WEBVTT

1
00:00:00.080 --> 00:00:03.160
<v Speaker 1>Have you ever wondered what truly goes on behind the

2
00:00:03.200 --> 00:00:06.559
<v Speaker 1>digital curtain? How the very best defenders learn to think

3
00:00:06.639 --> 00:00:11.480
<v Speaker 1>like whoa malicious actors all to keep our online world safer. Today,

4
00:00:11.800 --> 00:00:14.119
<v Speaker 1>we're taking a deep dive into the fascinating realm of

5
00:00:14.160 --> 00:00:18.320
<v Speaker 1>ethical hacking and penetration testing. Our mission to unpack the

6
00:00:18.399 --> 00:00:22.719
<v Speaker 1>core concepts, the practical techniques, and the essential tools that

7
00:00:22.760 --> 00:00:26.879
<v Speaker 1>empower individuals to understand and secure digital systems from the

8
00:00:26.879 --> 00:00:27.559
<v Speaker 1>inside out.

9
00:00:27.640 --> 00:00:30.000
<v Speaker 2>Really yeah, and our guide for this journey is the

10
00:00:30.039 --> 00:00:33.960
<v Speaker 2>comprehensive book Learn Ethical Hacking from Scratch by Zaid Sabi.

11
00:00:34.320 --> 00:00:37.439
<v Speaker 2>What's great is that this resource assumes no prior knowledge.

12
00:00:37.679 --> 00:00:40.119
<v Speaker 2>It offers a truly ground up approach, which makes it

13
00:00:40.119 --> 00:00:41.640
<v Speaker 2>perfect for our exploration today.

14
00:00:41.759 --> 00:00:45.719
<v Speaker 1>Absolutely so, whether you're simply curious about cybersecurity, maybe looking

15
00:00:45.799 --> 00:00:48.799
<v Speaker 1>to fortify your own digital defenses, or just love to

16
00:00:48.920 --> 00:00:51.880
<v Speaker 1>understand how things work at the deepest level, this deep

17
00:00:51.920 --> 00:00:54.079
<v Speaker 1>dive will give you a shortcut to being well informed

18
00:00:54.359 --> 00:00:58.000
<v Speaker 1>and honestly with some truly surprising facts along the way.

19
00:00:58.240 --> 00:01:01.159
<v Speaker 1>Get ready for some illuminating in sites, because we're about

20
00:01:01.159 --> 00:01:05.040
<v Speaker 1>to unpack how ethical hackers learn to protect systems by

21
00:01:05.120 --> 00:01:08.000
<v Speaker 1>understanding how to test their security just like well, real

22
00:01:08.040 --> 00:01:11.799
<v Speaker 1>attackers do. Okay, So the term ethical hacking it almost

23
00:01:11.799 --> 00:01:14.120
<v Speaker 1>sounds like an oxymoron to some people. Could you really

24
00:01:14.159 --> 00:01:16.920
<v Speaker 1>break down for us how hacking can truly be ethical

25
00:01:17.280 --> 00:01:19.799
<v Speaker 1>and what that critical distinction means, especially when we talk

26
00:01:19.799 --> 00:01:21.959
<v Speaker 1>about black hat versus white hat hackers.

27
00:01:22.200 --> 00:01:25.879
<v Speaker 2>Absolutely, it's a good question. At its core, ethical hacking

28
00:01:25.920 --> 00:01:29.040
<v Speaker 2>is about learning to test the security of systems exactly

29
00:01:29.079 --> 00:01:32.519
<v Speaker 2>as real attackers would. But and this is key, with

30
00:01:32.640 --> 00:01:36.959
<v Speaker 2>explicit permission. Always it's all in the service of strengthening

31
00:01:37.000 --> 00:01:39.400
<v Speaker 2>those systems, finding the holes before the bad guys do.

32
00:01:39.840 --> 00:01:43.439
<v Speaker 2>To critical distinction, so we differentiate between black hat hackers

33
00:01:43.439 --> 00:01:46.599
<v Speaker 2>who operate maliciously, you know, for criminal gain or disruption.

34
00:01:47.159 --> 00:01:49.000
<v Speaker 2>Then there are gray hat hackers who kind of blur

35
00:01:49.079 --> 00:01:52.120
<v Speaker 2>the lines, sometimes maybe finding a flaw and disclosing it,

36
00:01:52.159 --> 00:01:54.920
<v Speaker 2>but maybe not always with permission first. And then white

37
00:01:54.959 --> 00:01:57.680
<v Speaker 2>hat hackers, the ethical professionals we're focusing on today. Their

38
00:01:57.719 --> 00:01:59.519
<v Speaker 2>intent is always to secure.

39
00:01:59.439 --> 00:02:02.480
<v Speaker 1>Right, good guys using the same skills exactly.

40
00:02:02.680 --> 00:02:05.560
<v Speaker 2>Yeah, and this raises an important question. Yeah, why should

41
00:02:05.560 --> 00:02:08.960
<v Speaker 2>you listening right now learn about hacking even if you

42
00:02:09.039 --> 00:02:12.680
<v Speaker 2>never intend to be a penetration tester. The fundamental reason

43
00:02:12.800 --> 00:02:16.039
<v Speaker 2>is to truly understand vulnerabilities, you need to know how

44
00:02:16.080 --> 00:02:20.919
<v Speaker 2>things break to build stronger, more resilient defenses. The book

45
00:02:21.120 --> 00:02:24.479
<v Speaker 2>highlights a crucial point here. Any electronic device you interact with,

46
00:02:24.520 --> 00:02:27.680
<v Speaker 2>your phone, your smart TV, your laptop, even web servers

47
00:02:27.680 --> 00:02:31.840
<v Speaker 2>and routers, Yeah, they're all at their heart computers running

48
00:02:31.840 --> 00:02:35.360
<v Speaker 2>operating systems and programs h as. The concepts we're discussing

49
00:02:35.360 --> 00:02:38.479
<v Speaker 2>today are broadly applicable to pretty much anything in your

50
00:02:38.479 --> 00:02:39.199
<v Speaker 2>digital life.

51
00:02:39.280 --> 00:02:41.639
<v Speaker 1>One aspect that really opened my eyes when exploring this

52
00:02:41.879 --> 00:02:45.479
<v Speaker 1>was the absolute necessity of a dedicated lab environment. You

53
00:02:45.479 --> 00:02:48.599
<v Speaker 1>can't just go testing these techniques out on like your

54
00:02:48.639 --> 00:02:49.759
<v Speaker 1>neighbor's WiFi.

55
00:02:49.479 --> 00:02:52.120
<v Speaker 2>Right, Definitely not. That's illegal and unethical. This is where

56
00:02:52.159 --> 00:02:54.639
<v Speaker 2>virtual box comes in. It's a program, it's free, and

57
00:02:54.719 --> 00:02:57.639
<v Speaker 2>allows you to install virtual machines. Think of them as

58
00:02:57.680 --> 00:03:01.639
<v Speaker 2>completely separate, isolated computers inside your main machine. This is

59
00:03:01.680 --> 00:03:05.960
<v Speaker 2>incredibly important for penetration testing because well, first it avoids

60
00:03:06.000 --> 00:03:10.000
<v Speaker 2>needing multiple physical computers, save space and money. And second,

61
00:03:10.439 --> 00:03:14.319
<v Speaker 2>it completely isolates your hacking activities from your main system,

62
00:03:14.560 --> 00:03:18.400
<v Speaker 2>so you can experiment break things, really push the limits.

63
00:03:18.080 --> 00:03:19.960
<v Speaker 1>Without damaging your actual computer.

64
00:03:20.159 --> 00:03:22.759
<v Speaker 2>Exactly, and then you can easily revert back if something

65
00:03:22.759 --> 00:03:25.439
<v Speaker 2>goes wrong, no harm done to your primary setup.

66
00:03:25.599 --> 00:03:28.199
<v Speaker 1>So what does this typical lab look like? What machines

67
00:03:28.240 --> 00:03:29.080
<v Speaker 1>are we talking about?

68
00:03:29.199 --> 00:03:31.199
<v Speaker 2>Yeah? In a typical setup, we work with three main

69
00:03:31.319 --> 00:03:35.439
<v Speaker 2>virtual machines. First, our tacker machine. This usually runs Collie.

70
00:03:35.159 --> 00:03:37.120
<v Speaker 1>Linux Collie, right, I've heard of that.

71
00:03:37.240 --> 00:03:40.879
<v Speaker 2>Yeah. Collie is a specialized distribution of Linux based on Debian.

72
00:03:41.120 --> 00:03:43.759
<v Speaker 2>It comes pre installed with i mean pretty much all

73
00:03:43.759 --> 00:03:47.039
<v Speaker 2>the necessary penetration testing tools you'd need. Running it as

74
00:03:47.039 --> 00:03:49.919
<v Speaker 2>a virtual machine is ideal for isolation, like we said,

75
00:03:50.240 --> 00:03:53.240
<v Speaker 2>and makes it super easy to recover if things go sideways.

76
00:03:53.360 --> 00:03:55.680
<v Speaker 1>Okay, attacker machine Collie. What else?

77
00:03:56.039 --> 00:03:59.919
<v Speaker 2>Then we need victims. Our first victim is usually metasploid.

78
00:04:00.439 --> 00:04:03.639
<v Speaker 2>It's another Linux machine. But here's the crucial detail. It's

79
00:04:03.680 --> 00:04:04.879
<v Speaker 2>designed to be highly.

80
00:04:04.680 --> 00:04:06.879
<v Speaker 1>Vulnerable, ah intentionally weak.

81
00:04:07.120 --> 00:04:12.080
<v Speaker 2>Precisely, it's built specifically for learning penetration testing. It has

82
00:04:12.159 --> 00:04:15.240
<v Speaker 2>numerous known weaknesses built right in for you to practice

83
00:04:15.280 --> 00:04:16.560
<v Speaker 2>finding and exploiting.

84
00:04:16.720 --> 00:04:18.439
<v Speaker 1>Got it, and the second victim.

85
00:04:18.600 --> 00:04:22.199
<v Speaker 2>The second victim is usually a standard Windows machine, maybe

86
00:04:22.199 --> 00:04:25.360
<v Speaker 2>Windows ten or something similar. This is used for scenarios

87
00:04:25.360 --> 00:04:29.240
<v Speaker 2>that mimic a normal user browsing the internet, clicking links,

88
00:04:29.279 --> 00:04:30.319
<v Speaker 2>opening files.

89
00:04:30.079 --> 00:04:33.439
<v Speaker 1>Makes sense simulating a realistic target exactly.

90
00:04:33.680 --> 00:04:38.000
<v Speaker 2>And Microsoft actually offers free virtual machine versions for developers

91
00:04:38.000 --> 00:04:40.639
<v Speaker 2>and testers, which is really convenient for setting up these

92
00:04:40.680 --> 00:04:42.120
<v Speaker 2>realistic attack simulations.

93
00:04:42.160 --> 00:04:45.600
<v Speaker 1>Okay, attacker two victims. What about that recovery feature you

94
00:04:45.639 --> 00:04:46.319
<v Speaker 1>mentioned right.

95
00:04:46.160 --> 00:04:49.639
<v Speaker 2>That's snapshots a core feature of Virtual Box. It becomes

96
00:04:49.680 --> 00:04:53.279
<v Speaker 2>absolutely invaluable. Think of snapshots like instant bookmarks for your

97
00:04:53.319 --> 00:04:54.319
<v Speaker 2>virtual machine.

98
00:04:54.040 --> 00:04:56.439
<v Speaker 1>State, like a safe point in a game, kind of

99
00:04:56.439 --> 00:04:56.639
<v Speaker 1>like that.

100
00:04:56.720 --> 00:04:59.120
<v Speaker 2>Yeah, they allow you to save the exact state of

101
00:04:59.120 --> 00:05:02.040
<v Speaker 2>a virtual machine at any point in time. So let's

102
00:05:02.040 --> 00:05:04.680
<v Speaker 2>say you're trying to exploit and you completely mess up

103
00:05:04.680 --> 00:05:07.519
<v Speaker 2>the victim machine, maybe crash the operating system or something.

104
00:05:07.839 --> 00:05:11.240
<v Speaker 2>If you took a snapshot beforehand, you can instantly revert

105
00:05:11.360 --> 00:05:14.000
<v Speaker 2>right back to that previous working state.

106
00:05:14.560 --> 00:05:17.800
<v Speaker 1>Wow, Okay, that sounds essential for learning It really is.

107
00:05:18.040 --> 00:05:21.079
<v Speaker 2>A common practice is to take a fresh install snapshot

108
00:05:21.439 --> 00:05:24.360
<v Speaker 2>right after setting everything up. Then if an update breaks

109
00:05:24.360 --> 00:05:28.120
<v Speaker 2>something or an experiment goes totally wrong, boom, You're back

110
00:05:28.160 --> 00:05:30.800
<v Speaker 2>to that clean slate in seconds, ready to try again,

111
00:05:31.199 --> 00:05:32.399
<v Speaker 2>no reinstalling needed.

112
00:05:32.480 --> 00:05:35.600
<v Speaker 1>Okay, that makes setting up a lab feel much less daunting. Now,

113
00:05:35.680 --> 00:05:38.680
<v Speaker 1>Collie Linux, I know it has a graphical interface, but

114
00:05:38.720 --> 00:05:40.199
<v Speaker 1>I hear you quickly move past that.

115
00:05:40.399 --> 00:05:43.959
<v Speaker 2>Yeah, Collie has a nice graphical interface. GUI looks familiar

116
00:05:43.959 --> 00:05:46.600
<v Speaker 2>like Windows or macOS. But you're right, you quickly pitt

117
00:05:46.720 --> 00:05:48.399
<v Speaker 2>to the terminal the command line.

118
00:05:48.519 --> 00:05:50.560
<v Speaker 1>Why is that? Why is the terminal so central?

119
00:05:50.720 --> 00:05:53.600
<v Speaker 2>Well, the Linux terminal is just incredibly powerful. It lets

120
00:05:53.720 --> 00:05:56.160
<v Speaker 2>users do far more than the GUI in many cases,

121
00:05:56.480 --> 00:06:00.000
<v Speaker 2>and often it's much easier and quicker for specific tasks

122
00:06:00.079 --> 00:06:00.439
<v Speaker 2>once you.

123
00:06:00.399 --> 00:06:02.839
<v Speaker 1>Get the hang of it, faster than clicking around definitely

124
00:06:02.879 --> 00:06:03.600
<v Speaker 1>for many things.

125
00:06:03.720 --> 00:06:07.920
<v Speaker 2>But more importantly, in many real world penetration tests, you

126
00:06:08.040 --> 00:06:10.879
<v Speaker 2>might only gain access via command prompt on the target,

127
00:06:11.360 --> 00:06:14.360
<v Speaker 2>may through SSH or some other remote shell. If you

128
00:06:14.360 --> 00:06:17.240
<v Speaker 2>don't know the commands, you can't do anything. So mastering

129
00:06:17.240 --> 00:06:21.120
<v Speaker 2>the terminal is absolutely essential for controlling compromise systems effectively.

130
00:06:21.279 --> 00:06:24.199
<v Speaker 1>Makes sense. So what are some basic commands people should know?

131
00:06:24.800 --> 00:06:27.600
<v Speaker 2>Let's touch on a few foundational ones. The al's command,

132
00:06:27.680 --> 00:06:29.879
<v Speaker 2>for instance, it lists files and.

133
00:06:29.839 --> 00:06:32.160
<v Speaker 1>Directories like Dirt and Windows.

134
00:06:32.000 --> 00:06:35.079
<v Speaker 2>Exactly like Dirt and Windows, and you can add options

135
00:06:35.240 --> 00:06:40.439
<v Speaker 2>like ls L gives you a long listing with more detail, permissions, dates, file, sizes, etc.

136
00:06:41.000 --> 00:06:44.160
<v Speaker 2>If you're ever unsure about any command, man which stands

137
00:06:44.160 --> 00:06:46.879
<v Speaker 2>for manual, or just adding help or ad H after

138
00:06:46.920 --> 00:06:48.720
<v Speaker 2>the command, those are your best friends.

139
00:06:48.879 --> 00:06:51.000
<v Speaker 1>Ah built in help yep, they'll.

140
00:06:50.759 --> 00:06:53.240
<v Speaker 2>Give you comprehensive information on how to use almost any command.

141
00:06:53.279 --> 00:06:56.680
<v Speaker 2>It's a critical earning tool and a huge time saver.

142
00:06:56.759 --> 00:06:59.759
<v Speaker 2>Almost a reflex for experienced users is the tab button

143
00:07:00.720 --> 00:07:04.279
<v Speaker 2>for what for autocompletion? Start typing a command or a

144
00:07:04.279 --> 00:07:06.839
<v Speaker 2>file name, Hit tab and the system will try to

145
00:07:06.879 --> 00:07:08.959
<v Speaker 2>complete it for you or show you the possibilities if

146
00:07:09.000 --> 00:07:09.680
<v Speaker 2>there's more than one.

147
00:07:09.800 --> 00:07:12.399
<v Speaker 1>Oh. Nice safe typing and avoids typos.

148
00:07:12.839 --> 00:07:16.480
<v Speaker 2>Huge time saver. Yeah, makes complex commands feel much more intuitive.

149
00:07:16.759 --> 00:07:20.240
<v Speaker 2>Then there's CD for changing directories navigating around the filesystem,

150
00:07:20.399 --> 00:07:23.439
<v Speaker 2>and PUD prints your current working directory so you know

151
00:07:23.480 --> 00:07:26.519
<v Speaker 2>where you are. We also use app to get or

152
00:07:26.600 --> 00:07:29.839
<v Speaker 2>just appt now. Usually that's for managing software, updating the

153
00:07:29.879 --> 00:07:33.279
<v Speaker 2>list of available software, installing new programs, upgrading existing ones.

154
00:07:33.519 --> 00:07:34.399
<v Speaker 2>Keeps your COLLY set.

155
00:07:34.279 --> 00:07:37.920
<v Speaker 1>Up fresh, got it basics covered? Lab set up understood?

156
00:07:38.079 --> 00:07:39.000
<v Speaker 1>Where do we go first?

157
00:07:39.240 --> 00:07:42.199
<v Speaker 2>Okay, with our virtual lab ready, The first frontier and

158
00:07:42.279 --> 00:07:45.639
<v Speaker 2>ethical hacker typically explores is the network itself. You know,

159
00:07:45.680 --> 00:07:49.759
<v Speaker 2>the invisible pathways connecting all our devices. Network penetration testing

160
00:07:49.800 --> 00:07:53.279
<v Speaker 2>could be broadly divided into let's say four main sections.

161
00:07:53.519 --> 00:07:56.360
<v Speaker 2>There's pre connection stuff you do before even connecting, then

162
00:07:56.560 --> 00:07:59.920
<v Speaker 2>gaining access, then post connection what you do once you

163
00:08:00.040 --> 00:08:03.000
<v Speaker 2>are in, and finally detection and security aspects.

164
00:08:03.160 --> 00:08:05.240
<v Speaker 1>Okay, logical steps, and we're starting with wireless.

165
00:08:05.360 --> 00:08:08.959
<v Speaker 2>Yeah, let's focus on wireless networks initially. To start cracking

166
00:08:09.000 --> 00:08:11.839
<v Speaker 2>Wi Fi, you'll first need to get your wireless adapter

167
00:08:11.959 --> 00:08:15.560
<v Speaker 2>properly connected and configured inside your Colli Virtual Machine.

168
00:08:15.560 --> 00:08:18.120
<v Speaker 1>How does that work? The VM is software, the adapter

169
00:08:18.240 --> 00:08:18.800
<v Speaker 1>is hardware.

170
00:08:18.920 --> 00:08:22.759
<v Speaker 2>Good point. This often requires installing the Virtual Box Extension

171
00:08:22.759 --> 00:08:27.360
<v Speaker 2>pack first that enables better USB device support. Then you

172
00:08:27.360 --> 00:08:31.279
<v Speaker 2>can essentially pass through your physical USB Wi Fi adapter

173
00:08:31.680 --> 00:08:34.360
<v Speaker 2>to the COLLIVM so Collie can see it and control

174
00:08:34.399 --> 00:08:37.559
<v Speaker 2>it directly. Not all adapters work well for this, mind you,

175
00:08:37.600 --> 00:08:39.000
<v Speaker 2>some are better than others for hacking.

176
00:08:39.080 --> 00:08:41.639
<v Speaker 1>Okay, so you need the right hardware and setup. Now.

177
00:08:41.679 --> 00:08:45.480
<v Speaker 1>Something fundamental about networks is MSS addresses. You mentioned them earlier.

178
00:08:45.840 --> 00:08:49.600
<v Speaker 1>Every network card has this unique physical static media access

179
00:08:49.600 --> 00:08:52.879
<v Speaker 1>control address right assigned by the manufacturer. Why is the

180
00:08:52.960 --> 00:08:54.320
<v Speaker 1>static identify or important?

181
00:08:54.360 --> 00:08:57.960
<v Speaker 2>Here it's fundamental because MIC addresses are used for device

182
00:08:58.000 --> 00:09:01.240
<v Speaker 2>identification and packet transfer at the very lowest level of

183
00:09:01.240 --> 00:09:04.120
<v Speaker 2>the local network layer two for the technical folks. But

184
00:09:04.200 --> 00:09:07.440
<v Speaker 2>here's the kicker, the surprising part for many. You can

185
00:09:07.480 --> 00:09:08.399
<v Speaker 2>change your MSSEA.

186
00:09:08.519 --> 00:09:09.919
<v Speaker 1>You can change a physical address.

187
00:09:10.159 --> 00:09:13.120
<v Speaker 2>Well, you change what your operating system reports as your

188
00:09:13.240 --> 00:09:16.960
<v Speaker 2>Mac address. It's called spoofing. This allows you to do

189
00:09:17.000 --> 00:09:20.159
<v Speaker 2>a couple of things. You can avoid being easily traced

190
00:09:20.399 --> 00:09:24.279
<v Speaker 2>while performing tests, making your activity less obvious. Or you

191
00:09:24.279 --> 00:09:28.480
<v Speaker 2>could potentially impersonate a legitimate white listed device on a network,

192
00:09:28.799 --> 00:09:33.000
<v Speaker 2>maybe a printer or an authorized laptop to bypass MAAC

193
00:09:33.039 --> 00:09:35.080
<v Speaker 2>filtering security and gain access.

194
00:09:35.360 --> 00:09:40.159
<v Speaker 1>Wow. Okay, so even fundamental identifiers aren't always fixed. That's insightful.

195
00:09:40.320 --> 00:09:42.639
<v Speaker 2>It highlights that many things we assume are fixed in

196
00:09:42.679 --> 00:09:44.360
<v Speaker 2>networking can actually be manipulated.

197
00:09:44.440 --> 00:09:47.639
<v Speaker 1>Okay, so we understand how devices identify themselves and that

198
00:09:47.679 --> 00:09:50.840
<v Speaker 1>we can even spoof that. What's the next step? Listening

199
00:09:50.879 --> 00:09:51.639
<v Speaker 1>in exactly?

200
00:09:51.759 --> 00:09:54.559
<v Speaker 2>The next logical step is to actually listen in on

201
00:09:54.600 --> 00:09:57.759
<v Speaker 2>the digital conversations happening on the airwaves around you, even

202
00:09:57.799 --> 00:09:59.960
<v Speaker 2>if you're not part of the chat. This is packets new.

203
00:10:00.399 --> 00:10:02.399
<v Speaker 1>How do you do that with Wi Fi, you need

204
00:10:02.440 --> 00:10:02.840
<v Speaker 1>to put.

205
00:10:02.720 --> 00:10:06.440
<v Speaker 2>Your Wi Fi card into what's called monitor mode. Normal

206
00:10:06.440 --> 00:10:08.879
<v Speaker 2>Wi Fi mode only pays attention to trafficman for your

207
00:10:08.879 --> 00:10:12.159
<v Speaker 2>device or the network you're connected to. Monitor mode is different.

208
00:10:12.440 --> 00:10:15.360
<v Speaker 2>It allows you to capture any compatible Wi Fi packet

209
00:10:15.360 --> 00:10:18.919
<v Speaker 2>within your physical range, regardless of who it's for, even

210
00:10:18.919 --> 00:10:21.080
<v Speaker 2>if you're not connected to any network at all, like.

211
00:10:21.039 --> 00:10:23.000
<v Speaker 1>A radio scanner for Wi Fi signals.

212
00:10:23.080 --> 00:10:25.639
<v Speaker 2>That's a great analogy. Yeah, And a powerful tool for

213
00:10:25.679 --> 00:10:28.360
<v Speaker 2>this is aero dumping. It's part of the popular air

214
00:10:28.399 --> 00:10:31.600
<v Speaker 2>cracking suite. You're run aero dumping and it starts capturing

215
00:10:31.639 --> 00:10:33.639
<v Speaker 2>all the packets at seas, showing you all the Wi

216
00:10:33.639 --> 00:10:39.279
<v Speaker 2>Fi networks around you, their names, esds, their hardware addresses, bssids,

217
00:10:39.559 --> 00:10:43.120
<v Speaker 2>the channel thereon, the type of encryption they're using, lots

218
00:10:43.120 --> 00:10:43.840
<v Speaker 2>of useful info.

219
00:10:44.000 --> 00:10:46.080
<v Speaker 1>And what do you do with all those captured packets.

220
00:10:46.120 --> 00:10:48.879
<v Speaker 2>Well, aero dumping captures them, often saving them to a file.

221
00:10:49.360 --> 00:10:51.840
<v Speaker 2>Then you can use another tool like the incredibly powerful

222
00:10:51.879 --> 00:10:54.840
<v Speaker 2>wire shark to open that file and analyze the packets

223
00:10:54.840 --> 00:10:55.360
<v Speaker 2>in detail.

224
00:10:55.559 --> 00:10:57.480
<v Speaker 1>Wire Shark that sounds familiar.

225
00:10:57.639 --> 00:11:00.279
<v Speaker 2>It's a standard tool for a network analysis used by

226
00:11:00.320 --> 00:11:03.240
<v Speaker 2>network admins. And security pros alike. It gives you a

227
00:11:03.240 --> 00:11:06.480
<v Speaker 2>graphical view of every single packet, lets you filter, search,

228
00:11:06.559 --> 00:11:10.320
<v Speaker 2>and dissect the traffic, even if the data payload is encrypted.

229
00:11:10.679 --> 00:11:14.399
<v Speaker 2>Just seeing the patterns of communication can sometimes be revealing.

230
00:11:14.120 --> 00:11:18.080
<v Speaker 1>So we can listen. Can we also actively disrupt things?

231
00:11:18.120 --> 00:11:20.320
<v Speaker 1>I read about diuthentication attacks? What are those?

232
00:11:20.480 --> 00:11:24.000
<v Speaker 2>Yes? Absolutely? De Authentication attacks are interesting. They allow you

233
00:11:24.080 --> 00:11:29.799
<v Speaker 2>to selectively disconnect specific devices, or even all devices from

234
00:11:29.799 --> 00:11:32.399
<v Speaker 2>a Wi Fi network. You do this by sending specially

235
00:11:32.399 --> 00:11:35.320
<v Speaker 2>crafted authentication packets that look like they came from the

236
00:11:35.360 --> 00:11:38.759
<v Speaker 2>access point. The router telling the target device you're no

237
00:11:38.799 --> 00:11:40.200
<v Speaker 2>longer authorized, please.

238
00:11:39.919 --> 00:11:42.320
<v Speaker 1>Disconnect, and the device just disconnects.

239
00:11:42.519 --> 00:11:44.919
<v Speaker 2>Usually yes, it obeys the command. Now, this isn't about

240
00:11:44.919 --> 00:11:48.000
<v Speaker 2>gaining access to the network's data yourself. It's purely about disruption.

241
00:11:48.559 --> 00:11:51.080
<v Speaker 2>Or sometimes it's used tactically, as we'll see later.

242
00:11:51.159 --> 00:11:53.799
<v Speaker 1>Okay, disruption. What about tricking people fake networks?

243
00:11:54.159 --> 00:11:57.720
<v Speaker 2>Ah? Yes? Building on that, we learn about setting up

244
00:11:57.759 --> 00:12:01.600
<v Speaker 2>fake access points, often called evil to wins. This involves

245
00:12:01.639 --> 00:12:04.840
<v Speaker 2>creating a rogue Wi Fi network, maybe with the same

246
00:12:04.919 --> 00:12:08.440
<v Speaker 2>name as a legitimate nearby network like airport free Wi

247
00:12:08.559 --> 00:12:10.559
<v Speaker 2>Fi or coffee shop Guests.

248
00:12:10.360 --> 00:12:13.039
<v Speaker 1>To lure people into connecting to your network instead of

249
00:12:13.039 --> 00:12:13.679
<v Speaker 1>the real one.

250
00:12:13.720 --> 00:12:16.960
<v Speaker 2>Precisely, you trick users into connecting, and when they do,

251
00:12:17.080 --> 00:12:20.240
<v Speaker 2>all their Internet traffic flows directly through your Collie machine.

252
00:12:20.559 --> 00:12:24.759
<v Speaker 2>You effectively become their router. Tools like the Manna toolkit

253
00:12:25.120 --> 00:12:27.679
<v Speaker 2>used to be popular for automating this, making it easier

254
00:12:27.720 --> 00:12:29.559
<v Speaker 2>to set up sophisticated fake aps.

255
00:12:29.679 --> 00:12:31.159
<v Speaker 1>And once you're their router.

256
00:12:31.080 --> 00:12:33.200
<v Speaker 2>Once you're the man in the metal, you can capture

257
00:12:33.200 --> 00:12:36.639
<v Speaker 2>and analyze all their unencrypted traffic. Using wire Shark, you

258
00:12:36.639 --> 00:12:39.559
<v Speaker 2>can see websites they visit, maybe capture credentials entered on

259
00:12:39.600 --> 00:12:42.399
<v Speaker 2>insecure sites. It gives you a lot of visibility into

260
00:12:42.399 --> 00:12:43.000
<v Speaker 2>their activity.

261
00:12:43.200 --> 00:12:47.080
<v Speaker 1>That sounds incredibly powerful and quite scary from a user perspective.

262
00:12:47.240 --> 00:12:50.200
<v Speaker 2>It is. It highlights the danger of connecting to unknown

263
00:12:50.240 --> 00:12:51.919
<v Speaker 2>or unsecured Wi Fi networks.

264
00:12:52.159 --> 00:12:57.320
<v Speaker 1>Okay, so disruption observation. Let's talk about actually gaining access

265
00:12:57.360 --> 00:13:01.679
<v Speaker 1>to encrypted networks. Most networks today use WPA two, maybe

266
00:13:01.720 --> 00:13:04.200
<v Speaker 1>WPA three. Now, how do you get the password right?

267
00:13:04.240 --> 00:13:07.320
<v Speaker 2>Getting the key is the main goal for accessing recruited networks.

268
00:13:07.519 --> 00:13:10.000
<v Speaker 2>The strategy depends on the encryption type. For the really

269
00:13:10.039 --> 00:13:14.000
<v Speaker 2>old WBP encryption well, it's fundamental broken. There are attacks

270
00:13:14.039 --> 00:13:16.879
<v Speaker 2>that can recover the wpke relatively quickly, sometimes even if

271
00:13:16.879 --> 00:13:18.840
<v Speaker 2>no one is actively using the network. It's just not

272
00:13:18.879 --> 00:13:19.919
<v Speaker 2>secure at all anymore.

273
00:13:20.279 --> 00:13:22.600
<v Speaker 1>So avoid WEP at all costs.

274
00:13:22.639 --> 00:13:27.039
<v Speaker 2>Absolutely. WPA and especially WPA TOWPA three are much stronger.

275
00:13:27.879 --> 00:13:31.320
<v Speaker 2>The evolution from wp wasn't just about better encryption algorithms.

276
00:13:31.360 --> 00:13:34.679
<v Speaker 2>It was about fixing fundamental flaws in the connection process.

277
00:13:35.080 --> 00:13:38.840
<v Speaker 2>But even WPA two isn't impenetrable yet. These techniques expose

278
00:13:38.960 --> 00:13:41.799
<v Speaker 2>is that even robust encryption can sometimes be bypassed by

279
00:13:41.799 --> 00:13:46.320
<v Speaker 2>exploiting the connection process itself, not necessarily the encryption algorithm directly.

280
00:13:46.440 --> 00:13:49.600
<v Speaker 2>How So, for WPPA two, the main attack focuses on

281
00:13:49.639 --> 00:13:52.759
<v Speaker 2>capturing the handshake. This is a crucial four way exchange

282
00:13:52.759 --> 00:13:55.559
<v Speaker 2>of cryptographic messages that happens only when a device connects

283
00:13:55.639 --> 00:13:56.919
<v Speaker 2>or reconnects to the network.

284
00:13:57.159 --> 00:14:00.679
<v Speaker 1>The handshake contains information related to the passwords exactly.

285
00:14:00.840 --> 00:14:04.039
<v Speaker 2>It doesn't contain the password directly, but it contains information

286
00:14:04.120 --> 00:14:06.759
<v Speaker 2>derived from the password that can be used to verify

287
00:14:06.840 --> 00:14:10.159
<v Speaker 2>if a guest password is correct. So the goal is

288
00:14:10.200 --> 00:14:13.200
<v Speaker 2>to capture that handshake. You just wait for someone to

289
00:14:13.200 --> 00:14:17.559
<v Speaker 2>connect naturally or you can use those do authentication attacks.

290
00:14:17.240 --> 00:14:20.559
<v Speaker 1>We talked about, AH force someone to disconnect.

291
00:14:19.960 --> 00:14:24.840
<v Speaker 2>So they automatically try to reconnect moments later, allowing you

292
00:14:24.919 --> 00:14:28.519
<v Speaker 2>to reliably capture that handshake as they do. It's a

293
00:14:28.559 --> 00:14:30.080
<v Speaker 2>tactical use of the death attack.

294
00:14:30.159 --> 00:14:33.120
<v Speaker 1>Okay, clever, So you've captured the handshake file. Now what

295
00:14:33.440 --> 00:14:35.000
<v Speaker 1>how do you get the actual password?

296
00:14:35.200 --> 00:14:38.240
<v Speaker 2>Now comes the cracking part. The handshake itself doesn't give

297
00:14:38.279 --> 00:14:41.600
<v Speaker 2>you the password. You need to perform an offline brute

298
00:14:41.639 --> 00:14:45.799
<v Speaker 2>force or dictionary attack against the captured handshake data. This

299
00:14:45.879 --> 00:14:48.720
<v Speaker 2>is where tools that generate password possibilities come in, like

300
00:14:48.879 --> 00:14:49.759
<v Speaker 2>crunch Crunch.

301
00:14:49.799 --> 00:14:50.320
<v Speaker 1>What does it do?

302
00:14:50.720 --> 00:14:53.679
<v Speaker 2>Crunch is a flexible tool for creating custom word lists.

303
00:14:54.240 --> 00:14:56.399
<v Speaker 2>You don't just have to use pre made dictionaries of

304
00:14:56.399 --> 00:15:00.240
<v Speaker 2>common passwords. You can tell Crunch, for instance, generate all

305
00:15:00.279 --> 00:15:03.759
<v Speaker 2>possible passwords between eight and ten characters long using only

306
00:15:03.799 --> 00:15:07.120
<v Speaker 2>lowercase letters and the numbers one, two, three, or define

307
00:15:07.159 --> 00:15:08.200
<v Speaker 2>more complex patterns.

308
00:15:08.240 --> 00:15:11.399
<v Speaker 1>So you create massive lists of potential.

309
00:15:10.960 --> 00:15:14.279
<v Speaker 2>Password potentially massive yes. Then you take the captured handshake

310
00:15:14.320 --> 00:15:16.879
<v Speaker 2>file and you feed it, along with your generated word

311
00:15:16.879 --> 00:15:20.039
<v Speaker 2>list or a banner dictionary file into a cracking tool

312
00:15:20.159 --> 00:15:23.679
<v Speaker 2>like air cracking. Air cracking down then tries each password

313
00:15:23.679 --> 00:15:26.840
<v Speaker 2>from the list against the handshake data. If it finds

314
00:15:26.840 --> 00:15:30.320
<v Speaker 2>a password that successfully validates the handshake, you found.

315
00:15:30.159 --> 00:15:32.679
<v Speaker 1>The network key, which really just highlights the importance of

316
00:15:32.720 --> 00:15:36.360
<v Speaker 1>having a strong, complex Wi Fi password absolutely.

317
00:15:36.799 --> 00:15:39.440
<v Speaker 2>The difficulty of cracking depends entirely on the strength and

318
00:15:39.519 --> 00:15:42.279
<v Speaker 2>length of the password. A shirt simple password might be

319
00:15:42.279 --> 00:15:45.600
<v Speaker 2>cracked in minutes or hours, A long, complex, random one

320
00:15:45.600 --> 00:15:49.799
<v Speaker 2>could take years, decades, or even centuries with current technology.

321
00:15:50.080 --> 00:15:53.759
<v Speaker 1>Okay, so that covers gaining access. Now let's talk about

322
00:15:53.759 --> 00:15:56.639
<v Speaker 1>what happens after you're connected to a network. Man in

323
00:15:56.679 --> 00:16:00.320
<v Speaker 1>the middle attacks. You mentioned them with fake aps, but

324
00:16:00.360 --> 00:16:03.279
<v Speaker 1>they apply once you're on a legitimate network too, right.

325
00:16:03.559 --> 00:16:07.279
<v Speaker 2>Yes, Man in the middle or mitm IT attacks are

326
00:16:07.360 --> 00:16:10.480
<v Speaker 2>incredibly powerful. Once you're on the same local network as

327
00:16:10.480 --> 00:16:13.240
<v Speaker 2>your target, maybe you crack the Wi Fi or you

328
00:16:13.279 --> 00:16:16.399
<v Speaker 2>plugged into the same wired network, you can potentially redirect

329
00:16:16.440 --> 00:16:18.559
<v Speaker 2>their traffic through your machine.

330
00:16:18.159 --> 00:16:20.919
<v Speaker 1>So you sit between the target user and the router.

331
00:16:21.440 --> 00:16:25.039
<v Speaker 2>Essentially, yes, you become the invisible intermediary. This allows you

332
00:16:25.080 --> 00:16:28.440
<v Speaker 2>to read, modify, or even drop their network packets, and crucially,

333
00:16:28.440 --> 00:16:31.919
<v Speaker 2>it often allows you to capture sensitive information like usernames

334
00:16:31.919 --> 00:16:33.799
<v Speaker 2>and passwords entered on websites.

335
00:16:33.960 --> 00:16:36.840
<v Speaker 1>How does that redirection actually work? Technically? How do you

336
00:16:36.879 --> 00:16:39.679
<v Speaker 1>trick their computer into sending traffic to you instead of

337
00:16:39.679 --> 00:16:40.399
<v Speaker 1>the real router.

338
00:16:40.720 --> 00:16:43.600
<v Speaker 2>What's fascinating and maybe a bit alarming, is how this

339
00:16:43.759 --> 00:16:47.440
<v Speaker 2>often works due to the inherent simplicity and trust built

340
00:16:47.440 --> 00:16:51.159
<v Speaker 2>into a fundamental network protocol called ARP, the Address Resolution

341
00:16:51.279 --> 00:16:52.279
<v Speaker 2>Protocol ARP.

342
00:16:52.559 --> 00:16:53.279
<v Speaker 1>What's its job?

343
00:16:53.480 --> 00:16:57.039
<v Speaker 2>Think of ARP as the network's local address book. On

344
00:16:57.159 --> 00:17:00.919
<v Speaker 2>local network devices use IP addresses ninety two point one

345
00:17:01.000 --> 00:17:03.360
<v Speaker 2>sixty eight point one one zero zero to talk to

346
00:17:03.399 --> 00:17:05.720
<v Speaker 2>each other, but the actual data transfer at the lowest

347
00:17:05.799 --> 00:17:09.720
<v Speaker 2>level uses those physical MQ addresses we discussed. AARP's job

348
00:17:09.759 --> 00:17:11.559
<v Speaker 2>is simply to ask, hey, who has IP address one

349
00:17:11.599 --> 00:17:13.759
<v Speaker 2>ninety two point one sixty eight point one one zero zero,

350
00:17:13.920 --> 00:17:16.119
<v Speaker 2>Tell me your AMC address, and the device with that

351
00:17:16.200 --> 00:17:20.119
<v Speaker 2>IP responds with its MK. It's designed for efficiency.

352
00:17:19.559 --> 00:17:21.440
<v Speaker 1>But that simplicity makes it vulnerable.

353
00:17:21.480 --> 00:17:24.640
<v Speaker 2>Exactly, It's largely based on trust. There's no built in verification,

354
00:17:25.119 --> 00:17:28.559
<v Speaker 2>so using a technique called ARP spoofing or AIRP poisoning,

355
00:17:28.759 --> 00:17:32.200
<v Speaker 2>your attacking machine can send out unsolicited ARP replies. You

356
00:17:32.279 --> 00:17:34.920
<v Speaker 2>basically tell the target computer, hey, the router's IP address

357
00:17:34.960 --> 00:17:36.640
<v Speaker 2>like one hint two point one six eight point one

358
00:17:36.640 --> 00:17:39.279
<v Speaker 2>point one, that's my MSA address now, and simultaneously you

359
00:17:39.279 --> 00:17:41.359
<v Speaker 2>tell the router, hey, the target's IP address one ninety

360
00:17:41.359 --> 00:17:43.279
<v Speaker 2>two point one six eight point one one zero zero,

361
00:17:43.400 --> 00:17:44.480
<v Speaker 2>that's my MAAC address.

362
00:17:44.519 --> 00:17:46.680
<v Speaker 1>So you trick both of them into sending traffic meant

363
00:17:46.680 --> 00:17:48.680
<v Speaker 1>for each other to you instead.

364
00:17:48.960 --> 00:17:52.720
<v Speaker 2>Precisely you insert yourself into the conversation. Tools like the

365
00:17:52.920 --> 00:17:55.839
<v Speaker 2>MTMF the Man in the Middle framework automate this whole

366
00:17:55.839 --> 00:17:59.960
<v Speaker 2>process beautifully. MITMS performs the AARP poisoning to redirect trap,

367
00:18:00.440 --> 00:18:03.720
<v Speaker 2>and automatically starts various sniffing and attack plugins for you.

368
00:18:04.200 --> 00:18:07.599
<v Speaker 2>The book provides a compelling example using MITMF to capture

369
00:18:07.640 --> 00:18:11.119
<v Speaker 2>usernames and passwords submitted to plane HTTP websites like a

370
00:18:11.160 --> 00:18:14.000
<v Speaker 2>test site called hack dot me. Just by being the

371
00:18:14.119 --> 00:18:16.640
<v Speaker 2>MITM the credentials pop right up on your screen as

372
00:18:16.640 --> 00:18:17.720
<v Speaker 2>the victim logs.

373
00:18:17.400 --> 00:18:20.519
<v Speaker 1>In plan HTTP. That's the key there, right. What about

374
00:18:20.559 --> 00:18:22.000
<v Speaker 1>secure sites HTTPS?

375
00:18:22.200 --> 00:18:25.480
<v Speaker 2>Ah? Yes, that's the big hurdle HTTPS. When you try

376
00:18:25.480 --> 00:18:28.599
<v Speaker 2>an MITM attack on a site using HTTPS, the encryption

377
00:18:28.720 --> 00:18:31.880
<v Speaker 2>kicks in the browser. Expect the valid digital certificate from

378
00:18:31.880 --> 00:18:35.160
<v Speaker 2>the website signed by a trusted authority. Your MITM tool

379
00:18:35.160 --> 00:18:37.240
<v Speaker 2>can't provide that genuine certificate.

380
00:18:36.799 --> 00:18:38.319
<v Speaker 1>So the browser throws up a warning.

381
00:18:38.440 --> 00:18:41.200
<v Speaker 2>Exactly, the user gets a big, scary warning message saying

382
00:18:41.240 --> 00:18:44.240
<v Speaker 2>that connection is in private, the certificate is invalid. Most

383
00:18:44.319 --> 00:18:45.880
<v Speaker 2>users hopefully would back away.

384
00:18:45.720 --> 00:18:48.559
<v Speaker 1>At that point, so HTTTS works. But is there a

385
00:18:48.559 --> 00:18:49.559
<v Speaker 1>way around that warning?

386
00:18:49.799 --> 00:18:51.960
<v Speaker 2>Well, this is where a clever tool called SSL strip

387
00:18:52.000 --> 00:18:55.480
<v Speaker 2>comes in and understanding this is a truly illuminating insight

388
00:18:55.799 --> 00:18:58.799
<v Speaker 2>into how some attacks work. SSL strip works during the

389
00:18:58.839 --> 00:19:02.880
<v Speaker 2>initial connection attempt. If a user types, say example, dot

390
00:19:02.920 --> 00:19:05.400
<v Speaker 2>Com into their browser, the browser might first try to

391
00:19:05.400 --> 00:19:10.319
<v Speaker 2>connect via HTTP before being redirected to the HTTPS. SSL strip,

392
00:19:10.480 --> 00:19:14.160
<v Speaker 2>running on the MITM machine, intercepts that initial HTDP request.

393
00:19:14.480 --> 00:19:17.119
<v Speaker 2>It then connects to the real server over eahttps itself,

394
00:19:17.400 --> 00:19:20.400
<v Speaker 2>but it presents the website back to the victim over PLANEAHTTP.

395
00:19:20.640 --> 00:19:23.200
<v Speaker 1>It strips away the SSLTLS layer.

396
00:19:23.119 --> 00:19:26.000
<v Speaker 2>Effectively yes for the connection between the victim and the attacker.

397
00:19:26.400 --> 00:19:29.079
<v Speaker 2>The victims browser thinks it's talcking HGTP, so it doesn't

398
00:19:29.079 --> 00:19:32.200
<v Speaker 2>expect a certificate and therefore no warning appears, but the

399
00:19:32.240 --> 00:19:34.400
<v Speaker 2>attacker is still getting the data securely from the real

400
00:19:34.440 --> 00:19:36.799
<v Speaker 2>server and decrypting it or passing it along.

401
00:19:36.839 --> 00:19:38.759
<v Speaker 1>Wow, so it downgrades the connection silently.

402
00:19:38.960 --> 00:19:41.640
<v Speaker 2>Yes, it makes sniffing the traffic trivial again, even if

403
00:19:41.680 --> 00:19:46.839
<v Speaker 2>the original site uses HTTPS. Interestingly, MITMF often starts sslstrip

404
00:19:47.039 --> 00:19:50.319
<v Speaker 2>or its successor SSL strip plus for you automatically when

405
00:19:50.319 --> 00:19:50.799
<v Speaker 2>you run it.

406
00:19:50.920 --> 00:19:53.240
<v Speaker 1>That sounds like a huge security hole. Is there a

407
00:19:53.279 --> 00:19:54.880
<v Speaker 1>defense against SSL strip?

408
00:19:55.000 --> 00:19:59.440
<v Speaker 2>Yes, thankfully, there's a crucial limitation that highlights the ongoing

409
00:19:59.480 --> 00:20:05.119
<v Speaker 2>security evolution HSTS, which stends for HTTP strict transport security.

410
00:20:05.400 --> 00:20:09.799
<v Speaker 2>Websites like Google, Facebook, Banks, etc. Use HSTS. They send

411
00:20:09.839 --> 00:20:11.759
<v Speaker 2>a special header to your browser the first time you

412
00:20:11.799 --> 00:20:14.759
<v Speaker 2>connect securely. This header tells you browser, for the next

413
00:20:14.960 --> 00:20:18.519
<v Speaker 2>x months only ever connect to me using HTTPS, never

414
00:20:18.559 --> 00:20:20.400
<v Speaker 2>even try HTTP.

415
00:20:20.039 --> 00:20:22.839
<v Speaker 1>So the browser doesn't even make that initial insecure request

416
00:20:22.880 --> 00:20:25.079
<v Speaker 1>that SSL strip relies on exactly.

417
00:20:25.400 --> 00:20:28.519
<v Speaker 2>The browser has HSTS rules pre loaded for major sites,

418
00:20:28.759 --> 00:20:31.759
<v Speaker 2>and it remembers the HSTS policy for others after the

419
00:20:31.799 --> 00:20:35.200
<v Speaker 2>first visit. This means that on modern browsers, visiting sites

420
00:20:35.240 --> 00:20:39.200
<v Speaker 2>that use HSTS properly, SSL strip is largely ineffective. It's

421
00:20:39.240 --> 00:20:42.119
<v Speaker 2>a great example of security measures evolving to counter new attacks.

422
00:20:42.240 --> 00:20:44.920
<v Speaker 1>Okay, that's reassuring, But what if the target isn't typing

423
00:20:44.920 --> 00:20:47.240
<v Speaker 1>a password. Say they logged into a site yesterday and

424
00:20:47.240 --> 00:20:51.119
<v Speaker 1>click remember Me. They're authenticated by cookies then, right, not passwords.

425
00:20:51.279 --> 00:20:55.000
<v Speaker 2>That's a very important point. Yes, users are often authenticated

426
00:20:55.000 --> 00:20:58.279
<v Speaker 2>for ongoing sessions using cookies, not by re entering their

427
00:20:58.279 --> 00:21:01.039
<v Speaker 2>password every time they click a link, and these cookies

428
00:21:01.079 --> 00:21:03.359
<v Speaker 2>can also be captured during an MITM attack, even over

429
00:21:03.400 --> 00:21:06.880
<v Speaker 2>eahttps if SSL strip is working or if the cookie

430
00:21:06.960 --> 00:21:09.640
<v Speaker 2>wasn't properly secured by the website.

431
00:21:09.119 --> 00:21:11.319
<v Speaker 1>So you grab their session cookie exactly.

432
00:21:11.759 --> 00:21:14.680
<v Speaker 2>The technique is to sniff out those session cookies using

433
00:21:14.759 --> 00:21:18.319
<v Speaker 2>your MITM tools. Then you can take that cookie value

434
00:21:18.640 --> 00:21:21.319
<v Speaker 2>and inject it into your own browser's cookie storage for

435
00:21:21.440 --> 00:21:24.920
<v Speaker 2>that website. If you then visit the website, the server

436
00:21:25.039 --> 00:21:27.880
<v Speaker 2>sees the valid session cookie and thinks you are the

437
00:21:28.039 --> 00:21:29.880
<v Speaker 2>already authenticated.

438
00:21:29.279 --> 00:21:32.000
<v Speaker 1>User, so you can bypass the login process entirely and

439
00:21:32.039 --> 00:21:33.559
<v Speaker 1>just hijack their existing session.

440
00:21:33.680 --> 00:21:36.839
<v Speaker 2>Precisely, you log into their account without ever needing their password.

441
00:21:37.200 --> 00:21:40.599
<v Speaker 2>It's a powerful demonstration of how seemingly innocuous pieces of

442
00:21:40.680 --> 00:21:43.839
<v Speaker 2>data like cookies can hold the keys to a user's

443
00:21:43.839 --> 00:21:46.119
<v Speaker 2>online identity. If not handled securely.

444
00:21:46.200 --> 00:21:49.119
<v Speaker 1>Okay, this MITM stuff is powerful. You mentioned wire Shark

445
00:21:49.160 --> 00:21:51.839
<v Speaker 1>earlier for analyzing captured packets. How does it fit into

446
00:21:51.839 --> 00:21:54.839
<v Speaker 1>this MITM scenario? Is it just for Wi Fi sniffing?

447
00:21:55.119 --> 00:21:58.920
<v Speaker 2>Oh? No, wire shark is essential throughout well. Tools like

448
00:21:59.039 --> 00:22:02.839
<v Speaker 2>MITMF might show you the important stuff like castured passwords automatically.

449
00:22:03.279 --> 00:22:07.319
<v Speaker 2>Wireshort gives you the full raw picture of everything going

450
00:22:07.319 --> 00:22:11.079
<v Speaker 2>through your network interface during the MITM attack. Everything everything,

451
00:22:11.400 --> 00:22:15.640
<v Speaker 2>every DNS request, every HTTP request and response, every weird

452
00:22:15.720 --> 00:22:19.079
<v Speaker 2>protocol you didn't know was running. You select your network

453
00:22:19.079 --> 00:22:22.119
<v Speaker 2>interface in wire shark, the one MITMF is using to

454
00:22:22.160 --> 00:22:25.480
<v Speaker 2>pass traffic, and it logs all the traffic flowing through it.

455
00:22:26.200 --> 00:22:28.880
<v Speaker 2>Then you can use its powerful graphical interface and filtering

456
00:22:28.920 --> 00:22:32.920
<v Speaker 2>capabilities to dissect that traffic. You can filter specifically for

457
00:22:33.039 --> 00:22:37.000
<v Speaker 2>HTTP traffic, or look for packets containing HTTP dot cookie,

458
00:22:37.400 --> 00:22:40.680
<v Speaker 2>or filter for PUST requests which often carry log inform

459
00:22:40.799 --> 00:22:41.319
<v Speaker 2>data so.

460
00:22:41.440 --> 00:22:44.039
<v Speaker 1>You can find credentials or cookies that maybe in my

461
00:22:44.160 --> 00:22:46.559
<v Speaker 1>TMF didn't automatically flag exactly.

462
00:22:46.680 --> 00:22:49.640
<v Speaker 2>Or you can analyze other protocols, troubleshoot why something isn't working,

463
00:22:49.839 --> 00:22:51.880
<v Speaker 2>or just get a much deeper understanding of what's happening

464
00:22:51.920 --> 00:22:54.759
<v Speaker 2>under the hood. It captures everything flowing through that interface,

465
00:22:55.119 --> 00:22:57.799
<v Speaker 2>giving you a comprehensive view, not just the highlights. It's

466
00:22:57.799 --> 00:23:00.640
<v Speaker 2>an indispensable tool for both offense and defense.

467
00:23:00.880 --> 00:23:03.599
<v Speaker 1>Right it seems like understanding these tools is crucial for

468
00:23:03.640 --> 00:23:06.759
<v Speaker 1>anyone serious about security. Okay, let's shift gears a bit.

469
00:23:07.039 --> 00:23:10.079
<v Speaker 1>We've been talking a lot about network level attacks. Let's

470
00:23:10.119 --> 00:23:13.480
<v Speaker 1>move towards gaining direct access to the computer devices themselves.

471
00:23:14.119 --> 00:23:17.359
<v Speaker 1>The book details two main approaches here, server side attacks

472
00:23:17.440 --> 00:23:20.759
<v Speaker 1>versus client side attacks. What's the fundamental difference between those?

473
00:23:20.920 --> 00:23:24.960
<v Speaker 2>Good transition The core difference lies in whether user interaction

474
00:23:25.079 --> 00:23:29.319
<v Speaker 2>is required. Server side attacks target vulnerabilities and software running

475
00:23:29.319 --> 00:23:32.319
<v Speaker 2>on the remote server, the operating system itself or services

476
00:23:32.400 --> 00:23:36.240
<v Speaker 2>like web server, database server, FTP server, etc. The key

477
00:23:36.319 --> 00:23:40.079
<v Speaker 2>here is no user interaction is needed on the target's part.

478
00:23:40.240 --> 00:23:42.400
<v Speaker 1>You just attack the service directly exactly.

479
00:23:42.440 --> 00:23:45.240
<v Speaker 2>You find a flaw, maybe a known vulnerability and an

480
00:23:45.279 --> 00:23:48.759
<v Speaker 2>outdated piece of software, a default password that was never changed,

481
00:23:48.960 --> 00:23:52.839
<v Speaker 2>a misconfiguration, or complex flaws like SQL injection or buffer

482
00:23:52.880 --> 00:23:55.799
<v Speaker 2>overflows will discuss later, and you exploit it directly over

483
00:23:55.839 --> 00:23:59.440
<v Speaker 2>the network, for example, using a framework like metasploit. You

484
00:23:59.480 --> 00:24:02.519
<v Speaker 2>might explore a known backdoor in an old version of

485
00:24:02.559 --> 00:24:06.119
<v Speaker 2>an FTP server like vsftpd to gain full control.

486
00:24:06.359 --> 00:24:09.279
<v Speaker 1>Okay, so that's server side. What about client side?

487
00:24:09.559 --> 00:24:12.680
<v Speaker 2>Client side attacks, on the other hand, do require some

488
00:24:12.880 --> 00:24:17.240
<v Speaker 2>form of user interaction. The vulnerability isn't necessarily on a

489
00:24:17.279 --> 00:24:20.799
<v Speaker 2>server waiting to be attacked. It's often exploited when the

490
00:24:20.920 --> 00:24:24.160
<v Speaker 2>user performs an action like clicking a link exactly like

491
00:24:24.200 --> 00:24:28.119
<v Speaker 2>clicking a malicious link, opening an infected email attachment, installing

492
00:24:28.119 --> 00:24:31.680
<v Speaker 2>a fake software update, maybe even just visiting a compromise

493
00:24:31.759 --> 00:24:37.079
<v Speaker 2>website that exploits a browser vulnerability. Because of this human element,

494
00:24:37.440 --> 00:24:40.839
<v Speaker 2>information gathering about the person, their habits, their interests, the

495
00:24:40.920 --> 00:24:45.000
<v Speaker 2>software they use becomes incredibly important for crafting a successful

496
00:24:45.039 --> 00:24:48.359
<v Speaker 2>client side attack. This is where social engineering really comes

497
00:24:48.400 --> 00:24:48.839
<v Speaker 2>into play.

498
00:24:48.880 --> 00:24:52.119
<v Speaker 1>Okay, service side targets the machine software. Client side often

499
00:24:52.160 --> 00:24:55.920
<v Speaker 1>targets the user's actions. You mentioned metasploit again, it sounds

500
00:24:55.920 --> 00:24:58.000
<v Speaker 1>like a key tool. Can you elaborate on it.

501
00:24:58.079 --> 00:25:02.039
<v Speaker 2>Metasplate is huge. It's arguably the most widely used framework

502
00:25:02.039 --> 00:25:04.880
<v Speaker 2>for penetration testing and exploit development. Think of it as

503
00:25:04.920 --> 00:25:08.960
<v Speaker 2>a massive toolkit and database for finding, crafting, and launching exploits.

504
00:25:09.000 --> 00:25:09.880
<v Speaker 1>How is it structured.

505
00:25:10.079 --> 00:25:14.079
<v Speaker 2>It's organized into various components or modules. You have exploits,

506
00:25:14.480 --> 00:25:17.400
<v Speaker 2>which are the actual pieces of code that take advantage

507
00:25:17.440 --> 00:25:21.200
<v Speaker 2>of a specific vulnerability in a system or application. There

508
00:25:21.200 --> 00:25:25.160
<v Speaker 2>are thousands of exploits in metasploit for all sorts of software. Then,

509
00:25:25.720 --> 00:25:29.799
<v Speaker 2>once an exploit successfully breaches a system, it typically delivers

510
00:25:29.839 --> 00:25:30.319
<v Speaker 2>a payload.

511
00:25:30.519 --> 00:25:31.680
<v Speaker 1>Payloads What are they?

512
00:25:31.799 --> 00:25:34.960
<v Speaker 2>Payloads are the small pieces of malicious code that actually

513
00:25:35.000 --> 00:25:38.039
<v Speaker 2>execute on the target after the vulnerability has been exploited.

514
00:25:38.680 --> 00:25:40.720
<v Speaker 2>They define what you want to do once you get in.

515
00:25:41.039 --> 00:25:43.279
<v Speaker 2>Do you want a simple command show? Do you want

516
00:25:43.319 --> 00:25:46.920
<v Speaker 2>a more advanced remote control agent? That's what the payload determines.

517
00:25:46.960 --> 00:25:48.559
<v Speaker 1>Are there different tins of payloads?

518
00:25:48.640 --> 00:25:51.000
<v Speaker 2>Yes. Broadly speaking, there are two main types, based on

519
00:25:51.039 --> 00:25:54.839
<v Speaker 2>how the connection is established. Bind payloads. These open a

520
00:25:54.880 --> 00:25:57.839
<v Speaker 2>specific network port on the target machine, listening for an

521
00:25:57.880 --> 00:26:01.680
<v Speaker 2>incoming connection. The attack then connects to the compromise target.

522
00:26:01.720 --> 00:26:04.359
<v Speaker 1>Okay, the target listens, the attacker connects.

523
00:26:04.079 --> 00:26:07.160
<v Speaker 2>Right, but that often gets blocked by firewalls protecting the

524
00:26:07.200 --> 00:26:10.319
<v Speaker 2>target machine because figure walls are usually configured to block

525
00:26:10.400 --> 00:26:14.279
<v Speaker 2>unexpected incoming connections. So the other type is often more

526
00:26:14.319 --> 00:26:16.119
<v Speaker 2>effective reverse.

527
00:26:15.759 --> 00:26:19.720
<v Speaker 1>Payloads reverse, so the target connects back to the attacker exactly.

528
00:26:20.079 --> 00:26:23.319
<v Speaker 2>The payload on the target machine initiates an outgoing connection

529
00:26:23.519 --> 00:26:26.359
<v Speaker 2>back to a listening port on the attacker's machine.

530
00:26:26.400 --> 00:26:28.200
<v Speaker 1>Why is that more powerful.

531
00:26:27.960 --> 00:26:31.279
<v Speaker 2>Because firewalls are typically much more permissive at allowing outgoing

532
00:26:31.319 --> 00:26:34.319
<v Speaker 2>connections from the machines they protect. People need to browse

533
00:26:34.359 --> 00:26:37.640
<v Speaker 2>the web, check email, et cetera. So an outgoing connection

534
00:26:37.680 --> 00:26:41.799
<v Speaker 2>from the target back to the attacker often bypasses firewall rules.

535
00:26:42.079 --> 00:26:45.359
<v Speaker 1>Clever sneaking out instead of breaking in precisely.

536
00:26:45.680 --> 00:26:49.440
<v Speaker 2>For example, using a payload like Windows mitrepre reverse TTP,

537
00:26:49.640 --> 00:26:53.000
<v Speaker 2>or reverse TTPs is very common. These make the backdoor

538
00:26:53.039 --> 00:26:56.200
<v Speaker 2>connection look like standard web traffic using ports eighty or

539
00:26:56.200 --> 00:26:59.000
<v Speaker 2>four to forty three, making it even harder to detect

540
00:26:59.039 --> 00:27:00.720
<v Speaker 2>amongst legitimate web browsing.

541
00:27:00.960 --> 00:27:03.559
<v Speaker 1>Interpreter is that a specific type of payload.

542
00:27:03.920 --> 00:27:08.440
<v Speaker 2>Yes, Interpreter is an advanced payload within metasploit. Instead of

543
00:27:08.480 --> 00:27:11.039
<v Speaker 2>just giving you a basic command shell, it provides a

544
00:27:11.079 --> 00:27:14.839
<v Speaker 2>powerful extensible command and control agent with lots of built

545
00:27:14.839 --> 00:27:18.079
<v Speaker 2>in capabilities for post exploitation, which we'll get to later.

546
00:27:18.240 --> 00:27:21.559
<v Speaker 1>Okay, metasploit sounds critical Before you can exploit though you

547
00:27:21.599 --> 00:27:26.359
<v Speaker 1>need to find vulnerabalities, how do ethical hackers scan for weaknesses?

548
00:27:26.839 --> 00:27:30.119
<v Speaker 2>Right? Reconnaissance and scanning are crucial first steps. You need

549
00:27:30.160 --> 00:27:31.920
<v Speaker 2>to know what doors are open before you try to

550
00:27:31.960 --> 00:27:35.599
<v Speaker 2>pick the locks. There are various tools. One approach integrated

551
00:27:35.599 --> 00:27:39.720
<v Speaker 2>with metaploit itself is using MSFC, the Metaploit Community Interface

552
00:27:39.799 --> 00:27:43.279
<v Speaker 2>or similar commercial versions. This provides a web based UI

553
00:27:43.359 --> 00:27:45.880
<v Speaker 2>for metaploit. You can point it at a target IP

554
00:27:46.000 --> 00:27:48.839
<v Speaker 2>address or range and it will perform scans to discover

555
00:27:48.960 --> 00:27:51.880
<v Speaker 2>open ports, identify the services running on those ports like

556
00:27:51.880 --> 00:27:55.519
<v Speaker 2>web server, FTP, SSH, and often even identify the specific

557
00:27:55.559 --> 00:27:56.400
<v Speaker 2>software versions.

558
00:27:56.440 --> 00:27:58.519
<v Speaker 1>And it links those findings to exploits.

559
00:27:58.880 --> 00:28:02.000
<v Speaker 2>Yes, that's the really useful part. It often maps the

560
00:28:02.039 --> 00:28:05.920
<v Speaker 2>discovered services and versions directly to known exploits available within

561
00:28:05.960 --> 00:28:10.400
<v Speaker 2>the metasploid framework. In some cases, for well known vulnerabilities

562
00:28:10.400 --> 00:28:14.319
<v Speaker 2>on unpatched systems like our Metasploitable Victim machine, it might

563
00:28:14.400 --> 00:28:18.400
<v Speaker 2>even allow for one click exploitation directly from the web interface.

564
00:28:18.640 --> 00:28:19.880
<v Speaker 1>Makes it sound easy.

565
00:28:20.079 --> 00:28:23.480
<v Speaker 2>For known simple vulnerabilities, it can be, but real world

566
00:28:23.519 --> 00:28:26.519
<v Speaker 2>systems are often more complex and patched. That's where more

567
00:28:26.559 --> 00:28:30.000
<v Speaker 2>advanced scanners come in. Like Nextpose from rapid seven, who

568
00:28:30.000 --> 00:28:32.799
<v Speaker 2>also manage metasploit or nessis from tenable.

569
00:28:32.920 --> 00:28:34.319
<v Speaker 1>How is next pose different?

570
00:28:34.880 --> 00:28:38.720
<v Speaker 2>Nextpose is a more comprehensive vulnerability management framework. It goes

571
00:28:38.759 --> 00:28:42.720
<v Speaker 2>beyond just finding open ports and services. It performs deeper scans,

572
00:28:43.079 --> 00:28:47.119
<v Speaker 2>identifies vulnerabilities with associated risk scores, and crucially, it often

573
00:28:47.160 --> 00:28:50.680
<v Speaker 2>attempts to enumerate all installed software on the target system,

574
00:28:50.799 --> 00:28:52.079
<v Speaker 2>not just network services.

575
00:28:52.160 --> 00:28:54.400
<v Speaker 1>Why is knowing all installed software.

576
00:28:54.039 --> 00:28:57.880
<v Speaker 2>Important because sometimes the initial exploit only gives you limited access.

577
00:28:58.559 --> 00:29:01.400
<v Speaker 2>Knowing about other software installed on the machine might reveal

578
00:29:01.480 --> 00:29:05.960
<v Speaker 2>opportunities for local privilege escalation, using a flaw in a

579
00:29:06.000 --> 00:29:09.039
<v Speaker 2>locally installed program to gain higher administrative rights after you've

580
00:29:09.039 --> 00:29:13.319
<v Speaker 2>already got a foothold. Nexpose also generates much more detailed

581
00:29:13.319 --> 00:29:16.799
<v Speaker 2>and professional reports, which are essential for documenting findings in

582
00:29:16.839 --> 00:29:18.359
<v Speaker 2>a professional penetration test.

583
00:29:18.799 --> 00:29:22.440
<v Speaker 1>Okay, so scanning finds potential entry points. But what if

584
00:29:22.440 --> 00:29:25.680
<v Speaker 1>the target is well protected no obvious server side flaws.

585
00:29:26.359 --> 00:29:29.440
<v Speaker 1>That's when client side attacks and social engineering come back in.

586
00:29:29.720 --> 00:29:32.720
<v Speaker 2>Exactly when direct server side attacks fail, or maybe the

587
00:29:32.720 --> 00:29:36.079
<v Speaker 2>target isn't even directly reachable on the network behind multiple

588
00:29:36.160 --> 00:29:39.880
<v Speaker 2>layers of firewalls, client side attacks become the primary vector,

589
00:29:40.559 --> 00:29:43.799
<v Speaker 2>and these almost always involve some element of social engineering

590
00:29:44.200 --> 00:29:45.680
<v Speaker 2>manipulating the human user.

591
00:29:45.839 --> 00:29:48.160
<v Speaker 1>How do you make malware that works for this? Doesn't

592
00:29:48.160 --> 00:29:49.839
<v Speaker 1>antivirus catch most things?

593
00:29:50.039 --> 00:29:54.079
<v Speaker 2>Antivirus is a challenge, definitely. That's where tools like Veil Evasion,

594
00:29:54.279 --> 00:29:57.319
<v Speaker 2>now part of the larger Veil framework, become relevant. Veil

595
00:29:57.440 --> 00:30:01.839
<v Speaker 2>was specifically designed to generate payloads metasploit payloads in ways

596
00:30:01.839 --> 00:30:06.160
<v Speaker 2>that attempt to evade detection by common antivirus solutions. It

597
00:30:06.279 --> 00:30:10.880
<v Speaker 2>uses various techniques like encryption, code obfuscation, and different programming

598
00:30:10.960 --> 00:30:11.720
<v Speaker 2>language wrappers.

599
00:30:11.880 --> 00:30:15.119
<v Speaker 1>So you use VEIL to create an undetectable backdoor.

600
00:30:14.799 --> 00:30:17.240
<v Speaker 2>That's the goal. Yes, you use VEIL to generate a

601
00:30:17.279 --> 00:30:21.319
<v Speaker 2>malicious executable file, maybe backdoor, dot exe or something more

602
00:30:21.359 --> 00:30:25.039
<v Speaker 2>convincingly named. This file contains your chosen payload, like a

603
00:30:25.079 --> 00:30:27.920
<v Speaker 2>reverse interpreter shell. Then you need to get the user

604
00:30:27.960 --> 00:30:30.519
<v Speaker 2>to run that file. While Veil tries to handle the

605
00:30:30.559 --> 00:30:34.000
<v Speaker 2>antivirus evation, you still need the social engineering part, and

606
00:30:34.119 --> 00:30:37.240
<v Speaker 2>on your end you set up metasploits multi handler exploit

607
00:30:37.319 --> 00:30:40.319
<v Speaker 2>multi handler to listen for the incoming connection from that

608
00:30:40.359 --> 00:30:42.119
<v Speaker 2>back door. Once the victim runs.

609
00:30:41.960 --> 00:30:44.759
<v Speaker 1>It, right, the social engineering part how deep does that go?

610
00:30:45.119 --> 00:30:48.279
<v Speaker 2>It can go very deep. At its heart, social engineering

611
00:30:48.359 --> 00:30:51.880
<v Speaker 2>is the art or maybe science, of manipulating people to

612
00:30:51.960 --> 00:30:56.000
<v Speaker 2>perform actions they shouldn't or divulge confidential information. This is

613
00:30:56.039 --> 00:30:59.559
<v Speaker 2>where detailed information gathering about the person or the organization

614
00:31:00.000 --> 00:31:03.400
<v Speaker 2>it really shines. You need to understand your target to

615
00:31:03.480 --> 00:31:05.119
<v Speaker 2>craft a believable pretext.

616
00:31:05.240 --> 00:31:07.519
<v Speaker 1>What tools help with gathering info on people?

617
00:31:07.799 --> 00:31:11.000
<v Speaker 2>Maltago is a classic and incredibly powerful tool for open

618
00:31:11.000 --> 00:31:14.440
<v Speaker 2>source intelligence gathering oh SINT. You start with a piece

619
00:31:14.440 --> 00:31:17.039
<v Speaker 2>of information, maybe a Poston's name and email address, a

620
00:31:17.079 --> 00:31:21.799
<v Speaker 2>company name, a website, and Maultago automatically queries numerous public

621
00:31:21.880 --> 00:31:26.200
<v Speaker 2>data sources, search engines, social media, DNS records, whose databases, etc.

622
00:31:26.839 --> 00:31:30.119
<v Speaker 2>To find related information. It then visually maps out the

623
00:31:30.119 --> 00:31:33.839
<v Speaker 2>connections between people, websites, companies, email addresses, phone numbers, social

624
00:31:33.839 --> 00:31:37.799
<v Speaker 2>media profiles like Twitter, LinkedIn Facebook documents they've shared. It

625
00:31:37.839 --> 00:31:40.440
<v Speaker 2>can build a very detailed picture from publicly available data.

626
00:31:40.480 --> 00:31:42.640
<v Speaker 1>So you use Multago to find out about your target,

627
00:31:43.240 --> 00:31:44.640
<v Speaker 1>then what then you use.

628
00:31:44.599 --> 00:31:48.279
<v Speaker 2>That information to build a plausible attack strategy or pretext.

629
00:31:48.920 --> 00:31:52.400
<v Speaker 2>For example, if Maltago shows your target works at company

630
00:31:52.640 --> 00:31:56.319
<v Speaker 2>X and frequently uses say WordPress. You might craft an

631
00:31:56.319 --> 00:31:59.319
<v Speaker 2>attack pretending to be from WordPress support, offering them a

632
00:31:59.359 --> 00:32:02.279
<v Speaker 2>link to download a new beta security plug in, which

633
00:32:02.319 --> 00:32:04.799
<v Speaker 2>is actually your veil generated.

634
00:32:04.359 --> 00:32:08.240
<v Speaker 1>Back door ah, making it relevant and seem legitimate exactly.

635
00:32:08.440 --> 00:32:11.519
<v Speaker 2>The more tailored and believable the pretext, the higher the

636
00:32:11.599 --> 00:32:15.160
<v Speaker 2>chance of success. Other practical techniques include things like changing

637
00:32:15.160 --> 00:32:17.559
<v Speaker 2>the icon of your back door executable to make it

638
00:32:17.559 --> 00:32:20.240
<v Speaker 2>look like a harmless file like a PDF or an image.

639
00:32:20.599 --> 00:32:23.160
<v Speaker 2>Tools like auto it can help compile scripts that drop

640
00:32:23.200 --> 00:32:25.519
<v Speaker 2>and run the real back door while maybe displaying a

641
00:32:25.559 --> 00:32:26.480
<v Speaker 2>decoy document so.

642
00:32:26.480 --> 00:32:28.720
<v Speaker 1>It looks like they opened a picture, but malware runs

643
00:32:28.720 --> 00:32:30.079
<v Speaker 1>in the background precisely.

644
00:32:30.359 --> 00:32:32.960
<v Speaker 2>There's even a trick. Using a special Unicode character called

645
00:32:32.960 --> 00:32:36.480
<v Speaker 2>the right to left override RL character, you can name

646
00:32:36.519 --> 00:32:40.880
<v Speaker 2>a file something like report augustrlo cod dot ex in

647
00:32:40.960 --> 00:32:43.759
<v Speaker 2>Windows Explore. The ROL character reverses the order of the

648
00:32:43.839 --> 00:32:46.000
<v Speaker 2>characters that follow it, so the file name might appear

649
00:32:46.000 --> 00:32:50.000
<v Speaker 2>as report agustext dot dios hiding thereal dot ex extension

650
00:32:50.079 --> 00:32:51.680
<v Speaker 2>can fool less cautious users.

651
00:32:51.960 --> 00:32:53.680
<v Speaker 1>Wow, that's sneaky, it is.

652
00:32:54.200 --> 00:32:57.920
<v Speaker 2>And another potent technique is email spoofing, sending an email

653
00:32:58.000 --> 00:33:00.400
<v Speaker 2>that appears to come from someone the target nos and

654
00:33:00.480 --> 00:33:04.400
<v Speaker 2>trust their boss, a colleague, a friend. If the email

655
00:33:04.400 --> 00:33:07.799
<v Speaker 2>looks legitimate and comes from a trusted source, the target

656
00:33:07.839 --> 00:33:10.359
<v Speaker 2>is far more likely to click a link or open

657
00:33:10.359 --> 00:33:12.240
<v Speaker 2>an attachment containing your back door.

658
00:33:12.559 --> 00:33:15.599
<v Speaker 1>It really underscores how much trust we place in digital

659
00:33:15.599 --> 00:33:18.000
<v Speaker 1>communications and how that trust can be exploited.

660
00:33:18.200 --> 00:33:21.519
<v Speaker 2>Absolutely, the human element is often the weakest link in

661
00:33:21.559 --> 00:33:22.519
<v Speaker 2>the security chain.

662
00:33:22.720 --> 00:33:26.240
<v Speaker 1>Okay, let's explore another angle of client side attacks. What

663
00:33:26.319 --> 00:33:29.440
<v Speaker 1>if the target doesn't download or run anything, but simply

664
00:33:29.480 --> 00:33:32.599
<v Speaker 1>browses a webpage you control or have compromised. Can you

665
00:33:32.640 --> 00:33:33.960
<v Speaker 1>attack them through their browser?

666
00:33:34.519 --> 00:33:37.240
<v Speaker 2>Yes? Definitely. This is where the BEEF tool comes in.

667
00:33:37.279 --> 00:33:41.359
<v Speaker 2>BEEF stands for the Browser Exploitation Framework Browser exploitation.

668
00:33:41.480 --> 00:33:42.400
<v Speaker 1>How does that work?

669
00:33:42.599 --> 00:33:46.119
<v Speaker 2>BEEF allows you to hook a target's web browser and

670
00:33:46.160 --> 00:33:49.799
<v Speaker 2>then run various commands and attacks directly within their browser context,

671
00:33:50.039 --> 00:33:51.799
<v Speaker 2>often without them noticing immediately.

672
00:33:51.839 --> 00:33:53.400
<v Speaker 1>How do you hook their browser?

673
00:33:53.720 --> 00:33:56.640
<v Speaker 2>A target browser becomes hooked when it executes a small

674
00:33:56.640 --> 00:34:00.640
<v Speaker 2>piece of JavaScript code provided by BEEF. You can achieve

675
00:34:00.680 --> 00:34:03.519
<v Speaker 2>this in several ways. You could embed this JavaScript hook

676
00:34:03.880 --> 00:34:06.799
<v Speaker 2>into a web page you control, maybe even a blank page.

677
00:34:07.119 --> 00:34:10.119
<v Speaker 2>Then you use social engineering. Heycheck out this cool site

678
00:34:10.320 --> 00:34:13.880
<v Speaker 2>or perhaps DNS spoofing during an MITM attack to redirect

679
00:34:13.880 --> 00:34:16.840
<v Speaker 2>the victim to your page containing the hook. Or if

680
00:34:16.880 --> 00:34:20.000
<v Speaker 2>you find a cross site scripting EXSS vulnerability on a

681
00:34:20.039 --> 00:34:23.000
<v Speaker 2>legitimate website. We'll talk more about XSS later, you could

682
00:34:23.039 --> 00:34:26.119
<v Speaker 2>inject the beef hook script there, hooking anyone who visits

683
00:34:26.159 --> 00:34:27.760
<v Speaker 2>the compromise legitimate page.

684
00:34:27.920 --> 00:34:30.840
<v Speaker 1>Okay, so their browser runs your JavaScript hook. What can

685
00:34:30.880 --> 00:34:32.039
<v Speaker 1>you do then? Via beef?

686
00:34:32.360 --> 00:34:35.360
<v Speaker 2>Once a browser is hooked, Beef offers a surprisingly vast

687
00:34:35.440 --> 00:34:38.199
<v Speaker 2>array of commands and modules, all controlled from your attack

688
00:34:38.280 --> 00:34:42.039
<v Speaker 2>or interface. You can gather information what browser and version

689
00:34:42.079 --> 00:34:45.039
<v Speaker 2>are they using, what plugins are installed like Flash, Java

690
00:34:45.079 --> 00:34:48.199
<v Speaker 2>often vulnerable. What's the internal IP address of their computer?

691
00:34:48.519 --> 00:34:50.960
<v Speaker 2>What other websites do they have open in other tabs?

692
00:34:51.039 --> 00:34:53.519
<v Speaker 2>Can you grab cookies for the current site.

693
00:34:53.360 --> 00:34:55.320
<v Speaker 1>Just from them visiting a page if it's.

694
00:34:55.159 --> 00:34:58.679
<v Speaker 2>Hooked, Yes, and then you can launch browser based attacks.

695
00:34:59.000 --> 00:35:02.039
<v Speaker 2>You can display fake notification pop ups you do install

696
00:35:02.079 --> 00:35:05.280
<v Speaker 2>this update, you can execute arbitrary JavaScript in their browser.

697
00:35:05.559 --> 00:35:07.960
<v Speaker 2>You can attempt to redirect their browser to other malicious

698
00:35:08.000 --> 00:35:12.400
<v Speaker 2>sites or fake login pages. There's a particularly nasty module

699
00:35:12.400 --> 00:35:16.079
<v Speaker 2>called pretty theft. It can display very convincing fake login

700
00:35:16.199 --> 00:35:19.239
<v Speaker 2>pop ups that float over the current page asking for

701
00:35:19.320 --> 00:35:24.239
<v Speaker 2>credentials for sites like Facebook, LinkedIn, Gmail, generic webmail, hoping

702
00:35:24.239 --> 00:35:26.719
<v Speaker 2>the user will type their password into your fake box.

703
00:35:26.960 --> 00:35:29.599
<v Speaker 1>Wow, that's purely social engineering within.

704
00:35:29.480 --> 00:35:32.719
<v Speaker 2>The browser exactly. But BEEF can go even further. It

705
00:35:32.719 --> 00:35:35.679
<v Speaker 2>can act as a stepping stone to gain full system access.

706
00:35:36.199 --> 00:35:38.920
<v Speaker 2>There are modules designed to, for example, display a fake

707
00:35:39.000 --> 00:35:41.679
<v Speaker 2>notification bar at the top of the browser window, maybe

708
00:35:41.719 --> 00:35:44.480
<v Speaker 2>mimicking a flash update or a browser plugin update. If

709
00:35:44.480 --> 00:35:46.400
<v Speaker 2>the user clicks install update.

710
00:35:46.239 --> 00:35:47.880
<v Speaker 1>It downloads and runs your back door.

711
00:35:48.039 --> 00:35:52.039
<v Speaker 2>Precisely, BEEF can serve up your veil generated executable, tricking

712
00:35:52.039 --> 00:35:54.440
<v Speaker 2>the user into installing it, and if they do, boom,

713
00:35:54.480 --> 00:35:56.920
<v Speaker 2>you get a full mature procession back give you complete

714
00:35:56.920 --> 00:35:59.000
<v Speaker 2>control over their computer, not just their browser.

715
00:35:59.280 --> 00:36:02.000
<v Speaker 1>It's truly by opening how a simple web browser, something

716
00:36:02.039 --> 00:36:05.239
<v Speaker 1>we use constantly can become such a powerful attack factor.

717
00:36:05.480 --> 00:36:09.360
<v Speaker 2>It really is browser security. Keeping it updated and being

718
00:36:09.400 --> 00:36:12.079
<v Speaker 2>cautious about what you click are incredibly important.

719
00:36:12.119 --> 00:36:15.679
<v Speaker 1>Okay, this is all fascinating, but so far everything we've discussed,

720
00:36:15.679 --> 00:36:18.119
<v Speaker 1>the lab set up, the network attacks, the client side

721
00:36:18.159 --> 00:36:21.119
<v Speaker 1>stuff seems to assume everything is happening within your own

722
00:36:21.159 --> 00:36:25.039
<v Speaker 1>local network inside that virtual box. Environment. How do you

723
00:36:25.079 --> 00:36:27.880
<v Speaker 1>take these attacks out into the real world. How do

724
00:36:27.920 --> 00:36:30.480
<v Speaker 1>you attack a target that's somewhere else entirely on the

725
00:36:30.480 --> 00:36:32.239
<v Speaker 1>Internet outside your local network.

726
00:36:32.480 --> 00:36:36.280
<v Speaker 2>That's a critical question for simulating realistic scenarios. You're right.

727
00:36:36.360 --> 00:36:39.440
<v Speaker 2>Your virtual machines usually have local IP addresses like one

728
00:36:39.519 --> 00:36:42.079
<v Speaker 2>ninety two point one, six eight dot x or ten

729
00:36:42.119 --> 00:36:46.280
<v Speaker 2>dot xixodx that are directly reachable from the public Internet.

730
00:36:46.440 --> 00:36:49.920
<v Speaker 2>The key technology here is port forwarding on your Internet router,

731
00:36:50.280 --> 00:36:52.679
<v Speaker 2>the box your ISP gives you that connects your home

732
00:36:52.719 --> 00:36:54.000
<v Speaker 2>network to the wider Internet.

733
00:36:54.159 --> 00:36:55.880
<v Speaker 1>Port forwarding. How does that work?

734
00:36:56.159 --> 00:36:58.800
<v Speaker 2>First, you need to know your network's public IP address.

735
00:36:59.239 --> 00:37:01.000
<v Speaker 2>This is the address the rest of the Internet sees

736
00:37:01.039 --> 00:37:03.719
<v Speaker 2>for your entire home network. You can usually find it

737
00:37:03.760 --> 00:37:07.119
<v Speaker 2>easily by just searching what is my IP on Google

738
00:37:07.320 --> 00:37:10.440
<v Speaker 2>from a computer on your network. Then you log into

739
00:37:10.480 --> 00:37:13.679
<v Speaker 2>your router's administration interface. Somewhere in the settings there will

740
00:37:13.679 --> 00:37:16.679
<v Speaker 2>be a section for port forwarding, or sometimes called virtual

741
00:37:16.719 --> 00:37:20.679
<v Speaker 2>servers or application forwarding. Here you create rules. You tell

742
00:37:20.719 --> 00:37:22.800
<v Speaker 2>a router, hey, if any traffic comes in from the

743
00:37:22.800 --> 00:37:25.719
<v Speaker 2>Internet directed at my public IP address on a specific

744
00:37:25.760 --> 00:37:29.440
<v Speaker 2>port number, say port eighty eighty, please forward that traffic

745
00:37:29.519 --> 00:37:32.760
<v Speaker 2>inward to the local IP address of my Collie Linux

746
00:37:32.840 --> 00:37:35.760
<v Speaker 2>virtual machine on that same port or a different one.

747
00:37:35.880 --> 00:37:38.519
<v Speaker 1>So the router acts like a receptionist, directing incoming calls

748
00:37:38.559 --> 00:37:40.079
<v Speaker 1>to the right internal extension.

749
00:37:40.119 --> 00:37:43.519
<v Speaker 2>Perfect analogy. Yes, you're mapping an external port on your

750
00:37:43.519 --> 00:37:46.400
<v Speaker 2>public IP to an internal port on your specific Callie

751
00:37:46.440 --> 00:37:49.440
<v Speaker 2>machines local IP. You'd set up different rules for different

752
00:37:49.440 --> 00:37:51.920
<v Speaker 2>services you want to expose. Maybe port eighty eighty for

753
00:37:51.960 --> 00:37:54.280
<v Speaker 2>your backdoor listener port eighty if you're hosting a malicious

754
00:37:54.280 --> 00:37:57.199
<v Speaker 2>website on Collie, Port three thousand for the beef UI

755
00:37:57.280 --> 00:37:58.880
<v Speaker 2>if you want to hook external browsers.

756
00:37:59.119 --> 00:38:03.440
<v Speaker 1>Okay, So forwarding makes your internal Collie services reachable via

757
00:38:03.559 --> 00:38:06.280
<v Speaker 1>your public IP. How does that apply to backdoors?

758
00:38:06.559 --> 00:38:10.239
<v Speaker 2>Right, let's talk about external backdoors. When you create your

759
00:38:10.239 --> 00:38:13.000
<v Speaker 2>back door using a tool like veil evasion, you need

760
00:38:13.079 --> 00:38:17.480
<v Speaker 2>to configure the payload. Specifically, you set the l host option.

761
00:38:18.360 --> 00:38:20.679
<v Speaker 2>LOS tells the back door where to connect back to.

762
00:38:21.480 --> 00:38:23.920
<v Speaker 2>For internal attacks within your lab, you set LOS to

763
00:38:23.960 --> 00:38:27.519
<v Speaker 2>your Collie machine's local IP, but for an external attack,

764
00:38:27.639 --> 00:38:30.599
<v Speaker 2>you set l host to your network's public IP address.

765
00:38:30.800 --> 00:38:33.000
<v Speaker 1>Ah, so the backdoor tries to connect to your public

766
00:38:33.039 --> 00:38:34.000
<v Speaker 1>IP from outside.

767
00:38:34.039 --> 00:38:37.079
<v Speaker 2>Exactly the back door running on a victim machine somewhere

768
00:38:37.119 --> 00:38:39.840
<v Speaker 2>else on the Internet attempts to initiate that reverse connection

769
00:38:40.039 --> 00:38:42.119
<v Speaker 2>back to your public IP address on the port you

770
00:38:42.119 --> 00:38:46.440
<v Speaker 2>specified Tree eighty eighty. Your router sees this incoming traffic

771
00:38:46.440 --> 00:38:49.159
<v Speaker 2>on Court eighty eighty, your port forwarding rule kicks in

772
00:38:49.480 --> 00:38:52.320
<v Speaker 2>the router force that connection inward to your Collie machine's

773
00:38:52.320 --> 00:38:55.639
<v Speaker 2>local IP address, where your metasploit multi handler is listening,

774
00:38:55.719 --> 00:38:56.159
<v Speaker 2>and you.

775
00:38:56.119 --> 00:38:59.159
<v Speaker 1>Get the shell connecting the dots from external target through

776
00:38:59.199 --> 00:39:01.760
<v Speaker 1>the Internet, through your router to your COLLIVM.

777
00:39:01.960 --> 00:39:06.159
<v Speaker 2>Precisely, as an alternative to setting up individual port forwarding rules,

778
00:39:06.519 --> 00:39:10.079
<v Speaker 2>some routers support putting a specific internal IP address into

779
00:39:10.079 --> 00:39:14.280
<v Speaker 2>the DMZ or demilitarized zone. Putting your Collie machine's IP

780
00:39:14.440 --> 00:39:18.000
<v Speaker 2>in the DMZ essentially forwards all incoming ports from the

781
00:39:18.000 --> 00:39:21.480
<v Speaker 2>public IP directly to that internal machine. It's simply to

782
00:39:21.519 --> 00:39:24.559
<v Speaker 2>set up, but less secure as exposes all of Collie's ports.

783
00:39:24.679 --> 00:39:26.760
<v Speaker 2>Port Forwarding specific ports is generally safer.

784
00:39:26.840 --> 00:39:28.760
<v Speaker 1>Okay, that makes sense, and seeing it work must be

785
00:39:28.840 --> 00:39:29.719
<v Speaker 1>quite the moment.

786
00:39:29.639 --> 00:39:33.119
<v Speaker 2>It really is, the truly insightful moment. The real aha

787
00:39:33.519 --> 00:39:36.480
<v Speaker 2>comes when you demonstrate this end to end. Imagine you

788
00:39:36.519 --> 00:39:39.599
<v Speaker 2>set up port forwarding from port eighty to your Collie machine,

789
00:39:39.760 --> 00:39:42.559
<v Speaker 2>which is running a web server hosting your backdoor dot ex.

790
00:39:43.559 --> 00:39:46.000
<v Speaker 2>Then you go to a completely separate computer on a

791
00:39:46.039 --> 00:39:48.800
<v Speaker 2>totally different network, maybe using your phone's hotspot or at

792
00:39:48.880 --> 00:39:52.199
<v Speaker 2>friend's house, open a browser typing your home network's public

793
00:39:52.239 --> 00:39:55.840
<v Speaker 2>IP address, and download backdoor dot ex from your Collie

794
00:39:55.880 --> 00:39:58.360
<v Speaker 2>web server. You run the back door on that external

795
00:39:58.400 --> 00:40:00.960
<v Speaker 2>Windows machine and back on you your calling machine. You

796
00:40:01.000 --> 00:40:04.159
<v Speaker 2>see the interpreter session open up, showing the connection coming

797
00:40:04.239 --> 00:40:07.320
<v Speaker 2>from that truly external public IP address. That's when you

798
00:40:07.360 --> 00:40:09.800
<v Speaker 2>really grasp how these attacks bridge the gap from the

799
00:40:09.840 --> 00:40:11.320
<v Speaker 2>local lab to the global internet.

800
00:40:11.559 --> 00:40:14.679
<v Speaker 1>That definitely paints a clear picture. Okay, so let's assume

801
00:40:14.719 --> 00:40:18.480
<v Speaker 1>you've succeeded. You've used an exploit, maybe delivered a payload

802
00:40:18.559 --> 00:40:21.320
<v Speaker 1>bypass the fire wall with a reverse connection. You've gained

803
00:40:21.320 --> 00:40:24.519
<v Speaker 1>initial access to a system. What's next? What happens in

804
00:40:24.559 --> 00:40:26.000
<v Speaker 1>the post exploitation phase.

805
00:40:26.280 --> 00:40:30.280
<v Speaker 2>Right Getting access is often just the beginning. Post exploitation

806
00:40:30.360 --> 00:40:32.920
<v Speaker 2>is all about what you do after you compromise a system.

807
00:40:33.519 --> 00:40:36.079
<v Speaker 2>The main goals are usually to understand the system better,

808
00:40:36.599 --> 00:40:40.679
<v Speaker 2>escalate your privileges if needed. Maintain your access persistently and

809
00:40:40.760 --> 00:40:43.159
<v Speaker 2>potentially use this machine to attack others.

810
00:40:43.920 --> 00:40:47.119
<v Speaker 1>Let's start with understanding the system you mentioned Interpreter earlier.

811
00:40:47.280 --> 00:40:50.280
<v Speaker 2>Yes, if your payload was Interpreter, you get a very

812
00:40:50.519 --> 00:40:54.079
<v Speaker 2>powerful interactive shell. It has lots of built in commands,

813
00:40:54.079 --> 00:40:57.920
<v Speaker 2>specifically for post exploitation. You can run basic commands like

814
00:40:57.960 --> 00:41:01.400
<v Speaker 2>sits info to get detailed information about the operating system, hardware,

815
00:41:01.400 --> 00:41:05.960
<v Speaker 2>et cetera. PS lists all the running processes pwdn LS

816
00:41:06.119 --> 00:41:09.320
<v Speaker 2>or durrors on Windows. Targets let you navigate the filesystem

817
00:41:09.360 --> 00:41:11.880
<v Speaker 2>just like a local command prompt. You start exploring.

818
00:41:12.199 --> 00:41:14.119
<v Speaker 1>What about making your access more stable?

819
00:41:14.239 --> 00:41:17.599
<v Speaker 2>That's crucial process migration. Your initial access might have come

820
00:41:17.639 --> 00:41:21.079
<v Speaker 2>through exploiting a vulnerability and say a user's web browser

821
00:41:21.199 --> 00:41:24.880
<v Speaker 2>or a specific application. If the user closes that browser application,

822
00:41:25.000 --> 00:41:26.599
<v Speaker 2>your interpreter session dies.

823
00:41:26.320 --> 00:41:28.719
<v Speaker 1>With it, so you lose access exactly.

824
00:41:29.239 --> 00:41:32.760
<v Speaker 2>Process migration involves injecting your materpreter agent from that initial

825
00:41:32.880 --> 00:41:37.039
<v Speaker 2>unscable process into a different, more stable, long running process

826
00:41:37.079 --> 00:41:40.960
<v Speaker 2>on the system. On Windows, migrating into something like Explorer

827
00:41:41.000 --> 00:41:44.639
<v Speaker 2>dot exx, which handles the desktop or services dot ex

828
00:41:44.880 --> 00:41:48.119
<v Speaker 2>is common. These processes almost never close while the system

829
00:41:48.159 --> 00:41:51.000
<v Speaker 2>is running. This makes your access much more persistent for

830
00:41:51.039 --> 00:41:51.800
<v Speaker 2>your current session.

831
00:41:52.039 --> 00:41:55.800
<v Speaker 1>Okay, stable access, what else? Getting data definitely?

832
00:41:55.800 --> 00:41:58.719
<v Speaker 2>Interpreter makes it easy to upload and download files between

833
00:41:58.760 --> 00:42:01.800
<v Speaker 2>your Collie machine and the compromised target. You might want

834
00:42:01.800 --> 00:42:05.320
<v Speaker 2>to download sensitive documents you find, or upload additional tools,

835
00:42:05.559 --> 00:42:05.960
<v Speaker 2>maybe a.

836
00:42:06.000 --> 00:42:08.559
<v Speaker 1>Keylogger, keyloggers to capture typing.

837
00:42:08.639 --> 00:42:12.079
<v Speaker 2>Yes, Materpreter has modules to deploy keyloggers that capture every

838
00:42:12.119 --> 00:42:15.159
<v Speaker 2>single keystroke the user types on their keyboard, passwords, emails,

839
00:42:15.239 --> 00:42:19.000
<v Speaker 2>chat messages, documents, everything. It's incredibly invasive.

840
00:42:18.679 --> 00:42:21.639
<v Speaker 1>And keeping access long term even after they reboot.

841
00:42:21.840 --> 00:42:26.159
<v Speaker 2>Right. That's maintaining access or persistence. Just migrating processes keeps

842
00:42:26.159 --> 00:42:29.039
<v Speaker 2>you alive for the current session, but if the computer reboots,

843
00:42:29.159 --> 00:42:32.480
<v Speaker 2>you lose access again. Persistence techniques aim to ensure your

844
00:42:32.480 --> 00:42:35.480
<v Speaker 2>backdoor runs automatically every time the system starts up. There

845
00:42:35.519 --> 00:42:38.800
<v Speaker 2>are simpler methods. You could use valvation again to generate

846
00:42:38.840 --> 00:42:41.599
<v Speaker 2>a backdoor designed to install itself as a system service.

847
00:42:42.159 --> 00:42:45.760
<v Speaker 2>Materpreter itself also has persistent scripts or modules that try

848
00:42:45.760 --> 00:42:49.159
<v Speaker 2>to set up basic startup entries in the registry or scheduled.

849
00:42:48.679 --> 00:42:50.559
<v Speaker 1>Tasks, but those might get caught.

850
00:42:50.679 --> 00:42:53.840
<v Speaker 2>They often do yes. These simpler methods can be detectable

851
00:42:53.840 --> 00:42:57.679
<v Speaker 2>by anti virus or endpoint security software. The book hints

852
00:42:57.719 --> 00:43:01.800
<v Speaker 2>a more advanced, robust methods for each ving persistence, often

853
00:43:01.840 --> 00:43:06.400
<v Speaker 2>involving combining multiple techniques or using more sophisticated evasion tactics

854
00:43:06.440 --> 00:43:09.119
<v Speaker 2>to ensure the back door remains active and hidden even

855
00:43:09.159 --> 00:43:13.280
<v Speaker 2>after reboots without being easily detected. These often require a

856
00:43:13.320 --> 00:43:15.480
<v Speaker 2>deeper understanding of the OS internals.

857
00:43:15.719 --> 00:43:19.159
<v Speaker 1>Okay, persistence is key. What about attacking other computers from

858
00:43:19.159 --> 00:43:20.119
<v Speaker 1>the one you just hacked?

859
00:43:20.400 --> 00:43:23.840
<v Speaker 2>Ah, that's pivoting. This is a really important concept in

860
00:43:23.880 --> 00:43:28.199
<v Speaker 2>penetration testing. Often the first machine you compromise might just

861
00:43:28.239 --> 00:43:31.199
<v Speaker 2>be a regular user's workstation or a less critical server,

862
00:43:31.840 --> 00:43:35.039
<v Speaker 2>but that machine might have access to other internal networks

863
00:43:35.119 --> 00:43:37.679
<v Speaker 2>or servers that are not directly reachable by your calling

864
00:43:37.719 --> 00:43:39.280
<v Speaker 2>machine from the outside.

865
00:43:39.000 --> 00:43:41.280
<v Speaker 1>Like deeper inside their network exactly.

866
00:43:41.519 --> 00:43:44.760
<v Speaker 2>Pivoting involves using the compromised computer as a stamping stone

867
00:43:44.880 --> 00:43:47.559
<v Speaker 2>or a pivot to route your attack traffic through it

868
00:43:47.880 --> 00:43:51.280
<v Speaker 2>to reach those other internal targets. For example, you might

869
00:43:51.320 --> 00:43:53.920
<v Speaker 2>hack a Windows machine in their main office network, say

870
00:43:54.280 --> 00:43:57.000
<v Speaker 2>one ninety two point one six eight point one point

871
00:43:57.079 --> 00:44:00.239
<v Speaker 2>one zero. Then you discover, maybe through network scan from

872
00:44:00.280 --> 00:44:03.360
<v Speaker 2>that Windows machine, that there's a separate internal server network,

873
00:44:03.440 --> 00:44:06.199
<v Speaker 2>say ten point zero point zero point zero two four,

874
00:44:06.480 --> 00:44:09.239
<v Speaker 2>that holds critical data, but your callie machine can't see

875
00:44:09.239 --> 00:44:12.280
<v Speaker 2>it directly. You use the compromise Windows machine as a gateway.

876
00:44:12.760 --> 00:44:16.039
<v Speaker 2>Metasploit has modules like run auto route that automatically add

877
00:44:16.039 --> 00:44:18.719
<v Speaker 2>network routes through your materpreter session on the Windows box.

878
00:44:19.159 --> 00:44:21.199
<v Speaker 2>The sales metasploit. Hey, if you want to talk to

879
00:44:21.199 --> 00:44:23.400
<v Speaker 2>any machine on the ten point zero point one to network,

880
00:44:23.559 --> 00:44:26.159
<v Speaker 2>send the traffic via the interpreter session running on one

881
00:44:26.239 --> 00:44:28.519
<v Speaker 2>ninety two point one sixty eight point one point one

882
00:44:28.519 --> 00:44:29.280
<v Speaker 2>towards zero.

883
00:44:29.119 --> 00:44:32.159
<v Speaker 1>So you can then launch exploits from your callie machine

884
00:44:32.199 --> 00:44:35.760
<v Speaker 1>against those internal servers, tunneling through the first victim.

885
00:44:35.880 --> 00:44:39.079
<v Speaker 2>Precisely, it allows you to burrow deeper into a target network,

886
00:44:39.280 --> 00:44:42.639
<v Speaker 2>moving laterally from system to system, starting from just one

887
00:44:42.880 --> 00:44:46.599
<v Speaker 2>initial point of compromise. It's a fundamental technique for mapping

888
00:44:46.679 --> 00:44:48.480
<v Speaker 2>out and compromising larger networks.

889
00:44:48.599 --> 00:44:51.679
<v Speaker 1>Post exploitation seems just as complex, if not more so,

890
00:44:51.840 --> 00:44:53.760
<v Speaker 1>than getting initial access.

891
00:44:53.519 --> 00:44:55.960
<v Speaker 2>It often is. It requires a different set of skills.

892
00:44:56.039 --> 00:44:58.880
<v Speaker 2>Understanding the target os, knowing how to move quietly and

893
00:44:58.920 --> 00:45:01.079
<v Speaker 2>achieving specific without getting caught.

894
00:45:01.159 --> 00:45:05.519
<v Speaker 1>Okay, we've covered networks devices, client side, server side. Let's

895
00:45:05.559 --> 00:45:10.239
<v Speaker 1>transition now to website penetration testing, shifting focus from the

896
00:45:10.400 --> 00:45:14.760
<v Speaker 1>underlying infrastructure to the web applications themselves. First off, what

897
00:45:14.880 --> 00:45:18.000
<v Speaker 1>exactly is a website from an ethical hackers perspective? And

898
00:45:18.039 --> 00:45:21.719
<v Speaker 1>how do you start gathering information specifically about a website target?

899
00:45:21.840 --> 00:45:26.159
<v Speaker 2>Good question from our perspective. A website is essentially a

900
00:45:26.159 --> 00:45:29.119
<v Speaker 2>web application, a collection of files and code installed on

901
00:45:29.159 --> 00:45:31.639
<v Speaker 2>a web server, and that web server is just another

902
00:45:31.679 --> 00:45:35.239
<v Speaker 2>computer running an OS with an IP address made accessible

903
00:45:35.360 --> 00:45:39.280
<v Speaker 2>usually via a domain name like www dot example dot com.

904
00:45:39.639 --> 00:45:43.000
<v Speaker 2>For example, that Metasploitable virtual machine we talked about. It

905
00:45:43.079 --> 00:45:46.360
<v Speaker 2>runs a web server and it has website files like index,

906
00:45:46.400 --> 00:45:50.400
<v Speaker 2>dot php, images, etc. In a specific directory. You can

907
00:45:50.480 --> 00:45:54.119
<v Speaker 2>access its simple website just by typing Metasploitable's IP address

908
00:45:54.159 --> 00:45:56.159
<v Speaker 2>into a browser on your Collie machine.

909
00:45:56.320 --> 00:45:58.679
<v Speaker 1>Okay, so it's software on a server. How do you

910
00:45:58.760 --> 00:46:00.960
<v Speaker 1>gather info on it? Is it like the osin tweeted

911
00:46:01.000 --> 00:46:01.480
<v Speaker 1>for people?

912
00:46:01.880 --> 00:46:05.639
<v Speaker 2>It's similar in principle, but focused on web technologies and infrastructure.

913
00:46:05.920 --> 00:46:08.960
<v Speaker 2>Information gathering is just as critical for web targets. You

914
00:46:08.960 --> 00:46:10.440
<v Speaker 2>start with things like a who's look up for the

915
00:46:10.440 --> 00:46:13.079
<v Speaker 2>domain name. This can give you information about who registered

916
00:46:13.079 --> 00:46:15.760
<v Speaker 2>the domain, the company name and address if they did

917
00:46:15.880 --> 00:46:18.880
<v Speaker 2>use a privacy service, the domain name servers, which hinsit,

918
00:46:18.880 --> 00:46:22.559
<v Speaker 2>their hosting provider, and sometimes technical contact email addresses.

919
00:46:22.719 --> 00:46:24.639
<v Speaker 1>What else, what about the tech running the site?

920
00:46:24.800 --> 00:46:28.119
<v Speaker 2>For that, tools and services like Netcraft are excellent. You

921
00:46:28.159 --> 00:46:31.599
<v Speaker 2>can enter a website URL into Netcraft's site report tool

922
00:46:31.920 --> 00:46:33.840
<v Speaker 2>and it will try to identify the technology as the

923
00:46:33.880 --> 00:46:36.760
<v Speaker 2>website is using. Things like what web server software are

924
00:46:36.760 --> 00:46:41.000
<v Speaker 2>they running? Apache injincs, Microsoft ISA, What server side programming

925
00:46:41.079 --> 00:46:44.800
<v Speaker 2>languages are they using? Php? Java, dot Net, Python? Will

926
00:46:44.840 --> 00:46:50.360
<v Speaker 2>client side JavaScript libraries jQuery React? Crucially, Netcraft can often

927
00:46:50.400 --> 00:46:55.000
<v Speaker 2>identify specific web applications being used, like wordcres, Jumladruple, Magento.

928
00:46:55.599 --> 00:47:00.199
<v Speaker 2>Knowing they're using say WordPress version xy immediately tell you

929
00:47:00.280 --> 00:47:03.960
<v Speaker 2>to go research known vulnerabilities for that specific version ah.

930
00:47:03.639 --> 00:47:06.719
<v Speaker 1>Finding known weaknesses in the software they use, mark exactly.

931
00:47:07.000 --> 00:47:09.199
<v Speaker 2>Robtex is another useful service that provides a lot of

932
00:47:09.199 --> 00:47:11.960
<v Speaker 2>related network information for a given domain or ip address,

933
00:47:12.000 --> 00:47:16.239
<v Speaker 2>things like historical DNS records or related domains IPA, just neighbors.

934
00:47:15.800 --> 00:47:17.480
<v Speaker 1>IP addressed neighbors. Why does that matter?

935
00:47:17.719 --> 00:47:20.320
<v Speaker 2>This relates to the idea of websites on the same server.

936
00:47:21.119 --> 00:47:24.039
<v Speaker 2>It's very common for web hosting companies to put multiple

937
00:47:24.079 --> 00:47:27.639
<v Speaker 2>websites belonging to different customers, all in the same physical

938
00:47:27.679 --> 00:47:30.880
<v Speaker 2>server sharing the same IP address. So if your target

939
00:47:30.920 --> 00:47:34.400
<v Speaker 2>website seems really secure and you can't find any vulnerabilities

940
00:47:34.440 --> 00:47:37.199
<v Speaker 2>on it directly, you can check what other websites are

941
00:47:37.199 --> 00:47:39.880
<v Speaker 2>hosted on that same IP address. If you can find

942
00:47:39.880 --> 00:47:42.840
<v Speaker 2>and exploit a vulnerability on one of those other, potentially

943
00:47:42.920 --> 00:47:46.000
<v Speaker 2>less secure websites on the same server, gaining access to

944
00:47:46.000 --> 00:47:48.719
<v Speaker 2>that site often means you gain access to the underlying

945
00:47:48.760 --> 00:47:51.760
<v Speaker 2>server itself, and from there you can usually access the

946
00:47:51.800 --> 00:47:54.880
<v Speaker 2>files and databases of your original target website.

947
00:47:54.440 --> 00:47:57.639
<v Speaker 1>As well hack the neighbor to get into the target's house. Essentially,

948
00:47:57.800 --> 00:47:58.039
<v Speaker 1>that's a.

949
00:47:58.000 --> 00:48:00.679
<v Speaker 2>Good way to put it. It's a common technique. Another

950
00:48:00.719 --> 00:48:04.159
<v Speaker 2>thing to look for is subdomains. Companies often have subdomains

951
00:48:04.199 --> 00:48:07.639
<v Speaker 2>that aren't widely advertised, like dev dot example dot com,

952
00:48:07.800 --> 00:48:10.800
<v Speaker 2>staging dot Example dot com, Beta dot example dot com,

953
00:48:10.920 --> 00:48:14.599
<v Speaker 2>or maybe even admin dot example dot com. These subdomains

954
00:48:14.679 --> 00:48:18.480
<v Speaker 2>might host experimental features, older versions of the application, or

955
00:48:18.519 --> 00:48:21.880
<v Speaker 2>internal administrative interfaces that are often less secured or patched

956
00:48:22.199 --> 00:48:26.119
<v Speaker 2>than the main public facing website. Finding improbing these hidden

957
00:48:26.119 --> 00:48:27.760
<v Speaker 2>subdomains can be very fruitful.

958
00:48:28.000 --> 00:48:29.559
<v Speaker 1>How do you find them if they're not advertised?

959
00:48:29.599 --> 00:48:32.960
<v Speaker 2>There are tools that perform subdomain enumeration using various techniques

960
00:48:33.119 --> 00:48:37.840
<v Speaker 2>like checking common names, admin, test, dev, etc. Querying DNS records,

961
00:48:37.920 --> 00:48:43.239
<v Speaker 2>using search engines, creatively or even brute forcing potential subdomain names. Finally,

962
00:48:43.320 --> 00:48:46.760
<v Speaker 2>information gathering also involves looking for sensitive files and directories

963
00:48:46.800 --> 00:48:49.320
<v Speaker 2>directly on the web server that might have been left exposed.

964
00:48:49.719 --> 00:48:53.679
<v Speaker 2>Maybe developers left behind configuration files canfig dot php, dot BAK,

965
00:48:53.960 --> 00:48:58.159
<v Speaker 2>backup archives, website dot zip, debugging scripts, PHPNFO dot php

966
00:48:58.239 --> 00:49:01.440
<v Speaker 2>which reveals tons about the PHP setup, or even files

967
00:49:01.480 --> 00:49:03.719
<v Speaker 2>containing credentials passwords dot txt.

968
00:49:03.920 --> 00:49:06.000
<v Speaker 1>People actually leave password files accessible.

969
00:49:06.199 --> 00:49:10.199
<v Speaker 2>You'd be surprised how often misconfigurations happen. Tools like derb

970
00:49:10.639 --> 00:49:13.719
<v Speaker 2>or go buster help automate the process of finding these

971
00:49:13.800 --> 00:49:17.559
<v Speaker 2>hidden files and directories by rapidly trying thousands of common

972
00:49:17.639 --> 00:49:19.559
<v Speaker 2>names based on dictionary lists.

973
00:49:19.880 --> 00:49:22.039
<v Speaker 1>Okay, that's a lot of ground to cover just in

974
00:49:22.039 --> 00:49:25.480
<v Speaker 1>information gathering for websites. Now let's get into the actual

975
00:49:25.559 --> 00:49:29.039
<v Speaker 1>vulnerabilities what are some of the most common ways ethical

976
00:49:29.079 --> 00:49:33.239
<v Speaker 1>hackers find and exploit weaknesses in web applications themselves.

977
00:49:33.559 --> 00:49:36.800
<v Speaker 2>Right, let's dive into the nitty gritty of common webflaws.

978
00:49:37.440 --> 00:49:41.880
<v Speaker 2>One conceptually straightforward vulnerability is related to file uploads. Many

979
00:49:41.920 --> 00:49:45.719
<v Speaker 2>websites allow users to upload files, profile, pictures, documents, etc.

980
00:49:46.239 --> 00:49:48.840
<v Speaker 2>If the website doesn't properly validate what kind of file

981
00:49:48.920 --> 00:49:51.400
<v Speaker 2>is being uploaded, an attacker might be able to upload

982
00:49:51.400 --> 00:49:54.119
<v Speaker 2>a malicious script file instead of say a GPEG.

983
00:49:53.760 --> 00:49:56.800
<v Speaker 1>Image, like uploading code instead of data exactly.

984
00:49:56.920 --> 00:49:59.920
<v Speaker 2>If the web servers configure to execute phpe scripts, for example,

985
00:50:00.159 --> 00:50:02.239
<v Speaker 2>and you can upload a file ending in dot php

986
00:50:02.320 --> 00:50:06.239
<v Speaker 2>containing malicious PHP code, often called a webshell, then simply

987
00:50:06.280 --> 00:50:09.199
<v Speaker 2>browsing to the URL of that uploaded file could give

988
00:50:09.199 --> 00:50:11.679
<v Speaker 2>you full command execution capabilities on the.

989
00:50:11.639 --> 00:50:14.480
<v Speaker 1>Server, so you upload your own command prompt essentially.

990
00:50:14.559 --> 00:50:19.400
<v Speaker 2>Yes, Tools like Weaveley are specifically designed to generate compact

991
00:50:19.800 --> 00:50:23.400
<v Speaker 2>and often stealthy PHP webshells that give you a nice

992
00:50:23.440 --> 00:50:26.599
<v Speaker 2>interactive terminal to control the server. This all comes down

993
00:50:26.639 --> 00:50:29.920
<v Speaker 2>to the critical principle of input validation. The website must

994
00:50:30.000 --> 00:50:34.079
<v Speaker 2>strictly check file types and not trust user supplied file names.

995
00:50:33.920 --> 00:50:35.960
<v Speaker 1>Okay, insecure file uploads? What else?

996
00:50:36.360 --> 00:50:40.480
<v Speaker 2>Next up are code execution vulnerabilities. These are flaws where

997
00:50:40.599 --> 00:50:43.840
<v Speaker 2>user input is directly used or embedded into a command

998
00:50:43.920 --> 00:50:46.920
<v Speaker 2>that gets executed by the server's operating system. Imagine a

999
00:50:46.960 --> 00:50:49.559
<v Speaker 2>website feature that lets you ping another machine and you

1000
00:50:49.639 --> 00:50:52.800
<v Speaker 2>provide the IP address. If the website just takes your

1001
00:50:52.800 --> 00:50:55.079
<v Speaker 2>input and sticks it into a pin your input command

1002
00:50:55.079 --> 00:50:55.840
<v Speaker 2>without cleaning it.

1003
00:50:55.800 --> 00:50:57.679
<v Speaker 1>First, you could add other commands precisely.

1004
00:50:57.719 --> 00:51:01.199
<v Speaker 2>You could potentially inject os command separators like or and inmplinix,

1005
00:51:01.360 --> 00:51:04.440
<v Speaker 2>followed by your own commands like rm rf don't do that,

1006
00:51:04.960 --> 00:51:08.079
<v Speaker 2>or something more useful like ncee binch r cali.

1007
00:51:08.039 --> 00:51:09.920
<v Speaker 1>Port ncee What's that?

1008
00:51:09.920 --> 00:51:12.639
<v Speaker 2>That's a classic NETCIT command to create a reverse show.

1009
00:51:13.159 --> 00:51:16.079
<v Speaker 2>It tells the server to execute binch a command prompt

1010
00:51:16.320 --> 00:51:18.239
<v Speaker 2>and connect it to input and output back to a

1011
00:51:18.280 --> 00:51:22.199
<v Speaker 2>listing port on your CALLAI machine. Instant command line access,

1012
00:51:22.440 --> 00:51:26.639
<v Speaker 2>often bypassing firewalls. Again, the fix is rigorous input sanitization.

1013
00:51:27.119 --> 00:51:31.320
<v Speaker 1>Okay, file uploads, code execution? What about accessing files on

1014
00:51:31.360 --> 00:51:31.760
<v Speaker 1>the server?

1015
00:51:32.360 --> 00:51:35.159
<v Speaker 2>That brings us to file inclusion vulnerabilities. There are two

1016
00:51:35.199 --> 00:51:39.559
<v Speaker 2>main types, local and remote. Local file inclusion LiFi allows

1017
00:51:39.599 --> 00:51:42.239
<v Speaker 2>an attacker to trick the web application into including and

1018
00:51:42.280 --> 00:51:45.800
<v Speaker 2>displaying the contents of arbitrary files from the server's filesystem,

1019
00:51:45.960 --> 00:51:48.280
<v Speaker 2>files that were never intended to be accessed via the web.

1020
00:51:48.679 --> 00:51:51.039
<v Speaker 2>This often happens when a script uses user input to

1021
00:51:51.079 --> 00:51:55.320
<v Speaker 2>determine which file to include. GT pages PHP. If you

1022
00:51:55.320 --> 00:51:58.280
<v Speaker 2>can manipulate the page parameter in the URL, maybe using

1023
00:51:58.360 --> 00:52:01.920
<v Speaker 2>directory curricial sequences like LETT, you could potentially read files

1024
00:52:02.000 --> 00:52:03.400
<v Speaker 2>outside the normal web rout.

1025
00:52:03.440 --> 00:52:05.320
<v Speaker 1>Like system file exactly yeah.

1026
00:52:05.360 --> 00:52:08.559
<v Speaker 2>A classic LiFi demonstration is reading etcter password on a

1027
00:52:08.559 --> 00:52:10.800
<v Speaker 2>Linux server to get a list of system users, or

1028
00:52:10.840 --> 00:52:13.840
<v Speaker 2>reading application source code or configuration files that might contain

1029
00:52:13.920 --> 00:52:16.320
<v Speaker 2>database passwords or other secrets.

1030
00:52:16.159 --> 00:52:17.840
<v Speaker 1>And remote file inclusion.

1031
00:52:18.000 --> 00:52:21.880
<v Speaker 2>Remote file inclusion RFI is generally much more dangerous, though

1032
00:52:21.960 --> 00:52:26.400
<v Speaker 2>less common nowadays due to better default server configurations. RTIFI

1033
00:52:26.440 --> 00:52:29.079
<v Speaker 2>occurs when the application allows you to include a file

1034
00:52:29.480 --> 00:52:32.039
<v Speaker 2>not just from the local server, but from a completely

1035
00:52:32.079 --> 00:52:35.239
<v Speaker 2>different server over the network using a URL, so.

1036
00:52:35.239 --> 00:52:38.000
<v Speaker 1>You can make the target website include and execute a

1037
00:52:38.039 --> 00:52:40.719
<v Speaker 1>script file hosted on your calling machine precisely.

1038
00:52:40.840 --> 00:52:43.239
<v Speaker 2>If RFI is possible, you can usually just point it

1039
00:52:43.280 --> 00:52:46.440
<v Speaker 2>to a URL hosting your malicious PHP shell script and

1040
00:52:46.480 --> 00:52:48.880
<v Speaker 2>the target server will download and execute it, giving you

1041
00:52:48.920 --> 00:52:54.599
<v Speaker 2>immediate code execution. RFI typically requires specific insecure PHP settings

1042
00:52:54.599 --> 00:52:57.679
<v Speaker 2>to be enabled, like allowll include and alourel fopen, which

1043
00:52:57.920 --> 00:52:59.599
<v Speaker 2>thankfully are often disabled by default.

1044
00:52:59.639 --> 00:53:03.480
<v Speaker 1>Now LiFi reads local files, RFI executes remote code. What

1045
00:53:03.480 --> 00:53:06.199
<v Speaker 1>about databases? Websites use databases all the time.

1046
00:53:06.280 --> 00:53:08.239
<v Speaker 2>Ah. Yes, That leads us to one of the most

1047
00:53:08.280 --> 00:53:12.920
<v Speaker 2>widespread and impactful categories of web vulnerabilities. Sql injection scoot

1048
00:53:12.960 --> 00:53:16.280
<v Speaker 2>a lie cedicle. Vulnerabilities occur when user supplied input is

1049
00:53:16.280 --> 00:53:19.559
<v Speaker 2>incorporated into a database query in an unsafe way, allowing

1050
00:53:19.599 --> 00:53:22.400
<v Speaker 2>the attacker to manipulate the structure of the SQL query itself.

1051
00:53:22.559 --> 00:53:25.440
<v Speaker 1>So you inject SQL commands through a web form.

1052
00:53:25.320 --> 00:53:29.880
<v Speaker 2>Essentially yes, or through parameters in the URL. You discover

1053
00:53:29.960 --> 00:53:33.480
<v Speaker 2>potential SQL points, often by injecting special characters like a

1054
00:53:33.519 --> 00:53:36.199
<v Speaker 2>single quote or sequel fragments like AD one to on

1055
00:53:36.440 --> 00:53:40.039
<v Speaker 2>or AD one zero into input fields or URL parameters.

1056
00:53:40.920 --> 00:53:44.119
<v Speaker 2>If the application is vulnerable, these injections will often cause

1057
00:53:44.199 --> 00:53:47.400
<v Speaker 2>database errors to be displayed or change the content returned

1058
00:53:47.400 --> 00:53:50.360
<v Speaker 2>by the page in predictable ways, confirming that your input

1059
00:53:50.400 --> 00:53:51.639
<v Speaker 2>is affecting the SQL query.

1060
00:53:51.800 --> 00:53:53.360
<v Speaker 1>What can you do with SQL injection.

1061
00:53:53.440 --> 00:53:56.400
<v Speaker 2>Once you find it a lot, It ranges from simple

1062
00:53:56.480 --> 00:54:00.000
<v Speaker 2>checks to full database takeover. You can perform authorization bypass

1063
00:54:00.960 --> 00:54:03.440
<v Speaker 2>crafting an injection like ar one one was one into

1064
00:54:03.480 --> 00:54:06.039
<v Speaker 2>a username or password field might trick the log in

1065
00:54:06.119 --> 00:54:08.760
<v Speaker 2>query into always evaluating to true, letting you log in

1066
00:54:08.800 --> 00:54:12.079
<v Speaker 2>as an administrator or another user without knowing their actual password.

1067
00:54:12.400 --> 00:54:13.920
<v Speaker 1>Log in as admin just like.

1068
00:54:13.920 --> 00:54:17.079
<v Speaker 2>That in corely coded applications. Yes. Then you can start

1069
00:54:17.079 --> 00:54:20.559
<v Speaker 2>extracting data using SQL union operators. You can combine the

1070
00:54:20.599 --> 00:54:24.679
<v Speaker 2>applications intended query with your own select statements. You first

1071
00:54:24.679 --> 00:54:27.199
<v Speaker 2>figure out the number of columns the original querer returns.

1072
00:54:27.440 --> 00:54:31.320
<v Speaker 2>Then you can inject queries like union select one database

1073
00:54:31.840 --> 00:54:35.639
<v Speaker 2>user version five, assuming five columns to retrieve the current

1074
00:54:35.719 --> 00:54:39.320
<v Speaker 2>database name, the database username, the application is running as,

1075
00:54:39.559 --> 00:54:40.920
<v Speaker 2>and the database software version.

1076
00:54:41.039 --> 00:54:43.719
<v Speaker 1>Finding out details about the database itself right.

1077
00:54:44.119 --> 00:54:47.679
<v Speaker 2>Knowing the database type and version helps tailor further attacks.

1078
00:54:48.199 --> 00:54:51.480
<v Speaker 2>Then you can query the database's internal metadata tables like

1079
00:54:51.599 --> 00:54:54.679
<v Speaker 2>information Schema in mysequel to discover the names of all

1080
00:54:54.760 --> 00:54:57.840
<v Speaker 2>the tables and columns in the application's database. You might

1081
00:54:57.840 --> 00:55:01.239
<v Speaker 2>find tables named users, accounts, credit cards, and then you

1082
00:55:01.280 --> 00:55:04.679
<v Speaker 2>can query those tables directly to extract sensitive data like usernames,

1083
00:55:05.119 --> 00:55:07.320
<v Speaker 2>hash passwords, which you might be able to crack offline

1084
00:55:07.679 --> 00:55:09.480
<v Speaker 2>email addresses, personal details, etc.

1085
00:55:09.880 --> 00:55:12.840
<v Speaker 1>Extracting the entire user database through a web form.

1086
00:55:13.119 --> 00:55:17.000
<v Speaker 2>It's possible if the vulnerability is severe and not properly mitigated.

1087
00:55:18.000 --> 00:55:21.280
<v Speaker 2>In some database configurations, SQL injection can even be used

1088
00:55:21.280 --> 00:55:25.239
<v Speaker 2>to read arbitrary files from the server's file system, using

1089
00:55:25.280 --> 00:55:29.119
<v Speaker 2>functions like load file, effectively turning in simply flaw into

1090
00:55:29.119 --> 00:55:32.880
<v Speaker 2>an LFI flaw, or sometimes even write files leading to

1091
00:55:32.920 --> 00:55:33.719
<v Speaker 2>code execution.

1092
00:55:34.239 --> 00:55:36.679
<v Speaker 1>This sounds complex to do manually, it.

1093
00:55:36.639 --> 00:55:39.960
<v Speaker 2>Can be tedious, yes, That's why there are powerful automated

1094
00:55:40.000 --> 00:55:43.320
<v Speaker 2>tools like schoolmap. Schoole Map is an open source penetration

1095
00:55:43.400 --> 00:55:46.960
<v Speaker 2>testing tool that automates the process of detecting and exploiting

1096
00:55:47.239 --> 00:55:50.559
<v Speaker 2>SQL injection vulnerabilities. You just point it at a suspect

1097
00:55:50.760 --> 00:55:54.000
<v Speaker 2>URL and it will automatically test various injection techniques for

1098
00:55:54.000 --> 00:55:58.960
<v Speaker 2>different database types MYQL, postgrasschool, MSQL, Oracle, etc. If it

1099
00:55:59.000 --> 00:56:03.119
<v Speaker 2>finds an injection point, it can automatically enumerate databases, tables, columns,

1100
00:56:03.119 --> 00:56:05.280
<v Speaker 2>extract data, read files, and sometimes even give you an

1101
00:56:05.280 --> 00:56:08.599
<v Speaker 2>OS level command show all through the SQL injection vulnerability.

1102
00:56:08.679 --> 00:56:10.039
<v Speaker 2>It's an incredibly effective tool.

1103
00:56:10.199 --> 00:56:13.559
<v Speaker 1>Wow, SQL injection seems devastating. It really drives home a

1104
00:56:13.559 --> 00:56:14.400
<v Speaker 1>point you made earlier.

1105
00:56:14.639 --> 00:56:18.559
<v Speaker 2>What all these web vulnerabilities, especially SQL injection and code execution,

1106
00:56:19.239 --> 00:56:23.440
<v Speaker 2>fundamentally reveal is that critical principle never trust user input.

1107
00:56:23.719 --> 00:56:24.000
<v Speaker 1>Right.

1108
00:56:24.280 --> 00:56:27.519
<v Speaker 2>Every single piece of data coming from a user, whether

1109
00:56:27.519 --> 00:56:30.199
<v Speaker 2>it's in a URL, a form field, an HTTP head,

1110
00:56:30.280 --> 00:56:34.440
<v Speaker 2>or a cookie, must be rigorously validated and sanitized before

1111
00:56:34.480 --> 00:56:37.320
<v Speaker 2>it's used by the application, especially before it's included in

1112
00:56:37.320 --> 00:56:41.119
<v Speaker 2>a database query, an OS command, or a filepath. Otherwise,

1113
00:56:41.159 --> 00:56:43.760
<v Speaker 2>what looks like a benign comment or search query can

1114
00:56:43.800 --> 00:56:46.599
<v Speaker 2>become a direct command to your database or server.

1115
00:56:46.800 --> 00:56:51.000
<v Speaker 1>Okay, one more major web vulnerability type, cross site SCRIPTINGXSS.

1116
00:56:51.239 --> 00:56:53.480
<v Speaker 1>How is this different from things like SQL injection?

1117
00:56:53.920 --> 00:56:57.039
<v Speaker 2>XSS is fundamentally different because the injected code, which is

1118
00:56:57.119 --> 00:57:00.559
<v Speaker 2>usually JavaScript, executes in the victim user's browser, not on

1119
00:57:00.599 --> 00:57:01.480
<v Speaker 2>the server itself.

1120
00:57:01.559 --> 00:57:04.400
<v Speaker 1>A client side code injection, not server side exactly.

1121
00:57:04.920 --> 00:57:09.119
<v Speaker 2>SCORED affection affects the server's database. Code execution affects the servers.

1122
00:57:09.119 --> 00:57:12.800
<v Speaker 2>OS XSS affects the users visiting the vulnerable web page.

1123
00:57:13.199 --> 00:57:16.320
<v Speaker 2>There are three main types of XSS. Stored persistent EXSS.

1124
00:57:16.519 --> 00:57:20.400
<v Speaker 2>The attacker injects malicious JavaScript code and the web application

1125
00:57:20.440 --> 00:57:23.719
<v Speaker 2>stores it in this database VHG product review, a form,

1126
00:57:23.760 --> 00:57:27.360
<v Speaker 2>post a user profile. When other users view that stored content,

1127
00:57:27.639 --> 00:57:29.760
<v Speaker 2>the malicious script executes in their browsers.

1128
00:57:29.880 --> 00:57:32.239
<v Speaker 1>So one injection hits many users.

1129
00:57:32.000 --> 00:57:35.480
<v Speaker 2>Potentially Yes, That's why it's often considered the most dangerous type.

1130
00:57:35.800 --> 00:57:38.639
<v Speaker 2>Reflected EXSS. The malicious script is injected into the URL

1131
00:57:38.719 --> 00:57:41.480
<v Speaker 2>or a form submission, and the server reflects that script

1132
00:57:41.480 --> 00:57:44.400
<v Speaker 2>back in the immediate response page. It only executes if

1133
00:57:44.400 --> 00:57:47.280
<v Speaker 2>the user clicks on a specifically crafted malicious link, for example,

1134
00:57:47.320 --> 00:57:48.519
<v Speaker 2>sent via email or chat.

1135
00:57:48.639 --> 00:57:51.199
<v Speaker 1>Only affects users who click the bad link right.

1136
00:57:51.320 --> 00:57:53.800
<v Speaker 2>It requires more social engineering to get the victim to

1137
00:57:53.840 --> 00:57:58.760
<v Speaker 2>the malicious URL. DOM based XSS. This is a more

1138
00:57:58.800 --> 00:58:01.960
<v Speaker 2>subtle variant, where the vulnerability exists entirely in the client

1139
00:58:02.039 --> 00:58:04.960
<v Speaker 2>side JavaScript code running on the page. The server might

1140
00:58:05.000 --> 00:58:07.800
<v Speaker 2>not even see the malicious script, as the injection and

1141
00:58:07.880 --> 00:58:12.280
<v Speaker 2>execution happen purely within the browser's Document Object Model DOM.

1142
00:58:12.719 --> 00:58:15.199
<v Speaker 2>These can be harder to detect with server side standers.

1143
00:58:15.360 --> 00:58:18.559
<v Speaker 1>What can an attacker do with XSS if it just

1144
00:58:18.639 --> 00:58:19.519
<v Speaker 1>runs in the browser.

1145
00:58:19.760 --> 00:58:22.239
<v Speaker 2>JavaScript running in a browser context can still do a

1146
00:58:22.239 --> 00:58:25.360
<v Speaker 2>lot of damage. It can steal the user session cookies

1147
00:58:25.400 --> 00:58:28.159
<v Speaker 2>for that website, allowing the attacker to hijack their logged

1148
00:58:28.159 --> 00:58:30.480
<v Speaker 2>in session. It can rewrite parts of the current web

1149
00:58:30.480 --> 00:58:34.079
<v Speaker 2>page to display fake log informs or misleading information. It

1150
00:58:34.079 --> 00:58:36.840
<v Speaker 2>can redirect the user to malicious websites. It can perform

1151
00:58:36.880 --> 00:58:39.159
<v Speaker 2>actions on the website as the logged in user without

1152
00:58:39.159 --> 00:58:42.480
<v Speaker 2>their knowledge, eg change their passwords, send messages, transfer funds

1153
00:58:42.480 --> 00:58:43.440
<v Speaker 2>if it's a banking site.

1154
00:58:43.480 --> 00:58:46.760
<v Speaker 1>Wow. All from injecting script into a page.

1155
00:58:46.400 --> 00:58:51.440
<v Speaker 2>And remember BEEF. The Browser Exploitation Framework EXSS is the

1156
00:58:51.480 --> 00:58:54.480
<v Speaker 2>perfect way to deliver the BEEF hook. If you find

1157
00:58:54.519 --> 00:58:58.239
<v Speaker 2>a stored XSS vulnerability on a popular website, you can

1158
00:58:58.239 --> 00:59:02.280
<v Speaker 2>inject the beef hookscript as your PAYOEAD. Then every user

1159
00:59:02.320 --> 00:59:05.639
<v Speaker 2>who visits that compromised page gets automatically hooked into your

1160
00:59:05.679 --> 00:59:08.719
<v Speaker 2>BEEF console, giving your remote control over the browser session

1161
00:59:08.760 --> 00:59:10.400
<v Speaker 2>through all the module's BEEF offers.

1162
00:59:10.480 --> 00:59:13.320
<v Speaker 1>That connects the dots nicely. XSS delivers the hook for BEEF.

1163
00:59:13.360 --> 00:59:15.559
<v Speaker 2>It's a very common and powerful combination.

1164
00:59:15.840 --> 00:59:18.360
<v Speaker 1>So how do websites protect against EXSS?

1165
00:59:18.679 --> 00:59:21.960
<v Speaker 2>Again comes down to handling user inputs securely. The main

1166
00:59:22.000 --> 00:59:26.280
<v Speaker 2>defense is output encoding or escaping. Whenever usery supplied data

1167
00:59:26.320 --> 00:59:28.880
<v Speaker 2>is displayed back on a web page, the application should

1168
00:59:28.920 --> 00:59:33.000
<v Speaker 2>escape potentially dangerous HTML characters. For example, the character should

1169
00:59:33.000 --> 00:59:36.159
<v Speaker 2>be converted to NELT to NGS to end quote. This

1170
00:59:36.239 --> 00:59:39.639
<v Speaker 2>ensures that even if the user injects script exss script,

1171
00:59:39.880 --> 00:59:42.599
<v Speaker 2>the browser literally displays that text on the page instead

1172
00:59:42.599 --> 00:59:46.679
<v Speaker 2>of interpreting it as executable script tags. Content Security policy

1173
00:59:46.800 --> 00:59:50.679
<v Speaker 2>CSP headers are also a powerful defense mechanism, and user

1174
00:59:50.760 --> 00:59:55.079
<v Speaker 2>vigilance helps to being wary of suspicious links, checking for HTTPS,

1175
00:59:55.280 --> 00:59:57.360
<v Speaker 2>not installing untrusted browser extensions.

1176
00:59:57.519 --> 01:00:01.000
<v Speaker 1>Okay, that's an incredible overview of major web bloeulnerabilities. It

1177
01:00:01.039 --> 01:00:03.519
<v Speaker 1>seems like finding these manually requires a lot of skill

1178
01:00:03.599 --> 01:00:06.480
<v Speaker 1>and patients. Are there tools to help automate the discovery,

1179
01:00:06.599 --> 01:00:08.360
<v Speaker 1>similar to squamap for Sooley.

1180
01:00:08.760 --> 01:00:11.639
<v Speaker 2>Yes, while manual testing is crucial for understanding and finding

1181
01:00:11.639 --> 01:00:15.559
<v Speaker 2>complex flaws, there are automated web vulnerability scanners. A very

1182
01:00:15.599 --> 01:00:19.400
<v Speaker 2>popular open source one is OSPZP, which stands for the

1183
01:00:19.519 --> 01:00:21.840
<v Speaker 2>z Attack Proxy OSPZP.

1184
01:00:22.199 --> 01:00:22.920
<v Speaker 1>How does it work?

1185
01:00:23.199 --> 01:00:26.760
<v Speaker 2>ZAP typically runs as a proxy server on your local machine.

1186
01:00:27.119 --> 01:00:29.079
<v Speaker 2>You can figure your web browser to send all its

1187
01:00:29.119 --> 01:00:33.760
<v Speaker 2>traffic through the ZA proxy as you browse the target website. Normally,

1188
01:00:34.199 --> 01:00:37.960
<v Speaker 2>ZAP passively observes all the requests and responses. It can

1189
01:00:38.000 --> 01:00:40.960
<v Speaker 2>also actively spider the website to discover all its pages

1190
01:00:41.000 --> 01:00:44.320
<v Speaker 2>and links. Then you can tell ZAP to actively scan

1191
01:00:44.440 --> 01:00:48.679
<v Speaker 2>the discovered pages for common vulnerabilities like SQL injection, cross

1192
01:00:48.679 --> 01:00:52.840
<v Speaker 2>site scripting, file inclusion insecure configurations, and many others.

1193
01:00:52.960 --> 01:00:56.199
<v Speaker 1>So it acts like an automated ethical hacker trying common.

1194
01:00:55.880 --> 01:00:59.519
<v Speaker 2>Attacks in a way. Yes, it sends crafted requests with

1195
01:00:59.559 --> 01:01:02.400
<v Speaker 2>attack payloads and analyzes the responses to see if the

1196
01:01:02.440 --> 01:01:06.480
<v Speaker 2>application behaves in a vulnerable way. ZAP can generate detailed

1197
01:01:06.519 --> 01:01:10.599
<v Speaker 2>reports outlining the potential risks it found, categorizing them by severity,

1198
01:01:10.880 --> 01:01:13.760
<v Speaker 2>and often providing the specific URL and parameter that appears

1199
01:01:13.800 --> 01:01:16.239
<v Speaker 2>to be vulnerable, giving you a great starting point for

1200
01:01:16.320 --> 01:01:18.599
<v Speaker 2>manual verification and deeper exploitation.

1201
01:01:18.960 --> 01:01:21.159
<v Speaker 1>So it's a good backup or starting point, but maybe

1202
01:01:21.159 --> 01:01:23.880
<v Speaker 1>doesn't replace manual testing entirely exactly.

1203
01:01:24.000 --> 01:01:27.320
<v Speaker 2>Automated scanners like ZAP are excellent for finding low hanging

1204
01:01:27.320 --> 01:01:30.280
<v Speaker 2>fruit and ensuring broad coverage, but they can miss more

1205
01:01:30.320 --> 01:01:34.599
<v Speaker 2>complex logic based vulnerabilities that require human understanding of the

1206
01:01:34.639 --> 01:01:39.199
<v Speaker 2>application's context. They also sometimes produce false positives, so they

1207
01:01:39.199 --> 01:01:42.599
<v Speaker 2>are best used in conjunction with manual testing, not as

1208
01:01:42.639 --> 01:01:43.599
<v Speaker 2>a complete replacement.

1209
01:01:43.719 --> 01:01:47.199
<v Speaker 1>Makes sense. Wow, We have covered a staggering amount of

1210
01:01:47.239 --> 01:01:49.599
<v Speaker 1>ground in this deep dive. I mean, from setting up

1211
01:01:49.639 --> 01:01:53.480
<v Speaker 1>virtual hacking labs, understanding the nuances of network attacks like

1212
01:01:53.719 --> 01:01:58.000
<v Speaker 1>MI spoofing and MITM, the psychology of social engineering client

1213
01:01:58.039 --> 01:02:02.079
<v Speaker 1>side versus server side exploits, post exploisation, pivoting, and now

1214
01:02:02.119 --> 01:02:05.719
<v Speaker 1>this whole world of web application vulnerabilities like SEQL and EXSS.

1215
01:02:05.800 --> 01:02:08.519
<v Speaker 2>It's a lot, definitely, But what I hope stands out

1216
01:02:08.519 --> 01:02:10.719
<v Speaker 2>to you, the listener, is that ethical hacking isn't just

1217
01:02:10.800 --> 01:02:13.199
<v Speaker 2>about breaking in for the sake of it. It's really

1218
01:02:13.239 --> 01:02:16.000
<v Speaker 2>about deeply understanding how these complex systems are built, how

1219
01:02:16.000 --> 01:02:20.199
<v Speaker 2>the interact, and crucially, how they can fail or be manipulated. Also,

1220
01:02:20.280 --> 01:02:22.480
<v Speaker 2>they can ultimately be made more resilient and secure.

1221
01:02:22.639 --> 01:02:26.239
<v Speaker 1>That core lesson seems clear. Knowledge is power, not just

1222
01:02:26.280 --> 01:02:28.480
<v Speaker 1>for offense, but critically for defense.

1223
01:02:28.719 --> 01:02:33.400
<v Speaker 2>Precisely understanding the attacker's mindset, tools and techniques is arguably

1224
01:02:33.440 --> 01:02:35.639
<v Speaker 2>the best way to build effective defenses against them.

1225
01:02:35.760 --> 01:02:40.880
<v Speaker 1>We explored some incredibly sophisticated tools today metasploit, veil, multigo,

1226
01:02:41.199 --> 01:02:47.519
<v Speaker 1>beef wireshark, squall, map zap, each one revealing a different

1227
01:02:47.559 --> 01:02:51.320
<v Speaker 1>facet of this complex digital security landscape. It's honestly a

1228
01:02:51.400 --> 01:02:54.960
<v Speaker 1>profound reminder that our everyday online interactions, things we take

1229
01:02:55.000 --> 01:02:58.000
<v Speaker 1>for granted, like browsing a website or logging into an account,

1230
01:02:58.239 --> 01:03:02.960
<v Speaker 1>involve these intricate layers of technolog layers that can be misunderstood, misconfigured,

1231
01:03:03.079 --> 01:03:04.760
<v Speaker 1>or actively exploited.

1232
01:03:04.599 --> 01:03:07.000
<v Speaker 2>And that naturally leads to an important question. I think,

1233
01:03:07.199 --> 01:03:10.880
<v Speaker 2>considering how deeply interconnected our digital lives are now and

1234
01:03:10.920 --> 01:03:14.559
<v Speaker 2>seeing how these vulnerabilities work, how might a deeper understanding

1235
01:03:14.559 --> 01:03:17.559
<v Speaker 2>of these threats encourage you personally or professionally to approach

1236
01:03:17.599 --> 01:03:20.559
<v Speaker 2>your own cybersecurity differently, maybe moving beyond just the basic

1237
01:03:20.599 --> 01:03:23.960
<v Speaker 2>precautions like using strong passwords towards a more informed, maybe

1238
01:03:24.000 --> 01:03:26.480
<v Speaker 2>more proactive stance. Something to think about.

1239
01:03:26.639 --> 01:03:29.760
<v Speaker 1>Ah, that's a perfect closing thought, A challenge really for

1240
01:03:29.960 --> 01:03:32.280
<v Speaker 1>all of us. Thanks for diving deep with us today

1241
01:03:32.280 --> 01:03:35.039
<v Speaker 1>into the world of ethical hacking. It's been truly enlightening.

1242
01:03:35.119 --> 01:03:38.360
<v Speaker 1>Until next time, stay curious, stay informed, and most importantly,

1243
01:03:38.440 --> 01:03:39.159
<v Speaker 1>stay secure.