WEBVTT

1
00:00:00.040 --> 00:00:03.480
<v Speaker 1>Hey everyone, and welcome back for another deep dive. Today,

2
00:00:04.080 --> 00:00:06.240
<v Speaker 1>we're going to be cracking open the world of web

3
00:00:06.280 --> 00:00:07.400
<v Speaker 1>penetration testing.

4
00:00:07.559 --> 00:00:08.519
<v Speaker 2>Ooh exciting.

5
00:00:08.800 --> 00:00:14.119
<v Speaker 1>Yeah, so you're curious about how to you know, find

6
00:00:14.199 --> 00:00:18.359
<v Speaker 1>vulnerabilities and websites, right, like everybody is. So to guide

7
00:00:18.399 --> 00:00:22.120
<v Speaker 1>us today, we have excerpts from Practical Web Penetration Testing

8
00:00:22.280 --> 00:00:23.079
<v Speaker 1>by Gus.

9
00:00:22.839 --> 00:00:24.239
<v Speaker 2>Kawaja excellent source.

10
00:00:24.359 --> 00:00:28.480
<v Speaker 1>Yeah, and it's published by Packed Publishing. Okay, so this

11
00:00:28.600 --> 00:00:31.039
<v Speaker 1>might sound a little intimidating, but don't worry it can be.

12
00:00:31.239 --> 00:00:33.439
<v Speaker 1>We are here to make it fun and easy to understand.

13
00:00:33.600 --> 00:00:34.039
<v Speaker 2>That's us.

14
00:00:34.200 --> 00:00:37.000
<v Speaker 1>We'll even touch on some pretty cool tools like burp sweet,

15
00:00:37.159 --> 00:00:40.039
<v Speaker 1>which is like having X ray vision for web traffic ooh,

16
00:00:40.399 --> 00:00:44.880
<v Speaker 1>and even metasploit, which is like a hackers Swiss army knife.

17
00:00:45.119 --> 00:00:49.119
<v Speaker 2>Nice. So yeah, it's a fascinating journey, yeah, from building

18
00:00:49.119 --> 00:00:51.759
<v Speaker 2>your own hacking lab, oh yeah, to actually thinking like

19
00:00:51.799 --> 00:00:53.960
<v Speaker 2>a hacker. Yeah. And the book it lays it all

20
00:00:53.960 --> 00:00:56.759
<v Speaker 2>out in the way that really anyone can grasp.

21
00:00:56.840 --> 00:00:59.640
<v Speaker 1>Yeah for sure. So let's start with the basics. You know,

22
00:00:59.759 --> 00:01:02.439
<v Speaker 1>to practice hacking, you need a safe space to play, right,

23
00:01:02.960 --> 00:01:06.280
<v Speaker 1>So this book it walks you through setting up your

24
00:01:06.319 --> 00:01:07.719
<v Speaker 1>own virtual hacking lab.

25
00:01:07.959 --> 00:01:10.760
<v Speaker 2>It's like building your own digital playground. And this book

26
00:01:11.239 --> 00:01:16.799
<v Speaker 2>it uses this vulnerable web application called Mutiliday mutildy. Yeah,

27
00:01:16.799 --> 00:01:18.760
<v Speaker 2>it's kind of a weird name, I know. Yeah, it's

28
00:01:18.760 --> 00:01:22.439
<v Speaker 2>a type of ant, but the name kind of fits

29
00:01:22.640 --> 00:01:25.159
<v Speaker 2>I think because it lets you poke around, okay and

30
00:01:25.200 --> 00:01:27.040
<v Speaker 2>dissect it and you can set it up on either

31
00:01:27.040 --> 00:01:28.400
<v Speaker 2>Windows or open to Linux.

32
00:01:28.599 --> 00:01:32.840
<v Speaker 1>Okay. So like most major operating systems, yeah, exactly, and

33
00:01:32.879 --> 00:01:36.040
<v Speaker 1>the book makes it surprisingly easy even if you're not,

34
00:01:36.480 --> 00:01:39.359
<v Speaker 1>you know, a tech whiz. It really does installing things

35
00:01:39.359 --> 00:01:43.120
<v Speaker 1>like XMPP, which might sound a little intimidating, right, it's

36
00:01:43.159 --> 00:01:45.400
<v Speaker 1>a breeze with the step by step instructions.

37
00:01:45.480 --> 00:01:48.079
<v Speaker 2>The book really does hold your hand through that whole setup. Yeah.

38
00:01:48.120 --> 00:01:49.680
<v Speaker 2>But once you have your lab up and running, it's

39
00:01:49.680 --> 00:01:53.120
<v Speaker 2>time to meet your new best friend, Collie Linux.

40
00:01:53.159 --> 00:01:56.640
<v Speaker 1>Ah, Callie Linux. Yeah, the go to operating system for

41
00:01:56.760 --> 00:02:00.760
<v Speaker 1>penetration testers. Absolutely, it's like this toolbox act with everything

42
00:02:00.799 --> 00:02:03.079
<v Speaker 1>you need for like digital detective work. Right.

43
00:02:03.280 --> 00:02:03.640
<v Speaker 2>Yeah.

44
00:02:03.680 --> 00:02:07.799
<v Speaker 1>So the book it covers installation and configuration and even

45
00:02:07.840 --> 00:02:11.919
<v Speaker 1>how to navigate that command line which mandline Yeah can

46
00:02:11.960 --> 00:02:14.599
<v Speaker 1>seem a little scary at first, right, but it's where

47
00:02:14.639 --> 00:02:16.039
<v Speaker 1>the real magic happens.

48
00:02:16.520 --> 00:02:18.800
<v Speaker 2>It is. It's like learning a secret language that lets

49
00:02:18.840 --> 00:02:21.560
<v Speaker 2>you talk directly to the computer's core. Okay, you know.

50
00:02:22.039 --> 00:02:25.680
<v Speaker 2>And the book dives into some essential concepts for setting

51
00:02:25.759 --> 00:02:30.280
<v Speaker 2>up your virtual Collie machine, like the difference between bridged

52
00:02:30.840 --> 00:02:35.599
<v Speaker 2>net and internal network configurations. Ah okay, These determine how

53
00:02:35.639 --> 00:02:39.560
<v Speaker 2>your virtual machine interacts with your actual network. Okay, and

54
00:02:39.719 --> 00:02:42.719
<v Speaker 2>understanding that is key to making sure you're playing safely

55
00:02:43.000 --> 00:02:44.840
<v Speaker 2>yeah in your little digital sandbox.

56
00:02:44.960 --> 00:02:46.759
<v Speaker 1>Right, so you don't want to don't want to mess

57
00:02:46.800 --> 00:02:49.840
<v Speaker 1>up your break anything your actual computer, right right. It's

58
00:02:49.879 --> 00:02:52.080
<v Speaker 1>like learning the rules of the road before you start

59
00:02:52.120 --> 00:02:54.479
<v Speaker 1>like driving your virtual hacking machine around.

60
00:02:55.639 --> 00:02:56.400
<v Speaker 2>Good analogy.

61
00:02:56.680 --> 00:02:59.000
<v Speaker 1>So, speaking of secrets, did you know that the shadow

62
00:02:59.039 --> 00:03:03.080
<v Speaker 1>file and call is where like those hashed passwords are stored.

63
00:03:03.280 --> 00:03:05.479
<v Speaker 2>Oh yeah, it's like a little digital vault, and we'll

64
00:03:05.520 --> 00:03:07.919
<v Speaker 2>learn how to peek inside and see how those passwords

65
00:03:07.960 --> 00:03:08.400
<v Speaker 2>are protected.

66
00:03:08.439 --> 00:03:10.520
<v Speaker 1>Okay, so we get to see how the sausage is made.

67
00:03:10.400 --> 00:03:15.039
<v Speaker 2>Exactly how it's made. EO. Now onto another powerful tool,

68
00:03:15.879 --> 00:03:19.680
<v Speaker 2>burp suite. Oh yeah, this is where things get really

69
00:03:19.759 --> 00:03:23.879
<v Speaker 2>really interesting because burp suite is like having X ray vision. Yeah,

70
00:03:23.919 --> 00:03:24.840
<v Speaker 2>for web traffic.

71
00:03:25.159 --> 00:03:25.800
<v Speaker 1>It's true.

72
00:03:26.000 --> 00:03:26.560
<v Speaker 2>It's amazing.

73
00:03:26.639 --> 00:03:30.759
<v Speaker 1>Burpsweet acts like a web proxy sitting between your browser

74
00:03:31.120 --> 00:03:33.159
<v Speaker 1>and the website you're visiting, right, so you can see

75
00:03:33.159 --> 00:03:35.719
<v Speaker 1>all the requests and responses going back and forth.

76
00:03:35.840 --> 00:03:39.039
<v Speaker 2>It's like watching a secret conversation unfold. Yeah, right in

77
00:03:39.039 --> 00:03:39.400
<v Speaker 2>front of you.

78
00:03:39.400 --> 00:03:42.719
<v Speaker 1>You're spying on them. So what's really fascinating is that

79
00:03:42.840 --> 00:03:47.360
<v Speaker 1>you can actually modify those requests and responses in real time.

80
00:03:47.639 --> 00:03:50.400
<v Speaker 2>Yes, you can. Wow. So you can use Burke Suite

81
00:03:50.439 --> 00:03:54.879
<v Speaker 2>to crawl an entire website, poking and prodding for vulnerabilities,

82
00:03:55.240 --> 00:03:58.280
<v Speaker 2>and you can even craft your own custom attacks. Really,

83
00:03:58.360 --> 00:03:59.159
<v Speaker 2>it's incredible.

84
00:03:59.240 --> 00:04:00.599
<v Speaker 1>So it's like a hacker toolkit.

85
00:04:01.080 --> 00:04:05.039
<v Speaker 2>Yes, at your Fingertipszy and Burps.

86
00:04:05.039 --> 00:04:08.120
<v Speaker 1>We can also analyze a website structure to help you

87
00:04:08.199 --> 00:04:12.080
<v Speaker 1>pinpoint weaknesses. It can, so it's like a bloodhound sniffing

88
00:04:12.120 --> 00:04:13.120
<v Speaker 1>out vulnerabilities.

89
00:04:13.199 --> 00:04:13.840
<v Speaker 2>It really is.

90
00:04:14.000 --> 00:04:18.360
<v Speaker 1>That's really cool. Yeah, so let's talk about the vulnerabilities themselves. Okay,

91
00:04:18.519 --> 00:04:21.839
<v Speaker 1>the book it breaks down common web vulnerabilities in a

92
00:04:21.879 --> 00:04:24.920
<v Speaker 1>way that's really easy to understand, even if you don't code.

93
00:04:25.079 --> 00:04:26.120
<v Speaker 2>It does. It does.

94
00:04:26.240 --> 00:04:29.720
<v Speaker 1>For example, let's talk about file inclusion vulnerabilities.

95
00:04:29.839 --> 00:04:33.000
<v Speaker 2>So imagine an attacker finding a way to exploit a

96
00:04:33.000 --> 00:04:37.399
<v Speaker 2>website's code and access sensitive files on the server. Okay,

97
00:04:37.680 --> 00:04:41.120
<v Speaker 2>things like configuration files or even password databases. Oh wow,

98
00:04:41.160 --> 00:04:44.279
<v Speaker 2>in a worst case scenario. Right, So that's a file

99
00:04:44.319 --> 00:04:46.120
<v Speaker 2>inclusion vulnerability in a nutshell.

100
00:04:46.240 --> 00:04:48.920
<v Speaker 1>Okay, so like getting access to things that you shouldn't

101
00:04:48.920 --> 00:04:49.639
<v Speaker 1>have access.

102
00:04:49.319 --> 00:04:50.240
<v Speaker 2>To, exactly, got it?

103
00:04:50.360 --> 00:04:52.959
<v Speaker 1>Yeah, and what about cross site scripting. I've heard that

104
00:04:53.079 --> 00:04:55.360
<v Speaker 1>term thrown around, but I'm not entirely sure what it means.

105
00:04:55.560 --> 00:04:59.240
<v Speaker 2>Yes, So, cross site scripting or EXSS is basically when

106
00:04:59.279 --> 00:05:05.439
<v Speaker 2>an attacker injects malicious scripts, usually JavaScript, into a website. Okay,

107
00:05:05.519 --> 00:05:08.160
<v Speaker 2>it's like planting a little trap that can steal user

108
00:05:08.240 --> 00:05:11.800
<v Speaker 2>data okay, hijack their accounts oh wow, or even take

109
00:05:11.800 --> 00:05:12.879
<v Speaker 2>control of their browser.

110
00:05:13.439 --> 00:05:14.519
<v Speaker 1>That's really scary.

111
00:05:14.920 --> 00:05:15.680
<v Speaker 2>Yeah it can be.

112
00:05:15.800 --> 00:05:18.560
<v Speaker 1>So it's like slipping a secret note into a message

113
00:05:18.600 --> 00:05:21.959
<v Speaker 1>and tricking the recipient into doing something that they didn't intend.

114
00:05:22.240 --> 00:05:23.319
<v Speaker 2>That's a great analogy.

115
00:05:23.560 --> 00:05:27.560
<v Speaker 1>Thanks. So the book dives into different types of EXSS attacks,

116
00:05:27.720 --> 00:05:31.680
<v Speaker 1>like stored, reflected, and dom based, each with their own

117
00:05:31.759 --> 00:05:35.439
<v Speaker 1>little quirks and dangers they do. So lots of variety there, Yeah,

118
00:05:35.519 --> 00:05:37.680
<v Speaker 1>lots of variety. Okay. Starting to make sense.

119
00:05:37.759 --> 00:05:38.279
<v Speaker 2>Now good.

120
00:05:38.439 --> 00:05:41.439
<v Speaker 1>Another term I've heard is CSRF.

121
00:05:40.839 --> 00:05:45.160
<v Speaker 2>Right, Cross site request forgery or CSRF is another sneaky one.

122
00:05:45.319 --> 00:05:45.680
<v Speaker 1>Okay.

123
00:05:45.920 --> 00:05:50.319
<v Speaker 2>It tricks users into performing actions they didn't intend to do. Okay,

124
00:05:50.639 --> 00:05:53.519
<v Speaker 2>like unknowingly making a post on their social media or

125
00:05:53.680 --> 00:05:56.959
<v Speaker 2>even transferring money from their bank account. Oh wow, so

126
00:05:57.519 --> 00:05:58.199
<v Speaker 2>that's a bad one.

127
00:05:58.240 --> 00:06:03.639
<v Speaker 1>It's like really devious, it is? It is anything else

128
00:06:03.680 --> 00:06:05.879
<v Speaker 1>we should be aware of on our vulnerability watch lists.

129
00:06:06.319 --> 00:06:10.319
<v Speaker 2>Yes, you can't forget the classic sequel injection. This was

130
00:06:10.319 --> 00:06:14.480
<v Speaker 2>a favorite among attackers because databases hold a treasure trove

131
00:06:14.639 --> 00:06:15.839
<v Speaker 2>of sensitive information.

132
00:06:16.079 --> 00:06:17.079
<v Speaker 1>Oh yeah, for sure.

133
00:06:17.160 --> 00:06:18.519
<v Speaker 2>Yeah, so it's a popular one.

134
00:06:18.759 --> 00:06:20.360
<v Speaker 1>So how does SQL injection work?

135
00:06:20.600 --> 00:06:25.079
<v Speaker 2>Well, it involves manipulating the way a website talks to

136
00:06:25.120 --> 00:06:28.639
<v Speaker 2>its database. Okay, So imagine being able to slip in

137
00:06:29.120 --> 00:06:32.800
<v Speaker 2>a secret command that forces the database to spill all

138
00:06:32.839 --> 00:06:36.240
<v Speaker 2>of its secrets. Okay, or even give you control over

139
00:06:36.279 --> 00:06:40.759
<v Speaker 2>the entire system. Oh wow, that's the power of SEQL injection.

140
00:06:40.959 --> 00:06:42.160
<v Speaker 1>That sounds pretty scary.

141
00:06:42.240 --> 00:06:44.800
<v Speaker 2>It can be, Yeah, it really can be. And the

142
00:06:44.839 --> 00:06:48.319
<v Speaker 2>book uses utiliday our vulnerable web app to show you

143
00:06:48.360 --> 00:06:51.000
<v Speaker 2>exactly how this attack works. You actually get to see

144
00:06:51.040 --> 00:06:55.920
<v Speaker 2>how in SQL injection can completely bypass logins and expose

145
00:06:56.000 --> 00:06:57.319
<v Speaker 2>all sorts of sensitive data.

146
00:06:57.959 --> 00:07:00.319
<v Speaker 1>That's pretty cool it is. Now that's what I call

147
00:07:00.360 --> 00:07:02.959
<v Speaker 1>hands on learning. Yeah, so we've got our lab set up,

148
00:07:03.000 --> 00:07:06.160
<v Speaker 1>we're getting cozy with Callie Linux and yes, burp Suite,

149
00:07:06.920 --> 00:07:09.480
<v Speaker 1>and we're starting to get a handle on some common

150
00:07:09.639 --> 00:07:12.959
<v Speaker 1>web vulnerabilities. So what's next in our journey to becoming

151
00:07:12.959 --> 00:07:13.839
<v Speaker 1>an ethical hacker?

152
00:07:14.040 --> 00:07:15.759
<v Speaker 2>Okay? So now we're going to step into the world

153
00:07:15.800 --> 00:07:18.439
<v Speaker 2>of professional penetration testing.

154
00:07:18.519 --> 00:07:20.959
<v Speaker 1>Professional so like people get paid to do this.

155
00:07:21.120 --> 00:07:25.959
<v Speaker 2>They do they do. Really, companies hire ethical hackers also

156
00:07:26.000 --> 00:07:31.000
<v Speaker 2>known as penetration testers okay, to find vulnerabilities okay, before

157
00:07:31.040 --> 00:07:33.240
<v Speaker 2>the bad guys do. Okay, And the book kind of

158
00:07:33.279 --> 00:07:36.959
<v Speaker 2>walks us through how a real world engagement unfolds.

159
00:07:37.000 --> 00:07:40.000
<v Speaker 1>So it's not just randomly like hacking into websites. No,

160
00:07:40.240 --> 00:07:42.519
<v Speaker 1>there's an actual strategy involved.

161
00:07:42.600 --> 00:07:46.000
<v Speaker 2>There is a very deliberate process, okay, and it starts

162
00:07:46.040 --> 00:07:48.480
<v Speaker 2>with what's called the pre engagement phase.

163
00:07:48.639 --> 00:07:50.319
<v Speaker 1>Pre engagement okay, tell me more.

164
00:07:50.519 --> 00:07:53.199
<v Speaker 2>So it's all about preparation okay, and planning.

165
00:07:53.360 --> 00:07:53.680
<v Speaker 1>Okay.

166
00:07:53.759 --> 00:07:57.639
<v Speaker 2>So penetration testers they gather information about the target, the company,

167
00:07:57.879 --> 00:08:01.680
<v Speaker 2>their systems, their web applications define the scope of the engagement.

168
00:08:01.759 --> 00:08:02.879
<v Speaker 1>Okay, So they do their homework.

169
00:08:02.920 --> 00:08:05.360
<v Speaker 2>They do their homework before they even touch a keyboard.

170
00:08:06.040 --> 00:08:10.079
<v Speaker 2>And a crucial part of this phase is communication. Ah.

171
00:08:10.360 --> 00:08:13.560
<v Speaker 2>Penetration testers need to be upfront with the client about

172
00:08:13.560 --> 00:08:14.079
<v Speaker 2>what they'll be.

173
00:08:14.040 --> 00:08:17.639
<v Speaker 1>Doing, how they'll be doing it, what the expected outcomes are.

174
00:08:18.160 --> 00:08:20.920
<v Speaker 2>So it's not just about the technical skills, no, it's

175
00:08:20.920 --> 00:08:24.040
<v Speaker 2>about communication, yes, and professionalism as well.

176
00:08:24.240 --> 00:08:24.560
<v Speaker 1>It is.

177
00:08:24.920 --> 00:08:27.879
<v Speaker 2>I'm guessing there are different approaches to penetration testing.

178
00:08:28.000 --> 00:08:31.759
<v Speaker 1>There are There are three main types, black box, gray

179
00:08:31.800 --> 00:08:35.320
<v Speaker 1>box and white box testing. Okay, so imagine it like this.

180
00:08:36.519 --> 00:08:40.519
<v Speaker 1>Black box testing is like going into a maze blindfolded.

181
00:08:40.840 --> 00:08:42.080
<v Speaker 2>Oh wow, you have.

182
00:08:42.080 --> 00:08:44.399
<v Speaker 1>No knowledge of the layout. Yeah, you have to rely

183
00:08:44.519 --> 00:08:46.399
<v Speaker 1>on your senses to find your way through.

184
00:08:46.600 --> 00:08:48.759
<v Speaker 2>Sounds challenging, it can be okay.

185
00:08:48.879 --> 00:08:51.360
<v Speaker 1>Then there's grey box testing okay, and that's more like

186
00:08:51.399 --> 00:08:54.919
<v Speaker 1>having a map of the maze. Okay, but some areas

187
00:08:54.960 --> 00:08:57.799
<v Speaker 1>are blurred out. You have some knowledge, but not the

188
00:08:57.840 --> 00:08:59.600
<v Speaker 1>complete picture, so you have a little bit of a

189
00:08:59.639 --> 00:09:02.000
<v Speaker 1>headste a little bit of a headstart. Ok And then

190
00:09:02.000 --> 00:09:06.360
<v Speaker 1>there's white box testing okay, and that's like having the

191
00:09:06.559 --> 00:09:09.840
<v Speaker 1>complete map of the maze, including all the secret passages

192
00:09:09.879 --> 00:09:10.639
<v Speaker 1>and shortcuts.

193
00:09:10.720 --> 00:09:13.200
<v Speaker 2>So it's like having insider information.

194
00:09:13.600 --> 00:09:14.360
<v Speaker 1>You could say that.

195
00:09:14.440 --> 00:09:19.120
<v Speaker 2>Okay, and each approach has its own advantages and disadvantages. Yeah,

196
00:09:19.159 --> 00:09:21.879
<v Speaker 2>and the choice really depends on the client's needs and

197
00:09:21.919 --> 00:09:23.840
<v Speaker 2>the goals of the penetration test.

198
00:09:24.000 --> 00:09:29.799
<v Speaker 1>Got it. So black box, blindfolded, gray box, a little

199
00:09:29.840 --> 00:09:32.039
<v Speaker 1>bit of a map, and white box you have the

200
00:09:32.080 --> 00:09:32.759
<v Speaker 1>full blueprint.

201
00:09:32.840 --> 00:09:33.320
<v Speaker 2>You got it?

202
00:09:33.440 --> 00:09:36.000
<v Speaker 1>Okay. What happens after the pre engagement phase?

203
00:09:36.039 --> 00:09:38.000
<v Speaker 2>Okay, this is where we actually put on our hacker

204
00:09:38.080 --> 00:09:41.879
<v Speaker 2>hats ooh and start thinking like the bad guys. Okay,

205
00:09:41.960 --> 00:09:45.120
<v Speaker 2>but before we could dive into the technical stuff. Professional

206
00:09:45.159 --> 00:09:49.600
<v Speaker 2>penetration testers, they engage in something called threat modeling.

207
00:09:49.919 --> 00:09:51.799
<v Speaker 1>Threat modeling, Okay, break that down for me.

208
00:09:51.919 --> 00:09:57.200
<v Speaker 2>So it's all about systematically analyzing the application to identify

209
00:09:57.320 --> 00:09:58.799
<v Speaker 2>potential vulnerabilities.

210
00:09:59.000 --> 00:09:59.240
<v Speaker 1>Okay.

211
00:09:59.440 --> 00:10:02.559
<v Speaker 2>Imagine a hacker trying to break into a building. You'd

212
00:10:02.600 --> 00:10:06.720
<v Speaker 2>scout it out, look for weak points, plan your attack Accordingly,

213
00:10:07.279 --> 00:10:09.960
<v Speaker 2>threat modeling is basically doing that for a web application.

214
00:10:10.320 --> 00:10:13.000
<v Speaker 1>So they're trying to anticipate how a hacker might target

215
00:10:13.039 --> 00:10:13.960
<v Speaker 1>the system.

216
00:10:13.759 --> 00:10:17.000
<v Speaker 2>Exactly, got it. It's a very proactive approach to secure

217
00:10:17.120 --> 00:10:17.679
<v Speaker 2>so it's not.

218
00:10:17.639 --> 00:10:22.080
<v Speaker 1>Just about finding existing vulnerabilities. It's about predicting where future

219
00:10:22.200 --> 00:10:23.559
<v Speaker 1>vulnerabilities might arise.

220
00:10:23.679 --> 00:10:24.759
<v Speaker 2>That's a great way to put it.

221
00:10:24.799 --> 00:10:25.080
<v Speaker 1>Thanks.

222
00:10:25.200 --> 00:10:29.840
<v Speaker 2>It's about understanding the application's attack surface okay, and identifying

223
00:10:29.879 --> 00:10:31.519
<v Speaker 2>potential points of failure, so.

224
00:10:31.559 --> 00:10:33.480
<v Speaker 1>Like a weak spot, yes, okay.

225
00:10:33.600 --> 00:10:37.039
<v Speaker 2>And a key part of threat modeling is actually creating

226
00:10:37.080 --> 00:10:41.639
<v Speaker 2>a visual representation of how data moves through the application, okay.

227
00:10:42.159 --> 00:10:45.039
<v Speaker 2>And that's called a data flow diagram or DFD.

228
00:10:44.879 --> 00:10:46.000
<v Speaker 1>Data flow diagram Okay.

229
00:10:46.000 --> 00:10:48.240
<v Speaker 2>Taking that so it's like a map of the application's

230
00:10:48.240 --> 00:10:52.080
<v Speaker 2>nervous system. It shows how data enters and exits the system,

231
00:10:52.440 --> 00:10:56.039
<v Speaker 2>the processes it goes through, and where it's stored. And

232
00:10:56.120 --> 00:11:01.200
<v Speaker 2>this helps penetration testers identify potential weak pointoints where data

233
00:11:01.279 --> 00:11:03.080
<v Speaker 2>might be exposed or even tampered with.

234
00:11:03.279 --> 00:11:06.679
<v Speaker 1>So it's like creating a blueprint for hacking, but in reverse.

235
00:11:06.960 --> 00:11:10.679
<v Speaker 2>Yes, exactly. And once they have this map, they use

236
00:11:10.720 --> 00:11:14.919
<v Speaker 2>it to identify potential threats okay. They consider things like spoofing,

237
00:11:15.080 --> 00:11:20.320
<v Speaker 2>which is like faking identities, tampering with data, repudiation which

238
00:11:20.360 --> 00:11:26.159
<v Speaker 2>is like denying actions, information disclosure, leaking sensitive data, denial

239
00:11:26.200 --> 00:11:30.799
<v Speaker 2>of service, making the application unavailable, and elevation of privilege,

240
00:11:31.120 --> 00:11:32.639
<v Speaker 2>gaining unauthorized access.

241
00:11:32.799 --> 00:11:35.639
<v Speaker 1>Wow, that's a lot to consider. It is, so it

242
00:11:35.679 --> 00:11:38.559
<v Speaker 1>sounds like they're trying to think of every possible way

243
00:11:38.600 --> 00:11:40.360
<v Speaker 1>that a hacker could attack the system.

244
00:11:40.799 --> 00:11:43.279
<v Speaker 2>That is the goal is to be as thorough as

245
00:11:43.320 --> 00:11:47.720
<v Speaker 2>possible and to help categorize and assess these threats. They

246
00:11:47.799 --> 00:11:50.120
<v Speaker 2>use frameworks like Stride and dread.

247
00:11:50.720 --> 00:11:54.559
<v Speaker 1>Stride and dread, they'll sound like a superhero duo fighting cybercrime.

248
00:11:54.679 --> 00:11:58.320
<v Speaker 2>They do, they do. They actually help penetration testers fight

249
00:11:58.360 --> 00:12:02.840
<v Speaker 2>the bad guys. Okay, Stride it's actually an acronym for

250
00:12:02.919 --> 00:12:07.159
<v Speaker 2>the different types of threats we just talked about spoofing, tampering, repudiation,

251
00:12:07.320 --> 00:12:10.960
<v Speaker 2>information disclosure, denial of service, and elevation of privilege.

252
00:12:11.080 --> 00:12:13.039
<v Speaker 1>So it's a handy way to remember all those.

253
00:12:13.159 --> 00:12:13.480
<v Speaker 2>It is.

254
00:12:13.519 --> 00:12:15.679
<v Speaker 1>It is different ways an attacker might try to exploit

255
00:12:15.679 --> 00:12:16.200
<v Speaker 1>the system.

256
00:12:16.360 --> 00:12:19.519
<v Speaker 2>Absolutely got it, and then dread. It's a framework for

257
00:12:19.679 --> 00:12:26.559
<v Speaker 2>ranking the severity of those threats based on their potential damage, reproducibility, exploitability,

258
00:12:26.600 --> 00:12:29.279
<v Speaker 2>affected users, and discoverability.

259
00:12:29.360 --> 00:12:32.120
<v Speaker 1>Wow. Okay, so a whole bunch of factors, a lot

260
00:12:32.159 --> 00:12:35.879
<v Speaker 1>of factors. So by using these frameworks, penetration testers can

261
00:12:35.919 --> 00:12:40.519
<v Speaker 1>really prioritize which threats pose the most significant risk they

262
00:12:40.559 --> 00:12:43.639
<v Speaker 1>can and need to be addressed first exactly. Okay, And

263
00:12:43.720 --> 00:12:46.840
<v Speaker 1>the book provides a practical example of a completed threat

264
00:12:46.879 --> 00:12:49.480
<v Speaker 1>modeling document showing how it all comes together. It does,

265
00:12:49.600 --> 00:12:52.440
<v Speaker 1>so you can see an example, you can. Awesome. So

266
00:12:52.759 --> 00:12:56.240
<v Speaker 1>we've covered pre engagement and threat modeling. Yes, what's the

267
00:12:56.279 --> 00:12:57.639
<v Speaker 1>next step in this process?

268
00:12:57.679 --> 00:13:02.200
<v Speaker 2>Okay? So once penetration testers they understand the application and

269
00:13:02.240 --> 00:13:05.960
<v Speaker 2>its potential vulnerabilities, they can start digging into the code itself.

270
00:13:06.120 --> 00:13:08.120
<v Speaker 1>Ah. So this is where it gets really technical.

271
00:13:08.320 --> 00:13:10.960
<v Speaker 2>It can be, but it's a crucial part of the process,

272
00:13:11.639 --> 00:13:13.240
<v Speaker 2>and that's where source code review comes in.

273
00:13:13.360 --> 00:13:16.279
<v Speaker 1>Source code review okay, so break that down for me.

274
00:13:16.600 --> 00:13:19.120
<v Speaker 1>What exactly are they looking for in this phase?

275
00:13:19.679 --> 00:13:22.279
<v Speaker 2>So the goal of source code review is to find

276
00:13:22.320 --> 00:13:26.240
<v Speaker 2>those hilly security flaws in the application's code. So it's

277
00:13:26.279 --> 00:13:28.840
<v Speaker 2>like being a detective, right searching for clues at a

278
00:13:28.879 --> 00:13:32.639
<v Speaker 2>crime scene, except the crime scene is lines of code.

279
00:13:32.840 --> 00:13:36.200
<v Speaker 2>It could be a very meticulous process. Yeah, but but

280
00:13:36.519 --> 00:13:40.879
<v Speaker 2>it can reveal vulnerabilities that other testing methods might miss.

281
00:13:41.159 --> 00:13:44.279
<v Speaker 1>So they're reading through the code line by line sometimes

282
00:13:44.279 --> 00:13:46.720
<v Speaker 1>looking for mistakes that could be exploited exactly.

283
00:13:46.919 --> 00:13:49.480
<v Speaker 2>And there are two main approaches to source code review,

284
00:13:50.320 --> 00:13:55.279
<v Speaker 2>manual and automated. So manual code review is like having

285
00:13:55.320 --> 00:13:59.159
<v Speaker 2>a human detective carefully examine every piece of evidence, okay,

286
00:13:59.480 --> 00:14:02.759
<v Speaker 2>whereas automated code review is more like using forensic tools

287
00:14:02.799 --> 00:14:06.759
<v Speaker 2>to scan for specific patterns or anomalies. So it's kind

288
00:14:06.759 --> 00:14:11.320
<v Speaker 2>of combining the power of human intuition and experience with

289
00:14:11.399 --> 00:14:14.519
<v Speaker 2>the efficiency of these automated tools. Best of both worlds,

290
00:14:14.639 --> 00:14:15.399
<v Speaker 2>Best of both worlds.

291
00:14:15.919 --> 00:14:19.320
<v Speaker 1>The book provides a checklist of common secure coding practices,

292
00:14:19.720 --> 00:14:25.360
<v Speaker 1>covering everything from authentication and authorization to session management and

293
00:14:25.480 --> 00:14:29.440
<v Speaker 1>data validation. It does so it's like having a guidebook

294
00:14:29.519 --> 00:14:33.840
<v Speaker 1>for building secure applications. It is, but in reverse, it

295
00:14:33.879 --> 00:14:36.279
<v Speaker 1>helps you spot where things might have gone wrong exactly,

296
00:14:36.639 --> 00:14:39.759
<v Speaker 1>got it. So, once they've completed the source code review,

297
00:14:40.279 --> 00:14:40.960
<v Speaker 1>are they done?

298
00:14:41.440 --> 00:14:42.039
<v Speaker 2>Not quite?

299
00:14:42.279 --> 00:14:42.600
<v Speaker 1>Okay?

300
00:14:42.799 --> 00:14:46.879
<v Speaker 2>Because web applications they don't exist in isolation. They rely

301
00:14:47.000 --> 00:14:51.080
<v Speaker 2>on a whole network of supporting systems like servers, firewalls,

302
00:14:51.120 --> 00:14:54.639
<v Speaker 2>and routers, and if those systems are vulnerable, the whole

303
00:14:54.639 --> 00:14:55.679
<v Speaker 2>applications at risk.

304
00:14:56.000 --> 00:14:57.679
<v Speaker 1>So it's like a chain reaction, it is.

305
00:14:57.799 --> 00:14:58.120
<v Speaker 2>It is?

306
00:14:58.279 --> 00:15:01.799
<v Speaker 1>Yeah, a single week link, Yes, can compromise.

307
00:15:01.279 --> 00:15:03.080
<v Speaker 2>The whole thing, the whole system.

308
00:15:03.159 --> 00:15:05.279
<v Speaker 1>So that's where network penetration testing comes in.

309
00:15:05.399 --> 00:15:06.320
<v Speaker 2>That is where it comes in.

310
00:15:06.440 --> 00:15:08.840
<v Speaker 1>Okay, this sounds like we're going deeper down the rabbit hole.

311
00:15:08.919 --> 00:15:09.799
<v Speaker 2>We are going deeper.

312
00:15:09.879 --> 00:15:10.480
<v Speaker 1>Okay, I'm ready.

313
00:15:10.519 --> 00:15:12.559
<v Speaker 2>So it's an essential part of the process, yeah, because

314
00:15:12.600 --> 00:15:16.679
<v Speaker 2>it focuses on attacking the underlying infrastructure that supports that

315
00:15:16.759 --> 00:15:20.159
<v Speaker 2>web application. Right. So it's a multi phase process that

316
00:15:20.240 --> 00:15:22.879
<v Speaker 2>starts with information gathering okay, kind of like a spy

317
00:15:22.960 --> 00:15:24.600
<v Speaker 2>gathering intel before emission.

318
00:15:24.879 --> 00:15:28.240
<v Speaker 1>Okay, So information gathering, like they're doing reconnaissance. They're trying

319
00:15:28.279 --> 00:15:31.159
<v Speaker 1>to learn as much as possible about the network they

320
00:15:31.159 --> 00:15:31.840
<v Speaker 1>are Okay.

321
00:15:31.919 --> 00:15:36.480
<v Speaker 2>They use a variety of techniques, including something called OSENT ohsent, yes,

322
00:15:36.639 --> 00:15:40.519
<v Speaker 2>open source intelligence okay. And this involves collecting information from

323
00:15:40.559 --> 00:15:45.639
<v Speaker 2>publicly available sources like where like company websites, social media profiles,

324
00:15:46.120 --> 00:15:50.039
<v Speaker 2>public databases, news articles, blog posts, you name it.

325
00:15:50.519 --> 00:15:54.240
<v Speaker 1>So they're piecing together a puzzle using publicly available information

326
00:15:54.399 --> 00:15:58.240
<v Speaker 1>to try to build a picture of the target network exactly. Okay.

327
00:15:58.519 --> 00:16:00.600
<v Speaker 1>And once they have a good understanding of the network,

328
00:16:00.720 --> 00:16:01.360
<v Speaker 1>what do they do?

329
00:16:01.559 --> 00:16:03.480
<v Speaker 2>Then they move on to vulnerability scanning.

330
00:16:03.720 --> 00:16:06.360
<v Speaker 1>Vulnerability scanning so pretty self explanatory.

331
00:16:06.440 --> 00:16:08.600
<v Speaker 2>Yeah, pretty much. Okay, so this is where they actually

332
00:16:08.759 --> 00:16:13.039
<v Speaker 2>use tools like endmap to scan the network for those

333
00:16:13.080 --> 00:16:14.879
<v Speaker 2>potential weaknesses end map.

334
00:16:14.919 --> 00:16:16.000
<v Speaker 1>Remind me what that does again?

335
00:16:16.120 --> 00:16:19.559
<v Speaker 2>Okay, So think of end map as a very powerful

336
00:16:19.679 --> 00:16:23.559
<v Speaker 2>radar system for your network. So it sends out signals

337
00:16:23.720 --> 00:16:27.399
<v Speaker 2>to identify open ports, determine what services are running on

338
00:16:27.440 --> 00:16:31.240
<v Speaker 2>those ports, and even guess the operating system of the

339
00:16:31.240 --> 00:16:31.960
<v Speaker 2>target machine.

340
00:16:32.039 --> 00:16:35.039
<v Speaker 1>So it's like getting a detailed map of the network's terrain.

341
00:16:35.279 --> 00:16:39.279
<v Speaker 1>It is highlighting all the potential points of entry exactly. Okay,

342
00:16:39.440 --> 00:16:42.919
<v Speaker 1>And once they've identified these potential vulnerabilities, what happens then?

343
00:16:43.399 --> 00:16:45.279
<v Speaker 2>Then the real fund begins?

344
00:16:45.399 --> 00:16:46.559
<v Speaker 1>Ooh, tell me more.

345
00:16:46.720 --> 00:16:48.200
<v Speaker 2>It's the exploitation phase.

346
00:16:48.840 --> 00:16:51.960
<v Speaker 1>Exploitation that sounds a little ominous.

347
00:16:51.720 --> 00:16:54.039
<v Speaker 2>It can be. Yeah, So this is where they actually

348
00:16:54.080 --> 00:16:57.480
<v Speaker 2>try to exploit the vulnerabilities they've found. They might use

349
00:16:57.519 --> 00:17:02.399
<v Speaker 2>a tool like metasploit to gain access to systems, escalate

350
00:17:02.480 --> 00:17:07.000
<v Speaker 2>their privileges, or even take control of the entire network. Wow,

351
00:17:07.960 --> 00:17:09.440
<v Speaker 2>so it's pretty.

352
00:17:09.160 --> 00:17:11.440
<v Speaker 1>Powerful metasploid didn't we mention that earlier?

353
00:17:11.440 --> 00:17:15.519
<v Speaker 2>Well, it's a framework for developing and executing exploits. It's

354
00:17:15.599 --> 00:17:18.599
<v Speaker 2>kind of like a hacker's toolbox filled with these pre

355
00:17:18.680 --> 00:17:22.119
<v Speaker 2>made tools and the ability to create custom ones.

356
00:17:22.559 --> 00:17:25.880
<v Speaker 1>So they're not just identifying vulnerabilities, they're actually trying to

357
00:17:25.960 --> 00:17:29.960
<v Speaker 1>break in. They are, but it's all done ethically, ethically

358
00:17:30.240 --> 00:17:31.519
<v Speaker 1>with the client's permission.

359
00:17:31.680 --> 00:17:33.440
<v Speaker 2>Yes, always with permission.

360
00:17:33.599 --> 00:17:36.559
<v Speaker 1>Okay, So they've exploited the vulnerabilities. Are they done now?

361
00:17:37.039 --> 00:17:41.279
<v Speaker 2>Almost? There's one more phase. It's called the post exploitation phase.

362
00:17:41.440 --> 00:17:43.440
<v Speaker 1>Post exploitation, so what happens there?

363
00:17:43.559 --> 00:17:46.119
<v Speaker 2>This is where they assess the damage? Okay, So they

364
00:17:46.119 --> 00:17:49.640
<v Speaker 2>figure out what an attacker could actually do, okay, once

365
00:17:49.640 --> 00:17:51.079
<v Speaker 2>they've gained access, So they're.

366
00:17:50.880 --> 00:17:52.680
<v Speaker 1>Not just breaking in, they're seeing what they can get

367
00:17:52.680 --> 00:17:53.799
<v Speaker 1>away with exactly.

368
00:17:53.920 --> 00:17:58.200
<v Speaker 2>Okay. They might try to steal sensitive data, install backdoors

369
00:17:58.279 --> 00:18:02.720
<v Speaker 2>for future access, or even use the compromise system to

370
00:18:03.039 --> 00:18:04.799
<v Speaker 2>attack other systems on the network.

371
00:18:05.000 --> 00:18:07.079
<v Speaker 1>That's a lot, it is. So it's not just about

372
00:18:07.119 --> 00:18:10.640
<v Speaker 1>finding vulnerabilities, it's about understanding the potential impact it is

373
00:18:10.759 --> 00:18:12.960
<v Speaker 1>and demonstrating the real world risks.

374
00:18:13.200 --> 00:18:14.519
<v Speaker 2>Absolutely, this is.

375
00:18:14.519 --> 00:18:18.559
<v Speaker 1>Really intense stuff. So we've covered pre engagement, threat modeling,

376
00:18:18.799 --> 00:18:21.640
<v Speaker 1>source code review, and network penetration testing.

377
00:18:21.759 --> 00:18:22.279
<v Speaker 2>Yes we have.

378
00:18:22.880 --> 00:18:26.200
<v Speaker 1>I'm guessing the next step is to actually start testing

379
00:18:26.519 --> 00:18:27.960
<v Speaker 1>the web application itself.

380
00:18:28.039 --> 00:18:31.799
<v Speaker 2>You are correct, Okay, we've laid all the groundwork and

381
00:18:31.880 --> 00:18:34.960
<v Speaker 2>now it's time to put everything together and perform those

382
00:18:35.000 --> 00:18:36.160
<v Speaker 2>web intrusion tests.

383
00:18:36.279 --> 00:18:38.640
<v Speaker 1>This is what we've been building up to, it is okay.

384
00:18:38.680 --> 00:18:42.000
<v Speaker 1>So how did they actually go about testing the web application.

385
00:18:42.359 --> 00:18:46.440
<v Speaker 2>It's a structured process. It starts with crawling the web

386
00:18:46.480 --> 00:18:50.640
<v Speaker 2>application to actually map out its structure. Okay, So imagine

387
00:18:50.640 --> 00:18:53.920
<v Speaker 2>those digital spiders we talked about earlier, but this time

388
00:18:53.920 --> 00:18:56.920
<v Speaker 2>they're exploring every nook and cranny of the web app.

389
00:18:57.279 --> 00:19:00.319
<v Speaker 1>So they're building a detailed map of the web apption

390
00:19:00.799 --> 00:19:04.279
<v Speaker 1>identifying all the pages and features exactly. And while they're

391
00:19:04.319 --> 00:19:08.359
<v Speaker 1>doing that, they're also looking for hidden content they are right,

392
00:19:08.480 --> 00:19:12.400
<v Speaker 1>that might reveal sensitive information exactly, like secret files or

393
00:19:12.440 --> 00:19:16.240
<v Speaker 1>directories that aren't meant to be publicly accessible. So it's

394
00:19:16.240 --> 00:19:18.960
<v Speaker 1>like playing a digital detective game. It is searching for

395
00:19:19.039 --> 00:19:23.440
<v Speaker 1>clues and piecing together information exactly. Okay. So once they

396
00:19:23.480 --> 00:19:26.119
<v Speaker 1>have a good understanding of the web apps structure and

397
00:19:26.160 --> 00:19:29.519
<v Speaker 1>potential weaknesses, what do they do Then they.

398
00:19:29.400 --> 00:19:31.640
<v Speaker 2>Start actually testing for vulnerabilities.

399
00:19:31.720 --> 00:19:33.640
<v Speaker 1>Okay, So this is where they put all their tools

400
00:19:33.680 --> 00:19:34.720
<v Speaker 1>and techniques to the test.

401
00:19:34.960 --> 00:19:40.079
<v Speaker 2>Exactly. They use a combination of automated and manual techniques

402
00:19:40.480 --> 00:19:44.200
<v Speaker 2>to probe for those vulnerabilities. Okay, they use tools like

403
00:19:44.240 --> 00:19:47.720
<v Speaker 2>burp suite to scan for common weaknesses. Yeah, but they'll

404
00:19:47.720 --> 00:19:51.359
<v Speaker 2>also manually test for those more subtle flaws.

405
00:19:51.680 --> 00:19:54.359
<v Speaker 1>So it's a mix of technology and human intuition.

406
00:19:54.680 --> 00:19:55.359
<v Speaker 2>It is, it is.

407
00:19:55.440 --> 00:19:59.200
<v Speaker 1>They're looking for things like cross site scripting vulnerabilities, SQL

408
00:19:59.240 --> 00:20:05.359
<v Speaker 1>injection flaw, file inclusion weaknesses, authentication authorization bypasses, and many more.

409
00:20:05.559 --> 00:20:06.160
<v Speaker 2>Yes, they are.

410
00:20:06.240 --> 00:20:08.720
<v Speaker 1>Wow, a lot of ways a web application can be vulnerable.

411
00:20:08.839 --> 00:20:11.319
<v Speaker 2>There are, there are, and that's why penetration testing is

412
00:20:11.359 --> 00:20:11.920
<v Speaker 2>so important.

413
00:20:12.119 --> 00:20:12.279
<v Speaker 1>Yea.

414
00:20:13.000 --> 00:20:16.880
<v Speaker 2>It helps organizations uncover these vulnerabilities before the bad guys

415
00:20:16.880 --> 00:20:17.599
<v Speaker 2>can exploit them.

416
00:20:17.920 --> 00:20:20.240
<v Speaker 1>That's the whole point, makes sense. So once they've found

417
00:20:20.240 --> 00:20:22.079
<v Speaker 1>some vulnerabilities, what's next?

418
00:20:22.480 --> 00:20:26.000
<v Speaker 2>Then they need to assess the severity of each vulnerability

419
00:20:26.160 --> 00:20:30.440
<v Speaker 2>because not all vulnerabilities are created equal. Some are minor

420
00:20:30.480 --> 00:20:33.519
<v Speaker 2>annoyances and others could be catastrophic.

421
00:20:33.839 --> 00:20:37.200
<v Speaker 1>So how do we assess the severity of a vulnerability?

422
00:20:37.599 --> 00:20:40.960
<v Speaker 2>That's where the Common Vulnerability Scoring System or CVSS comes in.

423
00:20:41.279 --> 00:20:44.480
<v Speaker 1>CVSS right a way to rank the severity of vulnerabilities.

424
00:20:44.559 --> 00:20:47.079
<v Speaker 2>It is like giving them a risk rating. Got it?

425
00:20:47.200 --> 00:20:51.799
<v Speaker 2>So CVSS takes into account things like how easy is

426
00:20:51.839 --> 00:20:55.799
<v Speaker 2>it to actually exploit the vulnerability, what's the potential damage

427
00:20:56.079 --> 00:20:58.920
<v Speaker 2>if a successful exploit, where to happen, and are there

428
00:20:58.960 --> 00:21:01.559
<v Speaker 2>any known mitigations or workarounds.

429
00:21:01.799 --> 00:21:04.759
<v Speaker 1>So it's not just about finding vulnerabilities, it's about understanding

430
00:21:04.759 --> 00:21:08.079
<v Speaker 1>how dangerous they are exactly. And the book provides practical

431
00:21:08.119 --> 00:21:12.799
<v Speaker 1>examples of how to actually calculate CVFS scores, showing how

432
00:21:12.799 --> 00:21:16.599
<v Speaker 1>different factors can influence that overall severity rating. So it's

433
00:21:16.599 --> 00:21:20.359
<v Speaker 1>a really valuable tool for prioritizing remediation efforts. It is,

434
00:21:20.440 --> 00:21:25.160
<v Speaker 1>so we've identified the vulnerabilities, assess their severity, and now

435
00:21:25.160 --> 00:21:28.680
<v Speaker 1>it's time to share our findings with the client. It is,

436
00:21:28.880 --> 00:21:32.559
<v Speaker 1>and that brings us to the final yes, and arguably

437
00:21:32.599 --> 00:21:35.039
<v Speaker 1>the most important step in the web intrusion testing process.

438
00:21:35.119 --> 00:21:36.160
<v Speaker 1>It is reporting.

439
00:21:36.319 --> 00:21:38.480
<v Speaker 2>Yes, reporting, So reporting.

440
00:21:38.039 --> 00:21:41.000
<v Speaker 1>This is where we translate all of our technical findings

441
00:21:41.000 --> 00:21:43.440
<v Speaker 1>into a language that the client can understand and act

442
00:21:43.480 --> 00:21:46.720
<v Speaker 1>upon exactly exactly okay. So a well written report can

443
00:21:46.759 --> 00:21:50.039
<v Speaker 1>make the difference between a successful penetration test that leads

444
00:21:50.079 --> 00:21:54.359
<v Speaker 1>to meaningful security improvements and one that just ends up ignored.

445
00:21:54.680 --> 00:21:55.440
<v Speaker 2>It really can.

446
00:21:55.680 --> 00:21:57.759
<v Speaker 1>Okay, I'm starting to see how important this is. But

447
00:21:57.839 --> 00:21:59.920
<v Speaker 1>I have to admit, when I think of penetration testing,

448
00:22:00.079 --> 00:22:04.519
<v Speaker 1>I picture hackers, you know, hunched over glowing screens, fingers

449
00:22:04.559 --> 00:22:08.559
<v Speaker 1>flying across keyboards. Reporting doesn't exactly scream.

450
00:22:08.119 --> 00:22:10.319
<v Speaker 2>Action packed, No it doesn't.

451
00:22:10.519 --> 00:22:13.200
<v Speaker 1>So what makes a good penetration testing report?

452
00:22:13.640 --> 00:22:17.160
<v Speaker 2>So a good report it tells a story, a story,

453
00:22:17.240 --> 00:22:22.119
<v Speaker 2>a compelling narrative that grabs the reader's attention and motivates

454
00:22:22.119 --> 00:22:25.960
<v Speaker 2>them to actually take action. Remember, we're not just presenting data,

455
00:22:26.640 --> 00:22:30.519
<v Speaker 2>we're explaining the risks and offering solutions. So we need

456
00:22:30.559 --> 00:22:34.279
<v Speaker 2>to bridge the gap between the technical world of penetration

457
00:22:34.400 --> 00:22:37.119
<v Speaker 2>testing and the business world of decision making.

458
00:22:37.279 --> 00:22:38.720
<v Speaker 1>So we're like translators.

459
00:22:38.839 --> 00:22:39.680
<v Speaker 2>We are translators.

460
00:22:39.799 --> 00:22:41.799
<v Speaker 1>Yeah, bridging the gap between the technical world and the

461
00:22:41.799 --> 00:22:46.079
<v Speaker 1>business world exactly. Okay, So where do we even begin?

462
00:22:46.759 --> 00:22:51.119
<v Speaker 1>What are the key elements of an effective penetration testing report?

463
00:22:51.319 --> 00:22:57.400
<v Speaker 2>Okay, so the book offers a very helpful sample report template. Okay,

464
00:22:57.559 --> 00:23:00.920
<v Speaker 2>but let's break down those essential components. So we start

465
00:23:00.920 --> 00:23:04.640
<v Speaker 2>with an executive summary, followed by the methodology section. Then

466
00:23:04.680 --> 00:23:07.759
<v Speaker 2>we dive into the findings, and finally we lay out

467
00:23:07.880 --> 00:23:09.160
<v Speaker 2>clear recommendations.

468
00:23:09.279 --> 00:23:11.720
<v Speaker 1>Perfect. Let's start with that executive summary. Why is it

469
00:23:11.759 --> 00:23:12.279
<v Speaker 1>so important?

470
00:23:12.359 --> 00:23:15.119
<v Speaker 2>So think of the executive summary as the elevator pitch

471
00:23:15.559 --> 00:23:19.000
<v Speaker 2>for your report. It's a high level overview of the

472
00:23:19.160 --> 00:23:25.079
<v Speaker 2>entire penetration test, summarizing those key findings, the overall risk assessment,

473
00:23:25.759 --> 00:23:27.480
<v Speaker 2>and the most critical recommendation.

474
00:23:27.559 --> 00:23:31.680
<v Speaker 1>So it's the TLDR version exactly for busy executives who

475
00:23:31.759 --> 00:23:34.359
<v Speaker 1>might not have time to read the entire report, got it.

476
00:23:34.400 --> 00:23:38.119
<v Speaker 2>So it needs to be concise, impactful, and very easy

477
00:23:38.160 --> 00:23:38.759
<v Speaker 2>to digest.

478
00:23:39.039 --> 00:23:42.799
<v Speaker 1>Okay. So what comes after that impactful executive summary?

479
00:23:42.880 --> 00:23:45.920
<v Speaker 2>Okay? Then comes the methodology section. Okay, So this is

480
00:23:45.920 --> 00:23:50.079
<v Speaker 2>where transparency is key. You explain how you conducted the

481
00:23:50.119 --> 00:23:54.000
<v Speaker 2>penetration test, the tools and techniques that you used, the

482
00:23:54.039 --> 00:23:56.559
<v Speaker 2>scope of the engagement. Okay, So you want to give

483
00:23:56.559 --> 00:23:59.720
<v Speaker 2>the client a clear understanding of how you approach the

484
00:23:59.759 --> 00:24:02.839
<v Speaker 2>test and any limitations of your findings.

485
00:24:02.920 --> 00:24:05.240
<v Speaker 1>So it's not just about the results, now, it's not.

486
00:24:05.559 --> 00:24:08.920
<v Speaker 1>It's about explaining the process it is and being upfront

487
00:24:08.920 --> 00:24:12.759
<v Speaker 1>about any constraints or assumptions exactly. Okay. Now for the

488
00:24:12.799 --> 00:24:15.240
<v Speaker 1>finding section, okay, So this is where we get into

489
00:24:15.240 --> 00:24:17.960
<v Speaker 1>the nitty gritty details, right, Yes it is. This is

490
00:24:18.000 --> 00:24:21.599
<v Speaker 1>where you present the vulnerabilities you discovered, along with a

491
00:24:21.640 --> 00:24:25.079
<v Speaker 1>detailed description of each one exactly. But remember we're not

492
00:24:25.160 --> 00:24:28.039
<v Speaker 1>just listing out technical jargon here, No, we need to

493
00:24:28.079 --> 00:24:32.119
<v Speaker 1>explain the vulnerabilities in plain language. We do highlighting the

494
00:24:32.160 --> 00:24:36.279
<v Speaker 1>potential impact of a successful exploit. Absolutely, So instead of

495
00:24:36.319 --> 00:24:40.279
<v Speaker 1>saying we found a cross site scripting vulnerability in the

496
00:24:40.279 --> 00:24:43.480
<v Speaker 1>input field on page X, we'd say something like an

497
00:24:43.519 --> 00:24:47.319
<v Speaker 1>attacker could inject malicious code into this form, potentially stealing

498
00:24:47.400 --> 00:24:51.720
<v Speaker 1>user Welcome back. Last time, we explored a ton from

499
00:24:51.759 --> 00:24:55.119
<v Speaker 1>setting up our hacking lab to understanding common vulnerabilities. We've

500
00:24:55.119 --> 00:24:57.119
<v Speaker 1>been touched on that automation with Python.

501
00:24:57.200 --> 00:24:58.240
<v Speaker 2>Yeah, it's power stuff.

502
00:24:58.519 --> 00:25:00.559
<v Speaker 1>But now it's time to get hands on and see

503
00:25:00.559 --> 00:25:02.759
<v Speaker 1>how this all comes together in a real world web

504
00:25:02.799 --> 00:25:07.000
<v Speaker 1>intrusion test. So imagine we're those ethical hackers hired to

505
00:25:07.039 --> 00:25:09.720
<v Speaker 1>test a company's website. Where do we even begin.

506
00:25:09.920 --> 00:25:12.599
<v Speaker 2>Well, before we jump into the web application itself, let's

507
00:25:12.599 --> 00:25:14.920
<v Speaker 2>revisit the web server vulnerability assessment.

508
00:25:14.960 --> 00:25:17.559
<v Speaker 1>Remember endmap, Yeah, that handy tool we use to scan

509
00:25:17.680 --> 00:25:20.119
<v Speaker 1>the server for open ports and potential vulnerabilities.

510
00:25:20.319 --> 00:25:22.519
<v Speaker 2>Exactly. It's like we were mapping out the server's terrain

511
00:25:22.640 --> 00:25:24.720
<v Speaker 2>right identifying those potential entry points.

512
00:25:24.799 --> 00:25:27.440
<v Speaker 1>Okay, so we've scanned the server. What's next on our

513
00:25:27.480 --> 00:25:31.759
<v Speaker 1>penetration testing checklist, It's time to fire up burpsuite.

514
00:25:32.200 --> 00:25:35.559
<v Speaker 2>Put on our detective heads now, make sure intercept is

515
00:25:35.599 --> 00:25:38.599
<v Speaker 2>on in the proxy tab. This is like setting up

516
00:25:38.599 --> 00:25:42.000
<v Speaker 2>a surveillance camera, capturing all the communication between your browser

517
00:25:42.160 --> 00:25:43.000
<v Speaker 2>and that web server.

518
00:25:43.680 --> 00:25:47.359
<v Speaker 1>So as we browse the web application, burpsuite is secretly

519
00:25:47.400 --> 00:25:49.519
<v Speaker 1>recording everything happening behind the scenes.

520
00:25:49.640 --> 00:25:53.400
<v Speaker 2>Precisely click on links, submit forms, use the search functions,

521
00:25:53.480 --> 00:25:56.319
<v Speaker 2>even try different user roles if the application allows it.

522
00:25:56.400 --> 00:25:59.319
<v Speaker 1>Okay, so we're simulating how a real user would interact

523
00:25:59.319 --> 00:26:02.319
<v Speaker 1>with the web app. But with burpsuite capturing every click,

524
00:26:02.440 --> 00:26:05.640
<v Speaker 1>every request, every response, I'm starting to see how this

525
00:26:05.680 --> 00:26:08.759
<v Speaker 1>gives us powerful insight into how the application works.

526
00:26:09.079 --> 00:26:12.720
<v Speaker 2>And as you browse, keep an eye on burp's target tab.

527
00:26:13.039 --> 00:26:16.559
<v Speaker 2>That's your dashboard showing the site map, requests, responses, everything

528
00:26:16.680 --> 00:26:19.279
<v Speaker 2>verb is intercepting. Okay, this is where you start piecing

529
00:26:19.319 --> 00:26:23.200
<v Speaker 2>together the puzzle, looking for clues that might reveal vulnerabilities.

530
00:26:23.440 --> 00:26:27.640
<v Speaker 1>Okay, but browsing every single page manually could take forever,

531
00:26:27.960 --> 00:26:29.359
<v Speaker 1>especially with a large web app.

532
00:26:29.480 --> 00:26:32.880
<v Speaker 2>You're right, that's where automation comes in. Burpsuite has these

533
00:26:33.000 --> 00:26:36.359
<v Speaker 2>awesome features spider and content discovery. Think of them as

534
00:26:36.720 --> 00:26:39.839
<v Speaker 2>those automated web crawlers, those digital spiders.

535
00:26:39.400 --> 00:26:42.440
<v Speaker 1>We talked about, right, So we unleash these spiders to

536
00:26:42.559 --> 00:26:45.960
<v Speaker 1>explore the website, mapping out its structure, uncovering all the

537
00:26:46.039 --> 00:26:47.359
<v Speaker 1>hidden pages and files.

538
00:26:47.559 --> 00:26:51.720
<v Speaker 2>Precisely, they systematically crawl through the web application, follow links,

539
00:26:51.759 --> 00:26:53.319
<v Speaker 2>and index everything they find.

540
00:26:53.519 --> 00:26:53.839
<v Speaker 1>Got it.

541
00:26:53.920 --> 00:26:56.599
<v Speaker 2>Now, while those spiders are busy, we can start looking

542
00:26:56.680 --> 00:26:59.680
<v Speaker 2>for other clues that might reveal sensitive information. A good

543
00:26:59.720 --> 00:27:03.000
<v Speaker 2>place to start the robots dot txt file.

544
00:27:03.400 --> 00:27:05.880
<v Speaker 1>Robots dot txt Remind me what that is again?

545
00:27:06.000 --> 00:27:08.839
<v Speaker 2>Basically, it's a set of instructions for those search engine bots,

546
00:27:08.880 --> 00:27:10.759
<v Speaker 2>telling them which parts of the website they should and

547
00:27:10.759 --> 00:27:15.480
<v Speaker 2>shouldn't index. But sometimes it can accidentally reveal hidden directories

548
00:27:15.559 --> 00:27:17.440
<v Speaker 2>or files that weren't meant to be public.

549
00:27:17.759 --> 00:27:21.119
<v Speaker 1>Ah, so it's like stumbling upon a secret map leading

550
00:27:21.160 --> 00:27:24.240
<v Speaker 1>to hidden treasures like sensitive data or can fig files.

551
00:27:24.599 --> 00:27:27.640
<v Speaker 2>Exactly. We're looking for anything that could help us understand

552
00:27:27.640 --> 00:27:31.960
<v Speaker 2>the application better or potentially exploit it. Things like database

553
00:27:32.039 --> 00:27:35.720
<v Speaker 2>connection strings, API keys, even backup files.

554
00:27:35.920 --> 00:27:39.000
<v Speaker 1>Okay, so we've crawled the web application, scan the server,

555
00:27:39.160 --> 00:27:43.200
<v Speaker 1>scoured the robots dot txt file for hidden treasures. What's next?

556
00:27:43.440 --> 00:27:47.599
<v Speaker 2>Now the real fun begins. Burp suite has compiled a

557
00:27:47.640 --> 00:27:51.079
<v Speaker 2>list of all those pages and files that discovered during crawling.

558
00:27:51.599 --> 00:27:55.039
<v Speaker 2>We go through each one methodically testing for vulnerabilities.

559
00:27:55.559 --> 00:27:57.880
<v Speaker 1>So this is where we put on our hacker hats

560
00:27:57.880 --> 00:27:59.079
<v Speaker 1>and try to break things.

561
00:27:59.279 --> 00:28:02.400
<v Speaker 2>Not break things, but more like gently poke and prod

562
00:28:02.440 --> 00:28:05.559
<v Speaker 2>for weaknesses. It's a stress test for the web application.

563
00:28:05.920 --> 00:28:07.759
<v Speaker 2>We're applying pressure to see where it cracks.

564
00:28:07.799 --> 00:28:10.279
<v Speaker 1>Okay, I like that analogy. So how do we actually

565
00:28:10.359 --> 00:28:12.000
<v Speaker 1>test these pages and files?

566
00:28:12.160 --> 00:28:15.920
<v Speaker 2>We start by sending each request to burpsuite scanner. It's

567
00:28:16.000 --> 00:28:19.519
<v Speaker 2>like an automated security guard checking for those common vulnerabilities

568
00:28:19.799 --> 00:28:22.920
<v Speaker 2>sequal injection, cross site scripting, and many more.

569
00:28:23.000 --> 00:28:25.400
<v Speaker 1>So it's like having a robot do the initial screening,

570
00:28:25.480 --> 00:28:27.599
<v Speaker 1>flagging anything suspicious exactly.

571
00:28:27.960 --> 00:28:31.079
<v Speaker 2>But even the most sophisticated tools can miss things, so

572
00:28:31.119 --> 00:28:32.799
<v Speaker 2>we also need to do some manual testing.

573
00:28:32.960 --> 00:28:36.160
<v Speaker 1>Got it. So we combine the speed of automation with

574
00:28:36.200 --> 00:28:39.319
<v Speaker 1>the intuition and experience of a human penetration tester.

575
00:28:39.480 --> 00:28:42.359
<v Speaker 2>You got about and to guide that manual testing. The

576
00:28:42.400 --> 00:28:46.720
<v Speaker 2>book provides a comprehensive checklist of common web age vulnerabilities.

577
00:28:46.839 --> 00:28:48.240
<v Speaker 1>Okay, so what's on this checklist?

578
00:28:48.440 --> 00:28:52.920
<v Speaker 2>It covers things like input validation issues, cross site scripting vulnerabilities,

579
00:28:53.240 --> 00:28:59.039
<v Speaker 2>sequal injection flaws, file inclusion weaknesses, authentication and authorization bypasses,

580
00:28:59.319 --> 00:28:59.960
<v Speaker 2>and many more.

581
00:29:00.240 --> 00:29:03.359
<v Speaker 1>Wow, a lot to consider. But the specific tests we

582
00:29:03.400 --> 00:29:06.160
<v Speaker 1>do will depend on the type of page. Right, A

583
00:29:06.200 --> 00:29:09.720
<v Speaker 1>log in page will have different vulnerabilities than a simple content.

584
00:29:09.440 --> 00:29:12.440
<v Speaker 2>Page, absolutely, and that's why the book also has checklists

585
00:29:12.440 --> 00:29:17.400
<v Speaker 2>for special pages, log in pages, registration forms, password reset functions,

586
00:29:17.599 --> 00:29:19.000
<v Speaker 2>and file upload mechanisms.

587
00:29:19.079 --> 00:29:20.680
<v Speaker 1>Oh so really targeted testing?

588
00:29:20.799 --> 00:29:21.720
<v Speaker 2>Yes, very targeted.

589
00:29:21.759 --> 00:29:23.759
<v Speaker 1>Okay, so we've gone through the checklists and uncovered a

590
00:29:23.799 --> 00:29:24.759
<v Speaker 1>few vulnerabilities.

591
00:29:24.839 --> 00:29:27.119
<v Speaker 2>What now, Now we got to determine how serious these

592
00:29:27.200 --> 00:29:30.920
<v Speaker 2>vulnerabilities are. Not all vulnerabilities are created equal, Some are

593
00:29:30.920 --> 00:29:33.519
<v Speaker 2>minor annoyances while others could be catastrophic.

594
00:29:33.680 --> 00:29:36.400
<v Speaker 1>Right, that makes sense. So how do we assess how

595
00:29:36.480 --> 00:29:37.880
<v Speaker 1>severe a vulnerability is?

596
00:29:38.319 --> 00:29:42.319
<v Speaker 2>That's where the Common Vulnerability Scoring System or CVSS comes in.

597
00:29:42.720 --> 00:29:44.759
<v Speaker 2>Remember that scoring system we mentioned.

598
00:29:44.799 --> 00:29:47.799
<v Speaker 1>Right, like giving vulnerabilities or risk grading exactly.

599
00:29:48.119 --> 00:29:51.759
<v Speaker 2>CVSS takes into account factors like how easy is it

600
00:29:51.799 --> 00:29:55.880
<v Speaker 2>to exploit, what's the potential damage if exploited? Are there

601
00:29:55.960 --> 00:29:57.480
<v Speaker 2>mitigations or workarounds?

602
00:29:57.599 --> 00:30:00.839
<v Speaker 1>Okay, so it's not just finding them, it's understanding their

603
00:30:00.880 --> 00:30:05.400
<v Speaker 1>impact and prioritizing. A minor vulnerability that's hard to exploit

604
00:30:05.519 --> 00:30:07.680
<v Speaker 1>might not be a big deal, but a critical one

605
00:30:07.839 --> 00:30:08.960
<v Speaker 1>needs immediate action.

606
00:30:09.240 --> 00:30:11.680
<v Speaker 2>You got it. And the book shows how to calculate

607
00:30:11.720 --> 00:30:15.759
<v Speaker 2>those CVSS scores, demonstrating how different factors can influence the

608
00:30:15.839 --> 00:30:19.680
<v Speaker 2>overall rating. It's a great tool for prioritizing remediation efforts.

609
00:30:19.720 --> 00:30:22.799
<v Speaker 1>Okay, so we've identified the vulnerabilities, assess their severity, and

610
00:30:22.839 --> 00:30:25.279
<v Speaker 1>now it's time to share our findings with the client.

611
00:30:25.000 --> 00:30:27.920
<v Speaker 2>Right exactly, And that brings us to the final and

612
00:30:28.079 --> 00:30:32.000
<v Speaker 2>arguably the most important step in web intrusion testing. Reporting.

613
00:30:32.279 --> 00:30:36.079
<v Speaker 1>Welcome back to our deep dive into practical web penetration testing.

614
00:30:36.200 --> 00:30:37.680
<v Speaker 2>Yeah, we're in the home stretch. Now.

615
00:30:37.880 --> 00:30:42.039
<v Speaker 1>We've been through setting up a lab, exploring tools like burpsuite, Metasploid,

616
00:30:42.240 --> 00:30:43.799
<v Speaker 1>even touched on Python automation.

617
00:30:44.279 --> 00:30:46.079
<v Speaker 2>A lot of ground covered, but now we got to

618
00:30:46.079 --> 00:30:48.359
<v Speaker 2>talk about a crucial part that often gets overlooked.

619
00:30:48.960 --> 00:30:52.960
<v Speaker 1>Reporting, Absolutely, reporting is that bridge between the technical work

620
00:30:53.039 --> 00:30:55.720
<v Speaker 1>and the actions the client needs to take to improve

621
00:30:55.720 --> 00:30:56.440
<v Speaker 1>their security.

622
00:30:56.920 --> 00:30:59.519
<v Speaker 2>So a good report makes the difference between a successful

623
00:30:59.559 --> 00:31:03.920
<v Speaker 2>penetratation test, one that actually leads to change, right, meaningful change,

624
00:31:04.000 --> 00:31:05.519
<v Speaker 2>and one that just sits on a shelf.

625
00:31:05.680 --> 00:31:06.240
<v Speaker 1>Pretty much.

626
00:31:06.400 --> 00:31:09.400
<v Speaker 2>I gotta admit, when I think penetration testing, I picture,

627
00:31:09.599 --> 00:31:13.319
<v Speaker 2>you know, hackers in the dark, typing away furiously. Yeah,

628
00:31:13.440 --> 00:31:17.079
<v Speaker 2>the Hollywood image reporting doesn't exactly screen action pack to me,

629
00:31:17.240 --> 00:31:18.279
<v Speaker 2>what's the big deal?

630
00:31:18.599 --> 00:31:22.400
<v Speaker 1>It's much more than just listing vulnerabilities. A good report

631
00:31:22.480 --> 00:31:25.119
<v Speaker 1>tells a story, one that resonates with the client and

632
00:31:25.200 --> 00:31:26.440
<v Speaker 1>makes them want to take action.

633
00:31:26.920 --> 00:31:29.480
<v Speaker 2>A story. So it's not just about data.

634
00:31:29.680 --> 00:31:33.400
<v Speaker 1>No, there's definitely an art to it. Imagine you've spent days,

635
00:31:33.759 --> 00:31:38.119
<v Speaker 1>weeks digging into a web application, finding weaknesses, exploiting them,

636
00:31:38.240 --> 00:31:41.480
<v Speaker 1>understanding those risks. Okay, yeah, Now you have to explain

637
00:31:41.519 --> 00:31:44.319
<v Speaker 1>all that technical stuff to someone who might not be

638
00:31:44.359 --> 00:31:47.519
<v Speaker 1>technical at all, right, like the client, who might not

639
00:31:47.599 --> 00:31:49.680
<v Speaker 1>know code or how an exploit even works.

640
00:31:49.720 --> 00:31:53.599
<v Speaker 2>Well, exactly. The report has to be clear, concise, and

641
00:31:53.720 --> 00:31:57.000
<v Speaker 2>make them want to do something about it. Highlight the impact,

642
00:31:57.119 --> 00:32:00.519
<v Speaker 2>explain the risks, and offer solutions.

643
00:32:00.559 --> 00:32:04.119
<v Speaker 1>Okay, So it's like being a translator, almost bridging that

644
00:32:04.200 --> 00:32:07.160
<v Speaker 1>gap between tech stuff and business decision.

645
00:32:07.240 --> 00:32:07.640
<v Speaker 2>You got it.

646
00:32:07.680 --> 00:32:10.720
<v Speaker 1>Okay, I'm seeing the importance now, But how do we

647
00:32:10.759 --> 00:32:12.799
<v Speaker 1>even start. What makes a good report?

648
00:32:13.119 --> 00:32:14.960
<v Speaker 2>Well, the book gives us a template, but let's break

649
00:32:15.000 --> 00:32:17.000
<v Speaker 2>it down. We start with an executive summary.

650
00:32:17.079 --> 00:32:19.519
<v Speaker 1>Okay, the executive summary, Why is that so important?

651
00:32:19.599 --> 00:32:22.079
<v Speaker 2>Think of it as the elevator pitch for the whole report.

652
00:32:22.160 --> 00:32:27.359
<v Speaker 2>It's high level, key findings, overall risk, the most important recommendations.

653
00:32:27.599 --> 00:32:30.559
<v Speaker 1>So the TLDR for busy people who won't read the

654
00:32:30.559 --> 00:32:31.160
<v Speaker 1>whole thing.

655
00:32:31.119 --> 00:32:34.200
<v Speaker 2>Exactly, concise, impactful, easy to understand.

656
00:32:34.240 --> 00:32:35.480
<v Speaker 1>Got it. What's next?

657
00:32:35.720 --> 00:32:39.799
<v Speaker 2>Methodology? Here's where we're transparent. Explain how we did, the

658
00:32:39.839 --> 00:32:42.799
<v Speaker 2>test tools, techniques, the scope of what we looked at.

659
00:32:42.960 --> 00:32:45.880
<v Speaker 1>Okay, so the client understands our process.

660
00:32:45.519 --> 00:32:49.240
<v Speaker 2>Right and any limitations. We're upfront about assumptions constraints so

661
00:32:49.279 --> 00:32:51.079
<v Speaker 2>they know how reliable the findings are.

662
00:32:51.400 --> 00:32:54.359
<v Speaker 1>Makes sense now, the finding section. This is where we

663
00:32:54.440 --> 00:32:55.480
<v Speaker 1>get into the nitty gritty.

664
00:32:55.599 --> 00:33:00.240
<v Speaker 2>Yes, presenting the vulnerabilities with a good description of each one.

665
00:33:00.559 --> 00:33:04.759
<v Speaker 2>But remember not just jargon, write plain language. Explain it

666
00:33:04.799 --> 00:33:08.160
<v Speaker 2>so anyone can get it and highlight the impact if

667
00:33:08.240 --> 00:33:09.720
<v Speaker 2>someone were to exploit.

668
00:33:09.319 --> 00:33:13.160
<v Speaker 1>This, So instead of saying cross site scripting vulnerability on

669
00:33:13.240 --> 00:33:17.319
<v Speaker 1>page X, we'd say an attacker could inject code, steal data,

670
00:33:17.519 --> 00:33:18.960
<v Speaker 1>takeover accounts.

671
00:33:18.519 --> 00:33:21.960
<v Speaker 2>Exactly, make it real, show the risks, and include those

672
00:33:22.000 --> 00:33:24.400
<v Speaker 2>cvsscores too, so they see how severe it is.

673
00:33:24.480 --> 00:33:27.920
<v Speaker 1>Okay, got it, explain it, impact severity. What else goes

674
00:33:27.960 --> 00:33:28.799
<v Speaker 1>in the finding.

675
00:33:28.559 --> 00:33:30.960
<v Speaker 2>Steps to reproduce it so the client's developers can actually

676
00:33:31.000 --> 00:33:35.359
<v Speaker 2>try it themselves, confirm we're right, a proof, and then recommendations.

677
00:33:35.400 --> 00:33:37.519
<v Speaker 2>This is where we shift from problem to solution.

678
00:33:37.319 --> 00:33:40.119
<v Speaker 1>So we're not just complaining, we're offering fixes.

679
00:33:40.039 --> 00:33:42.799
<v Speaker 2>Exactly, and be clear, don't just say fix the cross

680
00:33:42.799 --> 00:33:47.279
<v Speaker 2>site scripting. Offer real solutions specific to their tech and

681
00:33:47.319 --> 00:33:48.119
<v Speaker 2>how they do things.

682
00:33:48.240 --> 00:33:51.319
<v Speaker 1>So for that cross site scripting we might recommend output

683
00:33:51.359 --> 00:33:53.920
<v Speaker 1>in coding or input validation exactly.

684
00:33:54.000 --> 00:33:56.720
<v Speaker 2>The more concrete the solution, the more likely they'll actually

685
00:33:56.720 --> 00:33:56.960
<v Speaker 2>do it.

686
00:33:57.079 --> 00:34:01.200
<v Speaker 1>Okay, So we have executive summary, methodology, findings with details

687
00:34:01.240 --> 00:34:02.440
<v Speaker 1>and fixes. What else?

688
00:34:02.640 --> 00:34:05.799
<v Speaker 2>Two more things? A history log mm hmm, what we

689
00:34:05.839 --> 00:34:09.679
<v Speaker 2>did when, all the details like our activity.

690
00:34:09.119 --> 00:34:11.119
<v Speaker 1>Record so if there are questions later we can back

691
00:34:11.159 --> 00:34:11.719
<v Speaker 1>it up right.

692
00:34:11.960 --> 00:34:16.519
<v Speaker 2>And lastly, appendices for extra stuff too technical for the

693
00:34:16.519 --> 00:34:20.920
<v Speaker 2>main report. Screenshots, code, diagrams, whatever supports our findings.

694
00:34:20.960 --> 00:34:23.599
<v Speaker 1>So a complete picture, well documented.

695
00:34:23.079 --> 00:34:26.960
<v Speaker 2>Exactly, give the client everything they need to understand, verify

696
00:34:27.440 --> 00:34:28.519
<v Speaker 2>and fix the problems.

697
00:34:28.599 --> 00:34:30.800
<v Speaker 1>This has been eye opening. I really get the importance

698
00:34:30.800 --> 00:34:34.280
<v Speaker 1>of a good report now. So concise summary, clear methodology,

699
00:34:34.400 --> 00:34:38.199
<v Speaker 1>detailed findings with fixes, a history log and appendicies for proof.

700
00:34:38.400 --> 00:34:41.119
<v Speaker 2>You got it. Remember the report isn't just a document.

701
00:34:41.159 --> 00:34:45.000
<v Speaker 2>It starts a conversation penetration testers and client working together,

702
00:34:45.320 --> 00:34:47.599
<v Speaker 2>understanding the risks making things more secure.

703
00:34:47.840 --> 00:34:50.400
<v Speaker 1>Well, folks. That wraps up our deep dive into practical

704
00:34:50.440 --> 00:34:54.400
<v Speaker 1>web penetration testing. We've covered tools, techniques, vulnerability is the

705
00:34:54.440 --> 00:34:55.760
<v Speaker 1>whole process.

706
00:34:55.400 --> 00:34:58.920
<v Speaker 2>From building labs to writing reports. It's been quite a journey.

707
00:34:58.800 --> 00:35:02.840
<v Speaker 1>But the biggest takeaway penetration testing isn't about breaking things

708
00:35:02.880 --> 00:35:03.400
<v Speaker 1>for fun.

709
00:35:03.559 --> 00:35:05.239
<v Speaker 2>It's about making things better.

710
00:35:05.079 --> 00:35:09.800
<v Speaker 1>Working together, improving security, protecting against those attacks.

711
00:35:09.440 --> 00:35:12.679
<v Speaker 2>Helping organizations build stronger, more resilient systems.

712
00:35:12.840 --> 00:35:15.400
<v Speaker 1>Maybe some of you listening will even be inspired to

713
00:35:15.480 --> 00:35:19.199
<v Speaker 1>join this field, become the ethical hackers of tomorrow, making

714
00:35:19.199 --> 00:35:20.960
<v Speaker 1>the digital world a safer place.

715
00:35:21.119 --> 00:35:22.000
<v Speaker 2>That would be awesome.

716
00:35:22.199 --> 00:35:27.079
<v Speaker 1>So keep learning, keep exploring, keep pushing the boundaries of cybersecurity.

717
00:35:27.199 --> 00:35:31.159
<v Speaker 1>Be curious until next time, Stay vigilant, and keep on

718
00:35:31.559 --> 00:35:32.320
<v Speaker 1>diving deep