malicious hotspot, session hijacking, capturing downloads, modifying HTTP traffic on

655
00:33:54.400 --> 00:33:58.039
<v Speaker 2>the fly, checking for shell shock, SSL, poodle vulms.

656
00:33:57.799 --> 00:34:00.400
<v Speaker 1>So you get audit network security or simulated time from

657
00:34:00.400 --> 00:34:02.039
<v Speaker 1>a mobile device exactly.

658
00:34:02.160 --> 00:34:05.960
<v Speaker 2>It has modules for changing back addresses, creating tethered hotspots

659
00:34:05.960 --> 00:34:10.400
<v Speaker 2>where you can monitor traffic, steather, edit packets, Z packet editor,

660
00:34:10.719 --> 00:34:16.159
<v Speaker 2>strip SSL, redirect HTTP, replace images and victims browsers, intercept downloads,

661
00:34:16.199 --> 00:34:19.960
<v Speaker 2>insert HTML. Pretty powerful if used ethically for testing.

662
00:34:20.039 --> 00:34:23.519
<v Speaker 1>It also includes password auditing and tools to launch MITM

663
00:34:23.559 --> 00:34:27.599
<v Speaker 1>attacks like ARP or ICNP spoofing directly from the app.

664
00:34:27.760 --> 00:34:30.840
<v Speaker 2>Right It's a serious toolkit in your pocket, emphasizing the

665
00:34:30.880 --> 00:34:32.920
<v Speaker 2>need for mobile security awareness too.

666
00:34:33.280 --> 00:34:36.719
<v Speaker 1>The book includes a funny hack disrupting Internet connections using

667
00:34:36.960 --> 00:34:40.360
<v Speaker 1>ARP spoofing tools like netcut or tuxcut. Yeah.

668
00:34:40.480 --> 00:34:43.679
<v Speaker 2>These tools flood the local network with fake AARP messages,

669
00:34:43.880 --> 00:34:47.559
<v Speaker 2>basically telling devices that the attacker's machine is the router gateway.

670
00:34:47.800 --> 00:34:49.960
<v Speaker 2>Traffic gets sent to the attacker, who just drops it,

671
00:34:50.079 --> 00:34:53.320
<v Speaker 2>effectively cutting off the target's Internet access. The book stresses

672
00:34:53.320 --> 00:34:56.199
<v Speaker 2>ethical use cases like maybe stopping bandwidth hogs on your

673
00:34:56.239 --> 00:34:58.280
<v Speaker 2>own network, and warns against abuse.

674
00:34:58.079 --> 00:35:01.400
<v Speaker 1>And provides setup guides even for running tuxcats safely in

675
00:35:01.440 --> 00:35:02.159
<v Speaker 1>a Linux.

676
00:35:01.920 --> 00:35:04.239
<v Speaker 2>VM, emphasizing safe experimentation.

677
00:35:04.599 --> 00:35:08.480
<v Speaker 1>Finally, DOS attack's denial of service making things unavailable by

678
00:35:08.480 --> 00:35:09.400
<v Speaker 1>overwhelming them.

679
00:35:10.519 --> 00:35:13.079
<v Speaker 2>Flooding a server or network with so much traffic or

680
00:35:13.119 --> 00:35:16.480
<v Speaker 2>so many requests that it can't respond to legitimate users.

681
00:35:16.960 --> 00:35:21.000
<v Speaker 2>DS is the distributed version using a botnet for massive scale.

682
00:35:21.199 --> 00:35:23.440
<v Speaker 1>The book lists several types ping.

683
00:35:23.320 --> 00:35:27.679
<v Speaker 2>Of death sending oversized ICMP packets to crash older systems,

684
00:35:27.760 --> 00:35:31.880
<v Speaker 2>mostly historical now due to patches murpherttech amplification attack using

685
00:35:32.119 --> 00:35:35.440
<v Speaker 2>ICMP echo requests sent to a network's broadcast address, spoofing

686
00:35:35.480 --> 00:35:38.480
<v Speaker 2>the victim's IP as the source. All replies flood the

687
00:35:38.519 --> 00:35:41.400
<v Speaker 2>victim also largely mitigated.

688
00:35:40.920 --> 00:35:43.840
<v Speaker 1>Now buffer overflow. We covered that teardrop.

689
00:35:43.360 --> 00:35:50.400
<v Speaker 2>Attack exploiting TCPIP fragmentation reassembly sending deliberately overlapping packet fragments

690
00:35:50.400 --> 00:35:52.440
<v Speaker 2>to crash the target OS when it tries to put

691
00:35:52.440 --> 00:35:55.880
<v Speaker 2>them back together. SYN attack flooding the target with SYN

692
00:35:55.920 --> 00:35:58.840
<v Speaker 2>packets the first step in a TCP connection, but never

693
00:35:58.920 --> 00:36:02.239
<v Speaker 2>completing the handshake. This ties up the servers resources waiting

694
00:36:02.280 --> 00:36:05.000
<v Speaker 2>for replies that never come, exhausting its connection table.

695
00:36:05.159 --> 00:36:09.559
<v Speaker 1>Still relevant, the book mentions tools like nemesy Land Latierra botnets,

696
00:36:09.719 --> 00:36:11.599
<v Speaker 1>but also emphasizes doss protection.

697
00:36:11.840 --> 00:36:16.960
<v Speaker 2>Crucial protection involves keeping systems patched, using firewalls to block

698
00:36:17.039 --> 00:36:21.400
<v Speaker 2>malicious ips or protocols, configuring routers with access control lists

699
00:36:21.679 --> 00:36:26.679
<v Speaker 2>acls to filter traffic, and employing intrusion detection prevention systems.

700
00:36:27.199 --> 00:36:31.159
<v Speaker 2>For large scale ditaos, specialized mitigation services are often.

701
00:36:30.840 --> 00:36:33.440
<v Speaker 1>Needed, and it provides a practical example of a simple

702
00:36:33.440 --> 00:36:36.679
<v Speaker 1>pin of death using the Windows pin command with large

703
00:36:36.679 --> 00:36:39.480
<v Speaker 1>packet sizes and the infinite flag dense t t DO

704
00:36:39.599 --> 00:36:42.199
<v Speaker 1>six five five hundred and using nemesy.

705
00:36:41.920 --> 00:36:44.639
<v Speaker 2>Just to illustrate the concept. Yeah, showing how flooding can

706
00:36:44.679 --> 00:36:47.920
<v Speaker 2>impact network usage even if it doesn't crash modern systems.

707
00:36:48.000 --> 00:36:49.840
<v Speaker 1>Okay, that brings us to the end of this really

708
00:36:49.880 --> 00:36:53.400
<v Speaker 1>comprehensive deep dive. We've covered a lot, the author's journey,

709
00:36:53.480 --> 00:36:56.480
<v Speaker 1>the core concepts of hacking, the tools, the setup, the

710
00:36:56.519 --> 00:36:59.760
<v Speaker 1>critical importance of recon, and then practical examples across operatings

711
00:36:59.800 --> 00:37:03.159
<v Speaker 1>as web apps, wireless networks, and other attack vectors.

712
00:37:03.480 --> 00:37:05.719
<v Speaker 2>The goal really was to distill the essence of the

713
00:37:05.760 --> 00:37:08.199
<v Speaker 2>book to make you feel well informed about this often

714
00:37:08.239 --> 00:37:12.480
<v Speaker 2>opaque world of cybersecurity. It's a shortcut, hopefully to understanding

715
00:37:12.480 --> 00:37:13.920
<v Speaker 2>the landscape better, and.

716
00:37:13.840 --> 00:37:16.800
<v Speaker 1>It definitely highlights that idea from the book's title. Maybe

717
00:37:16.840 --> 00:37:19.719
<v Speaker 1>security is a myth, or at least a constant process,

718
00:37:19.760 --> 00:37:24.079
<v Speaker 1>not a final state. Understanding how a tax work seems

719
00:37:24.119 --> 00:37:26.920
<v Speaker 1>absolutely fundamental to building any kind of defense.

720
00:37:27.159 --> 00:37:30.480
<v Speaker 2>Couldn't agree more. Knowing the offense informs the defense.

721
00:37:30.760 --> 00:37:33.880
<v Speaker 1>So here's a thought to leave you with in this

722
00:37:33.960 --> 00:37:37.559
<v Speaker 1>world of constant vulnerabilities, where transparency about flaws is maybe

723
00:37:37.599 --> 00:37:40.719
<v Speaker 1>the only way forward. What aspect of your own digital life,

724
00:37:40.760 --> 00:37:43.840
<v Speaker 1>your own security posture, will you look at differently now?

725
00:37:44.360 --> 00:37:47.880
<v Speaker 1>How does knowing about these mechanisms change your perspective? Something

726
00:37:47.880 --> 00:37:50.639
<v Speaker 1>to think about until next time on the deep dive.