WEBVTT

1
00:00:00.080 --> 00:00:04.320
<v Speaker 1>Have you ever watched those intense movie scenes where a

2
00:00:04.400 --> 00:00:08.359
<v Speaker 1>hacker types like furiously a few lines of code and poof,

3
00:00:08.439 --> 00:00:13.480
<v Speaker 1>there's suddenly inside some top secret network happens exactly. It's

4
00:00:14.080 --> 00:00:18.039
<v Speaker 1>it's definitely dramatic, but the reality of digital security, and

5
00:00:18.079 --> 00:00:21.679
<v Speaker 1>you know, particularly the world of ethical hacking, it's, well,

6
00:00:21.719 --> 00:00:26.480
<v Speaker 1>it's far more methodical and honestly, I think even more fascinating.

7
00:00:26.519 --> 00:00:27.280
<v Speaker 2>I'd agree with that.

8
00:00:27.920 --> 00:00:33.359
<v Speaker 1>Today we're taking a deep dive into Collie Linux, which is, well,

9
00:00:33.600 --> 00:00:36.240
<v Speaker 1>it's really more than just an operating system, it really is.

10
00:00:36.320 --> 00:00:39.679
<v Speaker 2>It's a comprehensive framework, a powerhouse you could.

11
00:00:39.520 --> 00:00:43.039
<v Speaker 1>Say, yeah, packed with tools specifically designed for security auditing

12
00:00:43.240 --> 00:00:46.399
<v Speaker 1>and what we call penetration testing testing app. So our

13
00:00:46.479 --> 00:00:49.920
<v Speaker 1>mission for you, our listener, is to really extract the

14
00:00:49.920 --> 00:00:54.079
<v Speaker 1>most important nuggets from a detailed guide to Callie Linux.

15
00:00:54.320 --> 00:00:57.799
<v Speaker 1>Will explore exactly what penetration testing involves, right from the

16
00:00:57.960 --> 00:01:01.640
<v Speaker 1>very start, from the initial intelligence gap all the way

17
00:01:01.679 --> 00:01:05.280
<v Speaker 1>to that crucial final stage of reporting the findings. Think

18
00:01:05.280 --> 00:01:08.120
<v Speaker 1>of this as your shortcut to truly understanding the sort

19
00:01:08.120 --> 00:01:12.799
<v Speaker 1>of complex layers of digital defense and offense and offense. Yes,

20
00:01:13.120 --> 00:01:16.120
<v Speaker 1>so let's unpack this. When we talk about calli linux.

21
00:01:16.120 --> 00:01:18.000
<v Speaker 1>We're really talking about a complete framework.

22
00:01:18.079 --> 00:01:21.319
<v Speaker 2>Yeah, it comes pre loaded an expansive set of tools

23
00:01:21.319 --> 00:01:25.120
<v Speaker 2>covering well a huge range of cybersecurity use cases. Okay,

24
00:01:25.519 --> 00:01:29.239
<v Speaker 2>what's truly impressive about Kalie Linux is its incredible adaptability.

25
00:01:29.680 --> 00:01:32.519
<v Speaker 2>I mean, sure, you can install it on your personal laptop.

26
00:01:32.280 --> 00:01:33.640
<v Speaker 1>Right the standard way, but it.

27
00:01:33.560 --> 00:01:38.040
<v Speaker 2>Also excels on public servers for say, continuous network monitoring,

28
00:01:38.799 --> 00:01:44.040
<v Speaker 2>or on dedicated workstations for really deep forensic analysis forensics. Okay,

29
00:01:44.200 --> 00:01:47.680
<v Speaker 2>and here's where it gets particularly interesting. It can even

30
00:01:47.760 --> 00:01:51.920
<v Speaker 2>run on tiny embedded devices, things with an arm architecture CPUs,

31
00:01:52.040 --> 00:01:53.000
<v Speaker 2>like a Raspberry Pie.

32
00:01:53.040 --> 00:01:55.239
<v Speaker 1>Wow, a Raspberry Pie. That's tiny.

33
00:01:55.560 --> 00:01:58.120
<v Speaker 2>It is. Imagine that a device so small it could

34
00:01:58.159 --> 00:02:01.719
<v Speaker 2>literally act as a time bomb in a wireless network.

35
00:02:01.840 --> 00:02:04.799
<v Speaker 2>How so just by being plugged in somewhere discrete thanks

36
00:02:04.840 --> 00:02:07.799
<v Speaker 2>to its low power consumption and you know, small size.

37
00:02:08.000 --> 00:02:11.319
<v Speaker 2>It's about deploying powerful tools in completely unexpected places.

38
00:02:11.520 --> 00:02:13.800
<v Speaker 1>That's a great point. So it's not just some fancy

39
00:02:13.919 --> 00:02:17.000
<v Speaker 1>desktop environment. It's more like a like a Swiss army

40
00:02:17.039 --> 00:02:21.960
<v Speaker 1>knife for cybersecurity pros exactly, and honestly, for anyone curious

41
00:02:22.000 --> 00:02:23.479
<v Speaker 1>about how systems are secured.

42
00:02:23.680 --> 00:02:25.520
<v Speaker 2>Or how they might be breach or breach.

43
00:02:25.639 --> 00:02:28.599
<v Speaker 1>Yeah, so what kind of capabilities does the Swiss Army

44
00:02:28.680 --> 00:02:31.439
<v Speaker 1>Knife actually have inside?

45
00:02:31.520 --> 00:02:34.919
<v Speaker 2>Well beyond just the standard desktop cali Lenox offers this

46
00:02:35.759 --> 00:02:41.240
<v Speaker 2>carefully selected suite of core capabilities. They really show its range. Okay, Now,

47
00:02:41.280 --> 00:02:46.120
<v Speaker 2>instance information gathering. It gives you tools to systematically collect

48
00:02:46.199 --> 00:02:47.879
<v Speaker 2>data on target.

49
00:02:47.560 --> 00:02:49.759
<v Speaker 1>Systems, like what kind of data everything from.

50
00:02:49.680 --> 00:02:54.080
<v Speaker 2>The hardware they use, the operating systems, the services active

51
00:02:54.120 --> 00:02:57.120
<v Speaker 2>on their network, any sensitive areas that might be exposed,

52
00:02:57.560 --> 00:02:59.840
<v Speaker 2>even details about their active directories.

53
00:02:59.400 --> 00:03:02.280
<v Speaker 1>Active director Those are like the central control panels for

54
00:03:02.360 --> 00:03:03.319
<v Speaker 1>big networks.

55
00:03:03.039 --> 00:03:05.759
<v Speaker 2>Right verty much the central nervous system for managing users

56
00:03:05.759 --> 00:03:09.080
<v Speaker 2>and resources and a large company network. Crucial information.

57
00:03:09.520 --> 00:03:12.039
<v Speaker 1>And it's not just about what's inside a network, is it.

58
00:03:12.039 --> 00:03:14.439
<v Speaker 1>It's also about what's visible from the outside.

59
00:03:14.599 --> 00:03:19.560
<v Speaker 2>That's precisely where web application analysis becomes so critical. Ah okay.

60
00:03:19.759 --> 00:03:25.680
<v Speaker 2>College's tools can pinpoint flaws loopholes in publicly available web applications,

61
00:03:26.120 --> 00:03:28.199
<v Speaker 2>identifying them before malicious actors get a.

62
00:03:28.240 --> 00:03:30.400
<v Speaker 1>Chance proactive defense exactly.

63
00:03:30.960 --> 00:03:35.240
<v Speaker 2>Then there's vulnerability analysis. This uses tools loaded with massive

64
00:03:35.319 --> 00:03:39.960
<v Speaker 2>databases to understand common weaknesses in local systems remote systems.

65
00:03:40.680 --> 00:03:44.360
<v Speaker 2>It lets ethical hackers advise organizations precisely where they need

66
00:03:44.400 --> 00:03:46.000
<v Speaker 2>to shore up their defenses.

67
00:03:46.240 --> 00:03:49.599
<v Speaker 1>So you're essentially looking for those potential weaknesses, those open

68
00:03:49.680 --> 00:03:52.039
<v Speaker 1>doors before the bad guys even spot them.

69
00:03:52.120 --> 00:03:52.759
<v Speaker 2>That's the idea.

70
00:03:52.919 --> 00:03:55.240
<v Speaker 1>What other kinds of doors can cally help test?

71
00:03:55.560 --> 00:03:58.560
<v Speaker 2>Well? It also offers robust support for wireless attacks Wi

72
00:03:58.680 --> 00:04:01.639
<v Speaker 2>Fi and stuff. Yeah, it lets you use multiple wireless

73
00:04:01.639 --> 00:04:06.280
<v Speaker 2>cards to test and attack wireless networks. You can even

74
00:04:06.360 --> 00:04:10.159
<v Speaker 2>uncover inactive roads or maybe switches that might be misconfigured.

75
00:04:10.080 --> 00:04:12.800
<v Speaker 1>And getting pass logins, passwords.

76
00:04:12.280 --> 00:04:15.599
<v Speaker 2>Absolutely, password attacks. It includes tools to crack passwords and

77
00:04:15.680 --> 00:04:17.319
<v Speaker 2>attack what are called hashing systems.

78
00:04:17.360 --> 00:04:19.800
<v Speaker 1>Hashing systems, right, they scramble the passwords.

79
00:04:19.959 --> 00:04:23.199
<v Speaker 2>They do. They use mathematical functions to turn passwords into

80
00:04:23.279 --> 00:04:27.399
<v Speaker 2>unique codes. Your password isn't stored directly, just its hash.

81
00:04:27.959 --> 00:04:31.079
<v Speaker 2>Collie helps test how strong those hashing systems really are.

82
00:04:31.319 --> 00:04:34.560
<v Speaker 1>That's a really clear explanation. But okay, what if all

83
00:04:34.600 --> 00:04:38.319
<v Speaker 1>the technical defenses are like super strong, rock solid, where

84
00:04:38.319 --> 00:04:39.879
<v Speaker 1>does a penetration tester look then?

85
00:04:40.040 --> 00:04:43.240
<v Speaker 2>Ah, that leads us to social engineering tools. The human

86
00:04:43.279 --> 00:04:46.639
<v Speaker 2>element exactly. Yeah, When the tech is solid, the human

87
00:04:46.680 --> 00:04:50.680
<v Speaker 2>element often becomes the weakest link. COLLEIUE provides tools to

88
00:04:50.759 --> 00:04:55.879
<v Speaker 2>exploit this, like what like crafting deceptive USD drives, you know,

89
00:04:55.959 --> 00:04:58.240
<v Speaker 2>designed to entice someone to just plug it in, oh wow,

90
00:04:58.560 --> 00:05:02.120
<v Speaker 2>or creating sophisticated fish websites that look exactly like legitimate

91
00:05:02.160 --> 00:05:02.959
<v Speaker 2>banking sites for.

92
00:05:02.920 --> 00:05:04.160
<v Speaker 1>Example, Tricking people.

93
00:05:04.560 --> 00:05:07.680
<v Speaker 2>It's all designed to trick people into inadvertently compromising their

94
00:05:07.720 --> 00:05:13.680
<v Speaker 2>organization's security. It's about understanding how human behavior can be leveraged.

95
00:05:13.800 --> 00:05:17.360
<v Speaker 1>Okay, so when most people think about hacking, they probably picture,

96
00:05:17.480 --> 00:05:18.800
<v Speaker 1>you know, that lone.

97
00:05:18.519 --> 00:05:21.000
<v Speaker 2>Genius, Yeah, in a dark room.

98
00:05:20.959 --> 00:05:24.319
<v Speaker 1>Frantically typing green codes, rolling up the screen and then.

99
00:05:24.279 --> 00:05:25.879
<v Speaker 2>Bam, they're in instant access.

100
00:05:26.160 --> 00:05:30.240
<v Speaker 1>Movies make it look so instant and chaotic, but true

101
00:05:30.319 --> 00:05:38.000
<v Speaker 1>penetration testing it's actually incredibly structured, systematic, and surprisingly strategic.

102
00:05:38.079 --> 00:05:41.120
<v Speaker 2>That's a crucial point. What's fascinating here is just how

103
00:05:41.199 --> 00:05:45.399
<v Speaker 2>structured and methodical this entire process really is. It's worlds

104
00:05:45.399 --> 00:05:47.959
<v Speaker 2>away from the chaotic hacking you see in films. Right,

105
00:05:48.319 --> 00:05:52.480
<v Speaker 2>penetration testing follows a well a solid framework. It has

106
00:05:52.519 --> 00:05:55.240
<v Speaker 2>a proper structure and a very defined sequence.

107
00:05:55.399 --> 00:05:57.040
<v Speaker 1>Step by step, every.

108
00:05:56.800 --> 00:06:00.439
<v Speaker 2>Single stage builds logically on the last one h decision

109
00:06:00.560 --> 00:06:03.800
<v Speaker 2>is absolutely key. There are five main stages and they

110
00:06:03.839 --> 00:06:08.000
<v Speaker 2>follow a very linear path, almost like a military operation,

111
00:06:08.079 --> 00:06:09.120
<v Speaker 2>with distinct phases.

112
00:06:09.199 --> 00:06:12.800
<v Speaker 1>So definitely no instant access. Then how does this methodical,

113
00:06:12.879 --> 00:06:16.279
<v Speaker 1>almost intricate process actually start. What's the very first step.

114
00:06:16.519 --> 00:06:19.399
<v Speaker 2>It all kicks off with something we call reconnaissance. Recon

115
00:06:19.600 --> 00:06:22.480
<v Speaker 2>think of this like the military's intelligence analysts. It's all

116
00:06:22.519 --> 00:06:27.279
<v Speaker 2>about passive information gathering ass Okay, imagine officers and analysts,

117
00:06:27.519 --> 00:06:31.879
<v Speaker 2>you know, studying maps, monitoring activity from a secure, maybe

118
00:06:31.879 --> 00:06:37.319
<v Speaker 2>dimly lit room, gathering insights without any direct engagement, no detection.

119
00:06:37.600 --> 00:06:39.839
<v Speaker 1>So the goal is just learn everything.

120
00:06:40.040 --> 00:06:42.519
<v Speaker 2>The primary goal here is to find out as much

121
00:06:42.560 --> 00:06:46.360
<v Speaker 2>information about the target organization as humanly possible, all without

122
00:06:46.360 --> 00:06:47.160
<v Speaker 2>them ever knowing.

123
00:06:47.279 --> 00:06:50.920
<v Speaker 1>You're even looking, staying hidden, just observing. It's like casing

124
00:06:50.920 --> 00:06:52.399
<v Speaker 1>a building from across the street.

125
00:06:52.480 --> 00:06:53.279
<v Speaker 2>Perfect analogy.

126
00:06:53.560 --> 00:06:57.319
<v Speaker 1>So once you've gathered all that passive intel, what's the

127
00:06:57.360 --> 00:06:59.879
<v Speaker 1>next move? When you start getting a bit closer.

128
00:06:59.519 --> 00:07:02.240
<v Speaker 2>That's when you move into scanning. Okay, now picture maybe

129
00:07:02.279 --> 00:07:05.959
<v Speaker 2>a camouflaged soldier on a hilltop getting closer to the target,

130
00:07:06.079 --> 00:07:09.680
<v Speaker 2>but still trying to stay undetected. Their goal is to

131
00:07:09.720 --> 00:07:14.639
<v Speaker 2>confirm specific network infrastructure details. In pen testing, you use

132
00:07:14.759 --> 00:07:18.720
<v Speaker 2>tools to fetch concrete information on the target systems, their computers,

133
00:07:18.920 --> 00:07:20.319
<v Speaker 2>other devices on their network.

134
00:07:20.519 --> 00:07:22.360
<v Speaker 1>It's active now, but still stealthy.

135
00:07:22.439 --> 00:07:23.480
<v Speaker 2>It's stealthy as possible.

136
00:07:23.519 --> 00:07:27.040
<v Speaker 1>Yes, And once you've pinpointed those vulnerabilities, gathered your intel

137
00:07:27.079 --> 00:07:29.199
<v Speaker 1>from scanning, that's when you make your move, right.

138
00:07:29.360 --> 00:07:31.360
<v Speaker 2>Yes, that's the exploitation phase.

139
00:07:31.439 --> 00:07:32.959
<v Speaker 1>Okay, this sounds like the hacking part.

140
00:07:33.040 --> 00:07:36.360
<v Speaker 2>This is akin to a covert entry team. Imagine soldiers

141
00:07:36.519 --> 00:07:38.720
<v Speaker 2>entering a target camp through maybe a small gap in

142
00:07:38.759 --> 00:07:42.199
<v Speaker 2>a fence or an open door. They gather vital intelligence

143
00:07:42.680 --> 00:07:44.879
<v Speaker 2>and then crucially leave unnoticed.

144
00:07:45.120 --> 00:07:48.040
<v Speaker 1>Get in, get info, get out clean Exactly.

145
00:07:48.160 --> 00:07:51.000
<v Speaker 2>In our world, the goal is to enter the system,

146
00:07:51.480 --> 00:07:54.839
<v Speaker 2>gain the necessary information, and then leave the system without

147
00:07:54.879 --> 00:07:59.199
<v Speaker 2>being detected, all by leveraging those vulnerabilities you found earlier.

148
00:07:59.279 --> 00:08:02.800
<v Speaker 1>But gaining acts us just once. That isn't always enough,

149
00:08:02.879 --> 00:08:05.319
<v Speaker 1>is it, Especially if your objective requires you to come back,

150
00:08:05.439 --> 00:08:07.879
<v Speaker 1>or maybe if a whole team needs access over time.

151
00:08:08.079 --> 00:08:12.399
<v Speaker 2>Absolutely, that brings us to maintaining access. Okay, This is

152
00:08:12.439 --> 00:08:15.680
<v Speaker 2>where you might think of, say, tunnel engineer. Tunnel engineer, Yeah,

153
00:08:15.639 --> 00:08:17.639
<v Speaker 2>if they chart out a plan to get discrete tunnel

154
00:08:17.639 --> 00:08:20.279
<v Speaker 2>to a specific room so they can easily maintain access

155
00:08:20.319 --> 00:08:22.800
<v Speaker 2>to it. Ah, I see the strategic goal here is

156
00:08:22.839 --> 00:08:25.600
<v Speaker 2>to significantly reduce the time and effort it would take

157
00:08:25.920 --> 00:08:28.600
<v Speaker 2>to gain access to that same system again and again.

158
00:08:28.800 --> 00:08:31.199
<v Speaker 2>Makes sense, whether it's for future tasks you need to

159
00:08:31.199 --> 00:08:34.840
<v Speaker 2>perform or just for seamless collaboration among your pen testing team.

160
00:08:34.960 --> 00:08:35.320
<v Speaker 2>Got it.

161
00:08:35.720 --> 00:08:39.080
<v Speaker 1>And finally, after all that meticulous work, all those strategic steps,

162
00:08:39.720 --> 00:08:44.600
<v Speaker 1>it's time for the communication part, translating the tech stuff precisely.

163
00:08:45.039 --> 00:08:50.360
<v Speaker 2>The last stage is reporting. This is truly the commander's briefing.

164
00:08:50.840 --> 00:08:55.120
<v Speaker 2>Imagine a commander presenting a detailed report to generals and admirals,

165
00:08:55.559 --> 00:08:59.960
<v Speaker 2>clearly explaining the process they followed, the specific vulnerabilities they found,

166
00:09:00.320 --> 00:09:02.279
<v Speaker 2>which systems were successfully.

167
00:09:01.720 --> 00:09:03.639
<v Speaker 1>Attacked, so management can understand.

168
00:09:03.840 --> 00:09:06.720
<v Speaker 2>It's about taking all that complex technical work and translating

169
00:09:06.759 --> 00:09:10.639
<v Speaker 2>it into clear, actuable insights for management, for the technical

170
00:09:10.679 --> 00:09:14.559
<v Speaker 2>teams so they can understand and crucially act upon it.

171
00:09:14.720 --> 00:09:17.879
<v Speaker 1>That roadmap really paints a clear picture. Now let's maybe

172
00:09:17.919 --> 00:09:19.799
<v Speaker 1>dig into the nitty gritty of some of these key

173
00:09:19.799 --> 00:09:23.399
<v Speaker 1>stages and the tools involved. Okay, starting with reconnaissance again,

174
00:09:23.759 --> 00:09:26.320
<v Speaker 1>what are some of the clever ways you gather info

175
00:09:26.480 --> 00:09:30.159
<v Speaker 1>without you know, actually touching the target system directly.

176
00:09:30.559 --> 00:09:34.159
<v Speaker 2>Well in reconnaissance. One powerful technique is website mirroring.

177
00:09:34.559 --> 00:09:36.919
<v Speaker 1>Mirroring like making a copy exactly.

178
00:09:37.159 --> 00:09:39.600
<v Speaker 2>Tools like rudge a get there's a command line tool

179
00:09:39.720 --> 00:09:42.600
<v Speaker 2>they let you download an entire website, all its static

180
00:09:42.720 --> 00:09:46.440
<v Speaker 2>HTML files, images, everything, locally to your machine.

181
00:09:46.559 --> 00:09:47.240
<v Speaker 1>Why do that?

182
00:09:47.440 --> 00:09:50.600
<v Speaker 2>It's not just for convenience, It's a critical stealth tactic.

183
00:09:51.240 --> 00:09:54.360
<v Speaker 2>Think about casing that building again. You wouldn't keep knocking

184
00:09:54.360 --> 00:09:55.120
<v Speaker 2>on the front.

185
00:09:54.840 --> 00:09:56.559
<v Speaker 1>Door, right, Oh, definitely.

186
00:09:56.639 --> 00:10:00.879
<v Speaker 2>Not Mirroring the site lets you meticulously analyze every detail,

187
00:10:01.240 --> 00:10:05.399
<v Speaker 2>every hidden link, every piece of metadata, developer comments, all

188
00:10:05.399 --> 00:10:08.159
<v Speaker 2>from your own machine without leaving a trace on their

189
00:10:08.200 --> 00:10:08.879
<v Speaker 2>live servers.

190
00:10:08.960 --> 00:10:10.679
<v Speaker 1>It's like taking the blueprint home to.

191
00:10:10.679 --> 00:10:12.720
<v Speaker 2>Study precisely at your leisure.

192
00:10:13.000 --> 00:10:16.240
<v Speaker 1>So you're creating a local replica. What about using something

193
00:10:16.279 --> 00:10:19.559
<v Speaker 1>as common as say Google, I've heard of google hacking?

194
00:10:19.799 --> 00:10:20.600
<v Speaker 1>Is that a rest.

195
00:10:20.440 --> 00:10:23.480
<v Speaker 2>Absolutely Google hacking or Google dorking as it's sometimes called.

196
00:10:23.720 --> 00:10:26.879
<v Speaker 2>It was pioneered by Johnny Long. It leverages advanced search

197
00:10:26.919 --> 00:10:30.480
<v Speaker 2>parameters that go way beyond basic keywords, like how you

198
00:10:30.519 --> 00:10:33.600
<v Speaker 2>can search for exact phrases, restrict searches to a specific

199
00:10:33.639 --> 00:10:37.519
<v Speaker 2>site or domain like maybe only dogov domains. Or look

200
00:10:37.559 --> 00:10:39.039
<v Speaker 2>for particular file.

201
00:10:38.759 --> 00:10:41.159
<v Speaker 1>Types file types like word docs.

202
00:10:40.799 --> 00:10:44.879
<v Speaker 2>Yeah or SQL files which might accidentally contain sensitive data

203
00:10:44.960 --> 00:10:50.039
<v Speaker 2>like passwords if misconfigured, or PDF and docx documents that

204
00:10:50.120 --> 00:10:54.480
<v Speaker 2>can hold internal information wow. For example, the Google Hacking Database,

205
00:10:54.519 --> 00:10:57.919
<v Speaker 2>the GHDB has loads of these pre made queries. If

206
00:10:57.960 --> 00:11:01.960
<v Speaker 2>a website is misconfigured, these queries could potentially reveal things

207
00:11:02.000 --> 00:11:05.759
<v Speaker 2>like network device passwords, stuff that was never meant to

208
00:11:05.759 --> 00:11:06.360
<v Speaker 2>be public.

209
00:11:06.480 --> 00:11:09.039
<v Speaker 1>That's wild. It's almost like people leave clues just lying

210
00:11:09.080 --> 00:11:10.039
<v Speaker 1>around online.

211
00:11:10.240 --> 00:11:13.399
<v Speaker 2>Sometimes they do. It's about finding information that wasn't intended

212
00:11:13.440 --> 00:11:15.039
<v Speaker 2>to be publicly discoverable.

213
00:11:15.120 --> 00:11:17.879
<v Speaker 1>But what about the information they do willingly put out there,

214
00:11:18.000 --> 00:11:20.840
<v Speaker 1>maybe without realizing the security implications exactly.

215
00:11:21.000 --> 00:11:24.120
<v Speaker 2>And that's where social media and the human aspects become

216
00:11:24.120 --> 00:11:25.840
<v Speaker 2>a genuine gold mine for a pen.

217
00:11:25.759 --> 00:11:26.840
<v Speaker 1>Tester Like LinkedIn.

218
00:11:27.360 --> 00:11:30.759
<v Speaker 2>LinkedIn is invaluable. You can map out organizational charts, figure

219
00:11:30.759 --> 00:11:34.600
<v Speaker 2>out who does what. Even job postings can reveal technology insights,

220
00:11:34.799 --> 00:11:37.679
<v Speaker 2>what systems they're using, what skills they're hiring. For interesting,

221
00:11:37.679 --> 00:11:41.960
<v Speaker 2>there's even a concept called doppelganger creation, creating fictitious social

222
00:11:42.000 --> 00:11:45.559
<v Speaker 2>media profiles to gather intelligence, though obviously you have to

223
00:11:45.600 --> 00:11:48.240
<v Speaker 2>be extremely careful to op rate strictly within legal and

224
00:11:48.279 --> 00:11:49.039
<v Speaker 2>ethical boundaries.

225
00:11:49.080 --> 00:11:52.440
<v Speaker 1>There, right, a fixer key yeah, Okay. Beyond websites and

226
00:11:52.480 --> 00:11:56.200
<v Speaker 1>social media, what about the Internet's own directory system DNS.

227
00:11:56.320 --> 00:11:57.960
<v Speaker 2>Yeah, DNS attacks DNS.

228
00:11:58.000 --> 00:12:01.720
<v Speaker 1>The Domain name system is basically the telephone directory of

229
00:12:01.759 --> 00:12:06.799
<v Speaker 1>the Internet, right, translates website names into IP addresses. Tools

230
00:12:06.840 --> 00:12:09.720
<v Speaker 1>like and slock up can reveal crucial info like a

231
00:12:09.759 --> 00:12:14.080
<v Speaker 1>domain's mail servers MX records or it's name servers NS records. Okay,

232
00:12:14.480 --> 00:12:17.120
<v Speaker 1>and the more powerful dig tool can even attempt what's

233
00:12:17.120 --> 00:12:18.000
<v Speaker 1>called a zone.

234
00:12:17.840 --> 00:12:19.320
<v Speaker 2>Transfer zone transfer.

235
00:12:19.440 --> 00:12:22.000
<v Speaker 1>Yeah. If a name server is misconfigured, and sometimes they are,

236
00:12:22.039 --> 00:12:25.279
<v Speaker 1>a zone transfer can effectively dump all the information it

237
00:12:25.320 --> 00:12:28.080
<v Speaker 1>holds about a domain's network structure, like getting a full

238
00:12:28.159 --> 00:12:30.519
<v Speaker 1>phone book for their entire internal system layout.

239
00:12:30.639 --> 00:12:33.720
<v Speaker 2>Wow. Okay. So, once you've gathered all that passive intel

240
00:12:33.720 --> 00:12:36.759
<v Speaker 2>through recon, it's time for scanning. How do you identify

241
00:12:36.960 --> 00:12:41.240
<v Speaker 2>the more specific weaknesses active points of entry? Right? So, first,

242
00:12:41.360 --> 00:12:44.360
<v Speaker 2>maybe a quick recap on some network fundamentals. Idea, think

243
00:12:44.360 --> 00:12:47.960
<v Speaker 2>of a big building. It's got technically sixty five and

244
00:12:47.960 --> 00:12:52.080
<v Speaker 2>thirty five doors for TCP communication and another sixty five, thousand,

245
00:12:52.159 --> 00:12:55.720
<v Speaker 2>five and thirty five for UDP. These are ports.

246
00:12:55.879 --> 00:12:57.360
<v Speaker 1>Ports are like doors got it.

247
00:12:57.399 --> 00:13:00.679
<v Speaker 2>And firewalls are like the vigilant gate keepers deciding which

248
00:13:00.720 --> 00:13:02.840
<v Speaker 2>doors are open or closed. Then you have the main

249
00:13:02.879 --> 00:13:07.080
<v Speaker 2>it protocols. TCP is connection based, reliable, like a phone call.

250
00:13:07.120 --> 00:13:10.240
<v Speaker 2>You establish a connection, confirm every message gets through using

251
00:13:10.279 --> 00:13:10.879
<v Speaker 2>a three way.

252
00:13:10.720 --> 00:13:14.039
<v Speaker 1>Handschick s yn sinac ack exactly.

253
00:13:14.240 --> 00:13:17.360
<v Speaker 2>UDP is connectionless, faster, more like a radio broadcast. You

254
00:13:17.399 --> 00:13:19.840
<v Speaker 2>just send info out, no confirmation it was received okay.

255
00:13:20.000 --> 00:13:23.960
<v Speaker 2>And ICMP that's used for basic network health checks. Familiar

256
00:13:23.960 --> 00:13:26.639
<v Speaker 2>commands like pie and trace route. They tell you if

257
00:13:26.639 --> 00:13:28.960
<v Speaker 2>a device is online, how data packets get there.

258
00:13:29.240 --> 00:13:32.320
<v Speaker 1>So with all those potential doors those ports, scanning is

259
00:13:32.399 --> 00:13:35.080
<v Speaker 1>essentially knocking on them, seeing who answers and how.

260
00:13:35.240 --> 00:13:38.480
<v Speaker 2>That's a perfect analogy. And the undisputed scanning king for this.

261
00:13:38.559 --> 00:13:41.279
<v Speaker 1>Task is NMAP NMP right heard of it.

262
00:13:41.279 --> 00:13:44.720
<v Speaker 2>It's incredibly powerful. Goes way beyond just detecting if a

263
00:13:44.799 --> 00:13:48.200
<v Speaker 2>device is online. You can identify operating systems, the services

264
00:13:48.240 --> 00:13:52.399
<v Speaker 2>running on open ports, sometimes even specific user accounts associated

265
00:13:52.440 --> 00:13:53.240
<v Speaker 2>with those services.

266
00:13:53.320 --> 00:13:55.200
<v Speaker 1>Wow, what are the different ways it knocks?

267
00:13:55.320 --> 00:13:57.840
<v Speaker 2>Well? Key scan types vary in stealth and the info

268
00:13:57.879 --> 00:14:01.159
<v Speaker 2>they give back. A stealth scan dash ASS tries an

269
00:14:01.159 --> 00:14:04.960
<v Speaker 2>incomplete handshake. It's harder for poorly configured systems to log

270
00:14:05.080 --> 00:14:09.080
<v Speaker 2>or detect sneaky. A TCP connect scan dash ST completes

271
00:14:09.120 --> 00:14:12.039
<v Speaker 2>the handshake gives more detailed info, but it's much easier

272
00:14:12.039 --> 00:14:15.320
<v Speaker 2>to detect. Then. You also have UDP SCANSSU for those

273
00:14:15.399 --> 00:14:19.159
<v Speaker 2>UDP ports, and ACK scans SA, which can sometimes help

274
00:14:19.159 --> 00:14:20.320
<v Speaker 2>figure out firewall rules.

275
00:14:20.360 --> 00:14:22.559
<v Speaker 1>And you can control how fast or slow en MAP

276
00:14:22.679 --> 00:14:24.000
<v Speaker 1>is how aggressive.

277
00:14:23.559 --> 00:14:27.159
<v Speaker 2>Absolutely you can fine tune its behavior using timing templates.

278
00:14:27.360 --> 00:14:30.279
<v Speaker 2>They range from T zero, which is paranoid extremely slow

279
00:14:30.279 --> 00:14:32.600
<v Speaker 2>and stealthy all the way up to T five insane

280
00:14:32.960 --> 00:14:35.320
<v Speaker 2>very fast but much more likely to be detected or

281
00:14:35.360 --> 00:14:36.440
<v Speaker 2>even disrupt.

282
00:14:36.000 --> 00:14:38.960
<v Speaker 1>Things, so you choose based on the situation exactly.

283
00:14:39.120 --> 00:14:43.080
<v Speaker 2>You also have precise targeting methods, specifying IP ranges using

284
00:14:43.120 --> 00:14:46.399
<v Speaker 2>CIDR notation, even feeding it lists of targets from a file,

285
00:14:46.759 --> 00:14:50.399
<v Speaker 2>and you can select exact port selection WP if you

286
00:14:50.440 --> 00:14:54.799
<v Speaker 2>only care about specific doors like webports or file sharing ports.

287
00:14:54.960 --> 00:14:56.279
<v Speaker 1>And it has scripts too.

288
00:14:56.399 --> 00:15:01.159
<v Speaker 2>Yes, a very powerful n MAP scripting engine NSSE. It

289
00:15:01.200 --> 00:15:03.519
<v Speaker 2>allows you to run pre configured scripts for loads of

290
00:15:03.559 --> 00:15:08.200
<v Speaker 2>automated checks, vulnerability detection, more information gathering. It's vital to

291
00:15:08.279 --> 00:15:11.639
<v Speaker 2>keep that script database updated regularly. Script updated dub.

292
00:15:11.879 --> 00:15:14.639
<v Speaker 1>That sounds like it could generate a lot of raw data.

293
00:15:14.799 --> 00:15:17.159
<v Speaker 1>Is there a tool that helps make sense of it all?

294
00:15:17.320 --> 00:15:20.000
<v Speaker 1>Tells you what vulnerabilities are actually present in a more

295
00:15:20.039 --> 00:15:20.919
<v Speaker 1>digestible way.

296
00:15:21.120 --> 00:15:23.679
<v Speaker 2>That's precisely where nessus comes in nessus Okay, it's a

297
00:15:23.720 --> 00:15:27.480
<v Speaker 2>really powerful vulnerability scanner, comes from covie called tenable. Nessus

298
00:15:27.519 --> 00:15:31.120
<v Speaker 2>excels at taking that raw scan data, analyzing it and

299
00:15:31.200 --> 00:15:33.200
<v Speaker 2>identifying known vulnerabilities.

300
00:15:33.240 --> 00:15:33.840
<v Speaker 1>How does it work?

301
00:15:34.039 --> 00:15:37.720
<v Speaker 2>It typically has a web based interface, usually access securely

302
00:15:37.759 --> 00:15:41.799
<v Speaker 2>over HTTPS on your local machine. This interface lets you

303
00:15:41.840 --> 00:15:45.600
<v Speaker 2>easily configure scans, set of specific scanning policies, like maybe

304
00:15:45.600 --> 00:15:48.320
<v Speaker 2>you only want to check for critical web vulnerabilities, and

305
00:15:48.360 --> 00:15:49.639
<v Speaker 2>even disable certain.

306
00:15:49.440 --> 00:15:52.679
<v Speaker 1>Checks like ones that might be too risky exactly like.

307
00:15:52.679 --> 00:15:56.679
<v Speaker 2>Checks that might inadvertently trigger a denial of service derosis attack.

308
00:15:57.639 --> 00:16:00.320
<v Speaker 2>If your rules of engagement for a specific test phibit

309
00:16:00.679 --> 00:16:05.440
<v Speaker 2>potentially disruptive actions, you can disable those specific plugins in nessis.

310
00:16:05.559 --> 00:16:08.600
<v Speaker 1>Okay, that makes sense. All right, So you've done recon

311
00:16:08.759 --> 00:16:12.679
<v Speaker 1>You've scammed for vulnerabilities. Now we've arrived at stage three exploitation.

312
00:16:13.360 --> 00:16:16.320
<v Speaker 1>We've covered a lot of ground finding weaknesses. Now it

313
00:16:16.320 --> 00:16:18.960
<v Speaker 1>seems like the stage is set for the actual breach. Right.

314
00:16:19.039 --> 00:16:21.159
<v Speaker 1>This is probably what most people think of when they

315
00:16:21.159 --> 00:16:21.720
<v Speaker 1>hear hacking.

316
00:16:21.879 --> 00:16:24.200
<v Speaker 2>It often is Yes, So what happens.

317
00:16:23.799 --> 00:16:26.639
<v Speaker 1>Next in that process? And how do you even begin

318
00:16:26.720 --> 00:16:28.720
<v Speaker 1>to categorize the ways you might get in?

319
00:16:29.120 --> 00:16:32.039
<v Speaker 2>That's a great question, and it highlights an important distinction,

320
00:16:32.559 --> 00:16:35.559
<v Speaker 2>the difference between an attack vector and an attack.

321
00:16:35.360 --> 00:16:36.679
<v Speaker 1>Type vector versus type.

322
00:16:36.759 --> 00:16:40.039
<v Speaker 2>Okay, think of it like a disease, a pathogen. The

323
00:16:40.159 --> 00:16:43.039
<v Speaker 2>vector is the means by which it travels. For example,

324
00:16:43.360 --> 00:16:47.000
<v Speaker 2>a web based attack vector means the attack comes through

325
00:16:47.039 --> 00:16:49.399
<v Speaker 2>a web browser or web server interaction.

326
00:16:49.200 --> 00:16:50.000
<v Speaker 1>Right the pathway.

327
00:16:50.159 --> 00:16:52.879
<v Speaker 2>The type is the specific action the pathogen takes once

328
00:16:52.919 --> 00:16:55.960
<v Speaker 2>it arrives. So for a web vector, the attack type

329
00:16:56.039 --> 00:16:59.879
<v Speaker 2>might be something like SEQL injection manipulating database queries, or

330
00:17:00.039 --> 00:17:04.599
<v Speaker 2>cross site scripting EXSS injecting malicious code into a website

331
00:17:04.799 --> 00:17:06.480
<v Speaker 2>for other users to encounter. Ah.

332
00:17:06.519 --> 00:17:08.920
<v Speaker 1>Okay, vector is the path. Type is the weapon.

333
00:17:09.000 --> 00:17:11.000
<v Speaker 2>You got it. The vector is the path The type

334
00:17:11.039 --> 00:17:13.480
<v Speaker 2>is the specific method of attack used on that path.

335
00:17:13.640 --> 00:17:16.720
<v Speaker 1>So you're choosing your path then selecting your specific weapon

336
00:17:16.759 --> 00:17:19.960
<v Speaker 1>for that path. Are there different kinds of exploits depending

337
00:17:19.960 --> 00:17:22.839
<v Speaker 1>on how you're connecting to the target system itself.

338
00:17:23.000 --> 00:17:27.480
<v Speaker 2>Yes. Broadly speaking, we categorize them as local exploits and remote.

339
00:17:27.119 --> 00:17:29.039
<v Speaker 1>Exploits, local versus remote.

340
00:17:29.160 --> 00:17:31.880
<v Speaker 2>A local exploit means you already have some level of

341
00:17:31.920 --> 00:17:35.200
<v Speaker 2>access to the system, maybe physical access, or you've already

342
00:17:35.240 --> 00:17:38.000
<v Speaker 2>logged in via SSH, or you're connected through a VPN.

343
00:17:38.160 --> 00:17:40.119
<v Speaker 1>You're already inside somehow.

344
00:17:40.000 --> 00:17:43.680
<v Speaker 2>Right, and social engineering often bridges this gap. Remember the

345
00:17:43.759 --> 00:17:48.240
<v Speaker 2>USB drive. Yeah, tricking a user into running said trojan

346
00:17:48.279 --> 00:17:50.680
<v Speaker 2>code embedded in a PDF or getting them to plug

347
00:17:50.720 --> 00:17:54.400
<v Speaker 2>in that malicious USB drive left as a courier. Those

348
00:17:54.480 --> 00:17:57.079
<v Speaker 2>actions can lead to the execution of code needed for

349
00:17:57.119 --> 00:18:00.680
<v Speaker 2>a local exploit, okay. And remote remote to exploits, on

350
00:18:00.720 --> 00:18:04.440
<v Speaker 2>the other hand, allow access purely through network connections. You

351
00:18:04.480 --> 00:18:08.319
<v Speaker 2>don't need any prior physical presence or user interaction on

352
00:18:08.480 --> 00:18:11.640
<v Speaker 2>the target machine itself. If it's not local, it's remote,

353
00:18:11.640 --> 00:18:13.319
<v Speaker 2>you're attacking it across the network.

354
00:18:13.400 --> 00:18:16.680
<v Speaker 1>Gotcha. And for actually doing these exploits, for orchestrating them,

355
00:18:17.039 --> 00:18:19.640
<v Speaker 1>there's one tool that really stands out, isn't there the

356
00:18:19.640 --> 00:18:21.039
<v Speaker 1>one you always hear about.

357
00:18:20.839 --> 00:18:24.640
<v Speaker 2>Absolutely the Metasploitt framework Menness point. It's arguably one of

358
00:18:24.680 --> 00:18:28.279
<v Speaker 2>the most powerful, most comprehensive tools available to a penetration tester.

359
00:18:28.640 --> 00:18:31.279
<v Speaker 2>It's often considered the crown jewel of many toolkits.

360
00:18:31.319 --> 00:18:32.519
<v Speaker 1>Why is it so powerful.

361
00:18:32.599 --> 00:18:36.400
<v Speaker 2>It's a result of years of knowledge, countless tests and trials,

362
00:18:36.799 --> 00:18:41.920
<v Speaker 2>contributions from security experts all over the globe. And it's incredibly.

363
00:18:41.359 --> 00:18:43.599
<v Speaker 1>Modular, modular like build up blocks.

364
00:18:43.880 --> 00:18:46.559
<v Speaker 2>Kind of think of it like James Bond's Aston Martin.

365
00:18:46.920 --> 00:18:50.000
<v Speaker 2>It has all these different gadgets, right ejector seed oil slick.

366
00:18:50.480 --> 00:18:54.880
<v Speaker 2>Metasploid is similar, with independent components or modules that can

367
00:18:54.920 --> 00:18:56.759
<v Speaker 2>be swapped in and out depending on the mission.

368
00:18:56.880 --> 00:18:58.799
<v Speaker 1>Okay, so it's not just one program, but a collection

369
00:18:58.880 --> 00:19:00.880
<v Speaker 1>of specialized parts. What are the key parts?

370
00:19:01.200 --> 00:19:04.039
<v Speaker 2>There are several key module types that work together. You

371
00:19:04.119 --> 00:19:08.400
<v Speaker 2>have exploit modules. These contain the actual pre written code

372
00:19:08.480 --> 00:19:11.759
<v Speaker 2>designed to leverage a specific vulnerability on a target system

373
00:19:12.119 --> 00:19:12.759
<v Speaker 2>to gain.

374
00:19:12.599 --> 00:19:14.559
<v Speaker 1>Access the attack code itself.

375
00:19:14.680 --> 00:19:17.559
<v Speaker 2>Right. Then there are auxiliary modules. These are for tasks

376
00:19:17.640 --> 00:19:20.519
<v Speaker 2>other than direct exploitation, things like scanning.

377
00:19:20.440 --> 00:19:22.640
<v Speaker 1>Fuzzing, fuzzing, what's that sending lots.

378
00:19:22.440 --> 00:19:25.079
<v Speaker 2>Of unexpected or random data to a program to see

379
00:19:25.079 --> 00:19:29.279
<v Speaker 2>if it crashes or reveals vulnerabilities. Auxiliary modules also include

380
00:19:29.319 --> 00:19:32.720
<v Speaker 2>things like SQL injection tools. They're mainly for gathering information

381
00:19:33.200 --> 00:19:34.720
<v Speaker 2>or performing specific checks.

382
00:19:34.880 --> 00:19:37.559
<v Speaker 1>Okay, exploits auxiliary what else?

383
00:19:37.759 --> 00:19:41.240
<v Speaker 2>Payloads? Payloads are crucial. They are the instructions to the

384
00:19:41.279 --> 00:19:44.519
<v Speaker 2>compromised system after it exploit succeeds. Think of them like

385
00:19:44.599 --> 00:19:48.279
<v Speaker 2>tiny communication devices dropped on the target that tell it

386
00:19:48.319 --> 00:19:52.440
<v Speaker 2>what to do next, like phone home exactly, or open

387
00:19:52.519 --> 00:19:56.440
<v Speaker 2>a command prompt. Then you have listeners or handlers. These

388
00:19:56.519 --> 00:19:59.480
<v Speaker 2>run on your machine waiting to communicate with those payloads

389
00:19:59.519 --> 00:20:03.400
<v Speaker 2>once they'rerunning on the target, a receiving end precisely. And finally,

390
00:20:03.680 --> 00:20:08.119
<v Speaker 2>shell code. This is the core, often very compact, piece

391
00:20:08.119 --> 00:20:13.119
<v Speaker 2>of machine code within a payload that's directly responsible for, say,

392
00:20:13.680 --> 00:20:16.720
<v Speaker 2>opening that command prompt or creating the communication channel. It's

393
00:20:16.759 --> 00:20:18.799
<v Speaker 2>like the explosives packed inside the payload.

394
00:20:18.920 --> 00:20:21.039
<v Speaker 1>Can you give us a more concrete example of how

395
00:20:21.079 --> 00:20:22.680
<v Speaker 1>those payloads work what they let you do?

396
00:20:22.880 --> 00:20:26.680
<v Speaker 2>Sure? Payloads are typically classified as either bind shells.

397
00:20:26.440 --> 00:20:28.279
<v Speaker 1>Or reverse shells bind versus reverse.

398
00:20:28.359 --> 00:20:30.279
<v Speaker 2>A bind shell is like a dormant program on the

399
00:20:30.279 --> 00:20:33.319
<v Speaker 2>target system. It opens up a port and just waits

400
00:20:33.319 --> 00:20:34.559
<v Speaker 2>for the attacker you to connect to it.

401
00:20:34.640 --> 00:20:36.400
<v Speaker 1>Okay, it waits for your call right.

402
00:20:36.640 --> 00:20:38.799
<v Speaker 2>A reverse shell, on the other hand, is often more useful,

403
00:20:38.920 --> 00:20:42.400
<v Speaker 2>especially through firewalls. When it runs, it immediately connects back

404
00:20:42.400 --> 00:20:45.559
<v Speaker 2>to the attacker's listening machine. It calls you exactly. It

405
00:20:45.640 --> 00:20:49.440
<v Speaker 2>actively reaches out, often bypassing firewall rules that might block

406
00:20:49.519 --> 00:20:53.599
<v Speaker 2>incoming connections. This gives the attacker direct keyboard access.

407
00:20:54.039 --> 00:20:56.200
<v Speaker 1>And you mentioned a special shell.

408
00:20:56.319 --> 00:20:59.680
<v Speaker 2>Min ah, Yes, the interpreter shell. This is really the

409
00:20:59.720 --> 00:21:03.799
<v Speaker 2>bread butter of metasploit post exploitation. It's a special, highly

410
00:21:03.880 --> 00:21:07.440
<v Speaker 2>versatile in memory shell. Once it's running on the target

411
00:21:07.559 --> 00:21:10.440
<v Speaker 2>via a payload, it gives you its own small but

412
00:21:10.559 --> 00:21:13.920
<v Speaker 2>powerful set of tools and commands directly on the compromise

413
00:21:13.960 --> 00:21:17.440
<v Speaker 2>system without writing much to the disc, making it stealthier.

414
00:21:17.839 --> 00:21:21.079
<v Speaker 1>So this is where it gets really interesting. Metasploit is

415
00:21:21.119 --> 00:21:25.240
<v Speaker 1>like this finely tuned orchestra of hacking tools, each playing

416
00:21:25.279 --> 00:21:27.720
<v Speaker 1>its part. How do you actually use it, say, to

417
00:21:27.839 --> 00:21:29.720
<v Speaker 1>run a scan or launch an exploit?

418
00:21:29.880 --> 00:21:32.640
<v Speaker 2>You can often access it via web based graphical interface,

419
00:21:32.680 --> 00:21:35.359
<v Speaker 2>which can be easier for some tasks, or through its

420
00:21:35.400 --> 00:21:39.160
<v Speaker 2>command line interface MS console, which is very powerful. Before

421
00:21:39.240 --> 00:21:42.319
<v Speaker 2>any serious mission, it's crucial to update its database of

422
00:21:42.400 --> 00:21:46.039
<v Speaker 2>exploits payloads and modules. Take it current always. When you're

423
00:21:46.039 --> 00:21:48.839
<v Speaker 2>setting up a scan or configuring an exploit. Within metasploit,

424
00:21:49.160 --> 00:21:51.640
<v Speaker 2>you define your targets, could be a single IP, arrange

425
00:21:51.640 --> 00:21:54.200
<v Speaker 2>a list from a file. Then you can configure various

426
00:21:54.240 --> 00:21:57.119
<v Speaker 2>advanced target settings like what this lets you fine tune things,

427
00:21:57.119 --> 00:22:00.920
<v Speaker 2>maybe exclude certain sensitive addresses from the scan, add custom

428
00:22:01.039 --> 00:22:04.640
<v Speaker 2>end map arguments for more specific scanning, or even set

429
00:22:04.720 --> 00:22:07.759
<v Speaker 2>a custom TCP source port to try and bypass certain

430
00:22:07.799 --> 00:22:10.720
<v Speaker 2>firewall rules that might filter based on source ports.

431
00:22:11.200 --> 00:22:15.559
<v Speaker 1>Sneaky, And once you've successfully exploited a system, you get

432
00:22:15.559 --> 00:22:19.759
<v Speaker 1>that interpreter session. What happens next? What can you actually

433
00:22:19.839 --> 00:22:20.559
<v Speaker 1>do from there?

434
00:22:20.920 --> 00:22:23.720
<v Speaker 2>Inside of interpreter session you unlock a whole suite of

435
00:22:23.759 --> 00:22:28.759
<v Speaker 2>post exploitation capabilities. It's really powerful. You can collect system data,

436
00:22:28.920 --> 00:22:32.359
<v Speaker 2>grab things like cash, Windows passwords, password hashes, or take

437
00:22:32.400 --> 00:22:35.839
<v Speaker 2>screenshots of the user's desktop. Wow. You can access filesystem

438
00:22:35.880 --> 00:22:39.559
<v Speaker 2>to upload your own tools, download sensitive files, or modify

439
00:22:39.599 --> 00:22:42.599
<v Speaker 2>existing ones. You can get a standard command shell to

440
00:22:42.640 --> 00:22:46.200
<v Speaker 2>interact directly with a target operating system using its native commands,

441
00:22:46.559 --> 00:22:49.119
<v Speaker 2>so full control pretty close. You can also do more

442
00:22:49.160 --> 00:22:51.680
<v Speaker 2>advanced things like great proxy pivot.

443
00:22:51.440 --> 00:22:52.400
<v Speaker 1>Pivot What's that?

444
00:22:53.000 --> 00:22:55.640
<v Speaker 2>It means using the compromised target machine as a gateway,

445
00:22:55.960 --> 00:22:58.720
<v Speaker 2>you pivot through it to scan or attack other systems

446
00:22:58.720 --> 00:23:01.880
<v Speaker 2>deeper inside their network you couldn't reach directly from the outside,

447
00:23:02.200 --> 00:23:05.319
<v Speaker 2>like island hopping. Exactly like island hopping in a network.

448
00:23:05.519 --> 00:23:08.920
<v Speaker 2>You can even create VPN pivot for encrypted traffic through

449
00:23:08.960 --> 00:23:11.599
<v Speaker 2>the target, and of course you can terminate session cleanly

450
00:23:11.640 --> 00:23:13.359
<v Speaker 2>when your work on that system is done.

451
00:23:13.519 --> 00:23:16.680
<v Speaker 1>This all sounds very focused on networks and operating systems,

452
00:23:17.119 --> 00:23:20.759
<v Speaker 1>But what about exploiting web servers and web applications? They're

453
00:23:20.799 --> 00:23:22.839
<v Speaker 1>everywhere right, often publicly exposed.

454
00:23:23.039 --> 00:23:26.079
<v Speaker 2>They are Web applications R and D a very common

455
00:23:26.119 --> 00:23:29.480
<v Speaker 2>target precisely because of that public exposure. Things listed in

456
00:23:29.519 --> 00:23:29.799
<v Speaker 2>the o.

457
00:23:29.839 --> 00:23:33.240
<v Speaker 1>ASP Top test wellwash right Open Web Application Security Project.

458
00:23:33.319 --> 00:23:35.960
<v Speaker 2>Yeah, their top ten lists the most common web vulnerabilities,

459
00:23:35.960 --> 00:23:40.759
<v Speaker 2>things like injection attacks, SQL injection, command injection, broken authentication,

460
00:23:41.000 --> 00:23:45.160
<v Speaker 2>cross site scripting XSS. These are frequent targets for PEN testers.

461
00:23:45.279 --> 00:23:47.799
<v Speaker 1>So how do you test web apps? Is it similar?

462
00:23:48.200 --> 00:23:52.920
<v Speaker 2>Web application testing often follows similar phases recon scanning, exploitation.

463
00:23:53.359 --> 00:23:55.119
<v Speaker 2>It usually begins with a manual review.

464
00:23:55.279 --> 00:23:57.480
<v Speaker 1>Manual justaing around.

465
00:23:57.400 --> 00:24:02.440
<v Speaker 2>Pretty much meticulously clicking every link, trying default or common

466
00:24:02.480 --> 00:24:06.599
<v Speaker 2>password guesses on log informs, carefully inspecting the website's htmail

467
00:24:06.720 --> 00:24:09.359
<v Speaker 2>source code for any comments or hidden information left behind

468
00:24:09.359 --> 00:24:11.559
<v Speaker 2>by developers. Good old fashioned.

469
00:24:11.240 --> 00:24:13.440
<v Speaker 1>Detective work, finding clues.

470
00:24:13.279 --> 00:24:17.599
<v Speaker 2>Finding clues. Then you move to fingerprinting. This uses tools

471
00:24:17.599 --> 00:24:20.440
<v Speaker 2>to actively probe the web server to figure out what

472
00:24:20.519 --> 00:24:21.200
<v Speaker 2>software it's.

473
00:24:21.079 --> 00:24:23.920
<v Speaker 1>Running, like endmap, but for web servers sort of.

474
00:24:24.279 --> 00:24:27.200
<v Speaker 2>Tools like netcat NC can connect to the web server's port,

475
00:24:27.359 --> 00:24:30.680
<v Speaker 2>and by setting a simple head HTTP one point zero request,

476
00:24:31.039 --> 00:24:34.359
<v Speaker 2>you can often get backheaders revealing valuable info like it's

477
00:24:34.440 --> 00:24:37.400
<v Speaker 2>running apatche version two point two on Linux of boontu okay.

478
00:24:37.559 --> 00:24:40.400
<v Speaker 2>Other tools like telnet can do similar things, and SSL

479
00:24:40.440 --> 00:24:43.359
<v Speaker 2>scan is great for checking which versions of ssltls the

480
00:24:43.359 --> 00:24:47.640
<v Speaker 2>server supports and looking at its certificate details for potential weaknesses.

481
00:24:47.119 --> 00:24:48.400
<v Speaker 1>And then automated tools.

482
00:24:48.759 --> 00:24:53.200
<v Speaker 2>Yes, after manual checks and fingerprinting, automated scanning tools come

483
00:24:53.240 --> 00:24:56.599
<v Speaker 2>into play. There are several good ones in colli Aracne

484
00:24:56.599 --> 00:24:58.759
<v Speaker 2>has a nice WebUI and is good for scanning a

485
00:24:58.799 --> 00:25:02.079
<v Speaker 2>single host I port W three AF was developed by

486
00:25:02.079 --> 00:25:04.880
<v Speaker 2>Owas people. It's very comprehensive with lots of plugins for

487
00:25:04.920 --> 00:25:08.680
<v Speaker 2>different checks and websploit is a Ruby based tool focused

488
00:25:08.680 --> 00:25:11.920
<v Speaker 2>specifically on web app exploits, and it integrates nicely with metasploit.

489
00:25:12.160 --> 00:25:14.880
<v Speaker 1>Okay, so a whole suite for web stuff too. Now,

490
00:25:14.960 --> 00:25:17.920
<v Speaker 1>after all that effort to gain access through the network

491
00:25:17.920 --> 00:25:20.079
<v Speaker 1>through web app whatever, the next stage you mentioned was

492
00:25:20.240 --> 00:25:24.240
<v Speaker 1>maintaining access the long game. Why is it so crucial

493
00:25:24.279 --> 00:25:27.079
<v Speaker 1>to establish that persistent access once you're in It seems

494
00:25:27.079 --> 00:25:28.359
<v Speaker 1>like you've already done the hard part.

495
00:25:28.599 --> 00:25:32.119
<v Speaker 2>The purpose is actually quite straightforward. It's to reduce the

496
00:25:32.160 --> 00:25:34.960
<v Speaker 2>time and effort taken to gain access to the same

497
00:25:35.039 --> 00:25:36.000
<v Speaker 2>system again.

498
00:25:35.920 --> 00:25:38.920
<v Speaker 1>Later on efficiency, efficiency.

499
00:25:38.400 --> 00:25:42.079
<v Speaker 2>Exactly, and for collaboration. If you have an ethical hacking

500
00:25:42.119 --> 00:25:45.839
<v Speaker 2>team working on an engagement, you definitely don't want every

501
00:25:45.880 --> 00:25:48.079
<v Speaker 2>single team member to have to go through the entire

502
00:25:48.400 --> 00:25:53.160
<v Speaker 2>potentially complex exploitation process from scratch every time they need

503
00:25:53.200 --> 00:25:56.519
<v Speaker 2>to access a system that's already been compromised by a teammate, right, That.

504
00:25:56.519 --> 00:25:57.920
<v Speaker 1>Would be a huge waste of time.

505
00:25:58.039 --> 00:26:02.119
<v Speaker 2>It's about efficiency and enabling sustained engagement, whether for further

506
00:26:02.160 --> 00:26:04.559
<v Speaker 2>testing or coordinated team actions.

507
00:26:04.559 --> 00:26:06.960
<v Speaker 1>So you leave a little something behind a way back in.

508
00:26:07.200 --> 00:26:09.920
<v Speaker 2>You might, yeah, and understand this properly. We need to

509
00:26:09.960 --> 00:26:13.599
<v Speaker 2>clarify some terminology first, Okay. Malware is just a generic

510
00:26:13.680 --> 00:26:18.400
<v Speaker 2>umbrella term for any kind of malicious software viruses, worms, trojans,

511
00:26:18.400 --> 00:26:18.839
<v Speaker 2>et cetera.

512
00:26:18.960 --> 00:26:19.279
<v Speaker 1>Got it.

513
00:26:19.680 --> 00:26:22.680
<v Speaker 2>A backdoor is a program specifically planted on a system

514
00:26:22.839 --> 00:26:27.079
<v Speaker 2>after initial compromise. Its sole purpose is to provide easy

515
00:26:27.160 --> 00:26:31.799
<v Speaker 2>future entry bypassing the original exploit method the secret entrance exactly.

516
00:26:32.119 --> 00:26:34.880
<v Speaker 2>A trojan horse is software that looks legitimate or useful,

517
00:26:35.279 --> 00:26:38.519
<v Speaker 2>maybe a game, a utility, a PDF read, but secretly

518
00:26:38.519 --> 00:26:42.799
<v Speaker 2>contains hidden malicious functionality like that back door. Very A

519
00:26:42.880 --> 00:26:47.039
<v Speaker 2>virus typically infects existing legitimate files or processes on the system.

520
00:26:47.720 --> 00:26:51.599
<v Speaker 2>Worms are self multiplying malware that spread across networks, generally

521
00:26:51.680 --> 00:26:54.920
<v Speaker 2>something you strictly avoid in a real ethical penetration test

522
00:26:55.240 --> 00:26:57.200
<v Speaker 2>because they can quickly get out of control and cause

523
00:26:57.240 --> 00:26:58.079
<v Speaker 2>widespread damage.

524
00:26:58.160 --> 00:26:59.880
<v Speaker 1>Right too risky, definitely.

525
00:27:00.400 --> 00:27:03.680
<v Speaker 2>Keyloggers are tools that capture keystrokes with the user types,

526
00:27:04.480 --> 00:27:08.480
<v Speaker 2>and botnets are networks of compromised computers, all controlled remotely

527
00:27:08.519 --> 00:27:12.359
<v Speaker 2>by a botmaster for coordinated tasks like sending spam or

528
00:27:12.400 --> 00:27:13.920
<v Speaker 2>launching denial of service attacks.

529
00:27:13.960 --> 00:27:16.240
<v Speaker 1>Okay, that clarifies the term. So what are some of

530
00:27:16.240 --> 00:27:20.039
<v Speaker 1>the actual strategies for maintaining this access once you've decided

531
00:27:20.079 --> 00:27:21.160
<v Speaker 1>you need it well.

532
00:27:21.319 --> 00:27:24.839
<v Speaker 2>Strategies can include things like collocation. This might mean hosting

533
00:27:24.880 --> 00:27:28.559
<v Speaker 2>malicious services on remote servers you control, or sometimes even

534
00:27:28.640 --> 00:27:32.039
<v Speaker 2>using compromised user computers as part of a larger infrastructure

535
00:27:32.160 --> 00:27:33.759
<v Speaker 2>like that spamming botnet.

536
00:27:33.319 --> 00:27:35.680
<v Speaker 1>Example, using their resources right.

537
00:27:36.039 --> 00:27:39.839
<v Speaker 2>Remote communications are key setting up covert tunnels, maybe using

538
00:27:39.920 --> 00:27:44.640
<v Speaker 2>VPNs or enabling remote desktop access back into the compromise system.

539
00:27:45.119 --> 00:27:47.839
<v Speaker 2>And command and control C two or C and C

540
00:27:47.960 --> 00:27:51.319
<v Speaker 2>systems are the infrastructure used by attackers to send commands

541
00:27:51.319 --> 00:27:55.519
<v Speaker 2>to and receive data from those compromise systems, managing their

542
00:27:55.559 --> 00:27:56.160
<v Speaker 2>back doors or.

543
00:27:56.160 --> 00:27:59.839
<v Speaker 1>Bots can metasploit help with creating and managing these backdoors too.

544
00:28:00.000 --> 00:28:01.359
<v Speaker 1>It seems like it does everything.

545
00:28:01.440 --> 00:28:05.039
<v Speaker 2>It's incredibly versatile for this as well. Metaploid has tools

546
00:28:05.319 --> 00:28:08.519
<v Speaker 2>like ms venom now which combined older tools like apps

547
00:28:08.599 --> 00:28:13.000
<v Speaker 2>payload and ansome code specifically for generating executable files payloads

548
00:28:13.000 --> 00:28:15.519
<v Speaker 2>for various operating systems, architectures and formats.

549
00:28:15.559 --> 00:28:18.359
<v Speaker 1>So you can make a Windows backdoor a Linux one exactly.

550
00:28:18.640 --> 00:28:21.720
<v Speaker 2>And what's more, you can often encode these payloads. Encoding

551
00:28:21.759 --> 00:28:24.359
<v Speaker 2>tries to obfuscate the payloads signature to make it harder

552
00:28:24.400 --> 00:28:27.799
<v Speaker 2>for antivirus software to detect it as malicious, avoiding av

553
00:28:28.039 --> 00:28:31.480
<v Speaker 2>trying to Yes, it's an ongoing cat and mouse game.

554
00:28:32.039 --> 00:28:35.759
<v Speaker 2>For example, using metasploid, you could create a trojan horse

555
00:28:36.039 --> 00:28:39.400
<v Speaker 2>by taking a legitimate harmless program like the standard Windows

556
00:28:39.440 --> 00:28:42.720
<v Speaker 2>calculator Yeah calc dot ex and embedding one of these

557
00:28:42.799 --> 00:28:46.440
<v Speaker 2>encoded backdoor payloads inside it. When the user runs the calculator,

558
00:28:46.799 --> 00:28:48.839
<v Speaker 2>the back door runs silently in the background.

559
00:28:49.079 --> 00:28:53.839
<v Speaker 1>Wow. Sneaky. So you create and deploy that back door

560
00:28:54.000 --> 00:28:56.720
<v Speaker 1>maybe hidden in a trojan than what how do you

561
00:28:56.799 --> 00:28:57.839
<v Speaker 1>actually connect to it later?

562
00:28:58.000 --> 00:29:00.640
<v Speaker 2>You absolutely need to set up a metasploil listener on

563
00:29:00.680 --> 00:29:03.559
<v Speaker 2>your attacking machine. This is a critical step the receiving

564
00:29:03.640 --> 00:29:06.680
<v Speaker 2>end again right. The listener uses the exploit multi handler

565
00:29:06.720 --> 00:29:09.200
<v Speaker 2>module in metasploit. You can figure it with the same

566
00:29:09.279 --> 00:29:13.079
<v Speaker 2>payload type, IP address LA to a plate and port

567
00:29:13.359 --> 00:29:15.839
<v Speaker 2>out or that you use when you generated the back door.

568
00:29:16.400 --> 00:29:19.720
<v Speaker 2>It then waits patiently listening for an income and connection.

569
00:29:19.519 --> 00:29:20.640
<v Speaker 1>And when the back door runs.

570
00:29:20.680 --> 00:29:23.000
<v Speaker 2>When the back door executable runs on the target machine,

571
00:29:23.000 --> 00:29:24.839
<v Speaker 2>it calls back to the IP address and port where

572
00:29:24.839 --> 00:29:27.599
<v Speaker 2>your listener is waiting. The listener catches the connection and boom.

573
00:29:27.640 --> 00:29:30.000
<v Speaker 2>You usually get a interpreter session giving you control again.

574
00:29:30.200 --> 00:29:33.240
<v Speaker 1>But what about reboots? If the user restarts their computer,

575
00:29:33.599 --> 00:29:34.920
<v Speaker 1>is the back door gone?

576
00:29:35.079 --> 00:29:39.759
<v Speaker 2>Good question. Simple backdoors might not survive a reboot. That's

577
00:29:39.799 --> 00:29:43.640
<v Speaker 2>where persistent back doors come in. Interpreter itself has scripts

578
00:29:43.880 --> 00:29:46.839
<v Speaker 2>like persistence or older ones like schedule EMA, which can

579
00:29:46.880 --> 00:29:50.359
<v Speaker 2>help establish access that persists over time out they might

580
00:29:50.359 --> 00:29:53.119
<v Speaker 2>install the back door as a service, or create scheduled

581
00:29:53.119 --> 00:29:55.680
<v Speaker 2>tasks or add registry keys so that the back door

582
00:29:55.720 --> 00:29:58.680
<v Speaker 2>automatically runs again every time the system boots up or

583
00:29:58.759 --> 00:30:01.200
<v Speaker 2>when a user logs in, even on a regular schedule

584
00:30:01.200 --> 00:30:04.559
<v Speaker 2>like daily or weekly. This ensures ongoing access.

585
00:30:05.039 --> 00:30:09.079
<v Speaker 1>Clever and what about capturing sensitive information like passwords? Can

586
00:30:09.119 --> 00:30:11.680
<v Speaker 1>you do that once you have this sustained access.

587
00:30:11.920 --> 00:30:16.119
<v Speaker 2>Yes. Metasploit's Interpreter shell includes a powerful built in key logger,

588
00:30:16.279 --> 00:30:20.640
<v Speaker 2>capturing typing exactly within an active interpreter session. Simple commands

589
00:30:20.680 --> 00:30:23.559
<v Speaker 2>allow you to start it, keys can start, retrieve everything

590
00:30:23.599 --> 00:30:26.160
<v Speaker 2>the user has typed since you started it, keyscin dump

591
00:30:26.440 --> 00:30:28.440
<v Speaker 2>and then stop it keyskin.

592
00:30:28.119 --> 00:30:30.559
<v Speaker 1>Stop So you could potentially grab passwords as they.

593
00:30:30.400 --> 00:30:34.960
<v Speaker 2>Type them, potentially yes or other sensitive information typed into

594
00:30:34.960 --> 00:30:37.680
<v Speaker 2>the emails, documents, anything. It's a very effective way to

595
00:30:37.680 --> 00:30:41.279
<v Speaker 2>collect information, although again the ethical considerations in the specific

596
00:30:41.359 --> 00:30:44.480
<v Speaker 2>rules of engagement for a test are absolutely paramount here.

597
00:30:44.519 --> 00:30:46.319
<v Speaker 2>You only collect what's necessary and authorized.

598
00:30:46.440 --> 00:30:52.279
<v Speaker 1>Right, Absolutely, So, all this meticulous work, recon scanning, exploitation,

599
00:30:52.599 --> 00:30:56.319
<v Speaker 1>maintaining access, all these strategic steps, these powerful tools, it

600
00:30:56.319 --> 00:30:59.559
<v Speaker 1>all culminates in the final and as you said, arguably

601
00:30:59.559 --> 00:31:03.920
<v Speaker 1>most sortant stage reporting. This is where you translate all

602
00:31:03.960 --> 00:31:07.160
<v Speaker 1>those technical findings into the so what for the people

603
00:31:07.160 --> 00:31:08.440
<v Speaker 1>who actually need to act on it?

604
00:31:08.519 --> 00:31:10.960
<v Speaker 2>Right? Exactly right? Yeah, If we connect this back to

605
00:31:11.000 --> 00:31:15.799
<v Speaker 2>the bigger picture, the entire penetration testing life cycle, from

606
00:31:15.839 --> 00:31:19.440
<v Speaker 2>that initial passive observation right through to securing ongoing access,

607
00:31:19.960 --> 00:31:23.400
<v Speaker 2>it all leads to this final, sometimes overlooked but utterly

608
00:31:23.480 --> 00:31:27.880
<v Speaker 2>crucial step, clear actionable reporting. Because without it, Without it,

609
00:31:28.200 --> 00:31:32.720
<v Speaker 2>all the brilliant technical work is frankly just academic, it

610
00:31:32.759 --> 00:31:36.359
<v Speaker 2>doesn't help the organization improve its security. These reports are

611
00:31:36.400 --> 00:31:39.400
<v Speaker 2>absolutely vital for both management, who need to understand the

612
00:31:39.480 --> 00:31:43.000
<v Speaker 2>risks and allocate resources, and for the technical staff who

613
00:31:43.039 --> 00:31:45.599
<v Speaker 2>need the details to actually fix the vulnerabilities.

614
00:31:45.839 --> 00:31:48.319
<v Speaker 1>What are the key parts of a really good penetration

615
00:31:48.559 --> 00:31:50.200
<v Speaker 1>test report? What should be in there?

616
00:31:50.440 --> 00:31:54.720
<v Speaker 2>Well, standard reports usually include several key sections. The executive

617
00:31:54.759 --> 00:31:57.759
<v Speaker 2>summary is critical. It's a high level overview, usually no

618
00:31:57.839 --> 00:32:02.160
<v Speaker 2>more than maybe two or three paragraphs, exactly written last

619
00:32:02.599 --> 00:32:05.160
<v Speaker 2>designed to quickly convey the most critical findings and the

620
00:32:05.200 --> 00:32:10.920
<v Speaker 2>overall security posture to non technical management needs visuals maybe graphskay?

621
00:32:11.079 --> 00:32:11.440
<v Speaker 1>What else?

622
00:32:11.519 --> 00:32:14.720
<v Speaker 2>And there's the engagement procedure section. This details the scope

623
00:32:14.720 --> 00:32:16.640
<v Speaker 2>of the test, what was in scope, what was out

624
00:32:16.640 --> 00:32:21.400
<v Speaker 2>of scope, the agreed upon methodology, any limitations. Transparency is key.

625
00:32:21.880 --> 00:32:25.799
<v Speaker 2>An optional architecture and composition section might describe the target

626
00:32:25.880 --> 00:32:30.200
<v Speaker 2>environment operating systems, key hardware, network layout if relevant, then

627
00:32:30.240 --> 00:32:34.720
<v Speaker 2>the juicy stuff, then the core. The finding section. This

628
00:32:34.880 --> 00:32:41.920
<v Speaker 2>lists all the discovered vulnerabilities, usually ranked by severity critical, high, medium, low. Crucially,

629
00:32:42.000 --> 00:32:45.359
<v Speaker 2>these should be clearly explained, demonstrate how they were exploited

630
00:32:45.559 --> 00:32:49.200
<v Speaker 2>and ideally linked to potential business impact or relevant compliance

631
00:32:49.200 --> 00:32:53.920
<v Speaker 2>standards like PCIDSS for payment cards or FISMA for government systems.

632
00:32:54.000 --> 00:32:56.319
<v Speaker 1>Okay, and just finding problems isn't.

633
00:32:56.160 --> 00:33:00.400
<v Speaker 2>Enough, No, you need recommended actions. This section outlines practical

634
00:33:00.440 --> 00:33:03.400
<v Speaker 2>steps the organization can take to remediate each finding or

635
00:33:03.400 --> 00:33:08.039
<v Speaker 2>at least mitigate the risk general fixes, configuration changes, patching advice.

636
00:33:08.640 --> 00:33:11.960
<v Speaker 2>Then a conclusion that summarizes the engagement and re emphasizes

637
00:33:12.000 --> 00:33:15.200
<v Speaker 2>the most critical findings, and finally appendices. This is where

638
00:33:15.240 --> 00:33:19.640
<v Speaker 2>you put supporting technical details raw TOUOL outputs, screenshots, scripts used,

639
00:33:19.880 --> 00:33:22.559
<v Speaker 2>IP addresses tested, anything that backs up the findings.

640
00:33:22.640 --> 00:33:26.079
<v Speaker 1>How important is the sort of professionalism the delivery of these.

641
00:33:25.880 --> 00:33:29.400
<v Speaker 2>Findings extremely important. Professionalism is absolutely key. You need to

642
00:33:29.440 --> 00:33:33.160
<v Speaker 2>avoid accusatory language or blaming individuals, focus purely on the

643
00:33:33.200 --> 00:33:36.519
<v Speaker 2>objective facts that technical findings and the associated risks. Just

644
00:33:36.559 --> 00:33:41.200
<v Speaker 2>the facts, Just the facts, and ensure secure delivery. These

645
00:33:41.240 --> 00:33:45.640
<v Speaker 2>reports contain highly sensitive information about an organization's weaknesses. You

646
00:33:45.759 --> 00:33:50.359
<v Speaker 2>need secure methods for handing them over in careful recordkeeping.

647
00:33:49.880 --> 00:33:52.000
<v Speaker 1>And what happens to the reports afterwards. You don't just

648
00:33:52.079 --> 00:33:53.039
<v Speaker 1>leave them lying.

649
00:33:52.839 --> 00:33:56.960
<v Speaker 2>Around, definitely not. Secure storage is critical. Encrypted digital copies

650
00:33:57.000 --> 00:34:00.880
<v Speaker 2>may be stored on offline media, protected with strong passwords, or,

651
00:34:01.119 --> 00:34:04.480
<v Speaker 2>depending on the agreement and legal advice, complete deletion might

652
00:34:04.519 --> 00:34:08.679
<v Speaker 2>be required after a certain period. Sometimes this requires two

653
00:34:08.760 --> 00:34:13.599
<v Speaker 2>person integrity, meaning to authorized individuals must concur before deletion

654
00:34:13.719 --> 00:34:17.639
<v Speaker 2>can occur. Always follow legal counsel's advice on retention.

655
00:34:17.400 --> 00:34:20.800
<v Speaker 1>And deletion handle with extreme care. Are there tools within

656
00:34:20.880 --> 00:34:23.559
<v Speaker 1>Kalie itself to help with this reporting process? It sounds

657
00:34:23.559 --> 00:34:24.639
<v Speaker 1>like a lot to compile.

658
00:34:24.960 --> 00:34:28.719
<v Speaker 2>Yes, Collie does offer tools specifically designed to streamline reporting.

659
00:34:28.960 --> 00:34:32.039
<v Speaker 2>Dratis is a popular open source framework. It's great for

660
00:34:32.079 --> 00:34:35.920
<v Speaker 2>collaboration within a testing team and helps consolidate findings and

661
00:34:35.960 --> 00:34:39.679
<v Speaker 2>evidence from various tools into a central repository, making report

662
00:34:39.760 --> 00:34:43.880
<v Speaker 2>generation easier. Another useful one sometimes mentioned is Magic Tree.

663
00:34:43.960 --> 00:34:47.679
<v Speaker 2>It's designed for data management and reporting, organizing information in

664
00:34:47.719 --> 00:34:51.039
<v Speaker 2>a hierarchical tree structure, which can be helpful for structuring

665
00:34:51.039 --> 00:34:54.800
<v Speaker 2>complex findings and notes during an engagement, ready for compiling

666
00:34:54.840 --> 00:34:55.840
<v Speaker 2>into the final report.

667
00:34:56.159 --> 00:35:01.119
<v Speaker 1>So tools to help manage the evidence and build the report. Okay,

668
00:35:02.440 --> 00:35:05.079
<v Speaker 1>So there you have it. We've taken a pretty comprehensive

669
00:35:05.280 --> 00:35:07.719
<v Speaker 1>deep dive, haven't we. We certainly have into the world

670
00:35:07.760 --> 00:35:11.880
<v Speaker 1>of Kalie, Linux and the intricate art of penetration testing.

671
00:35:12.480 --> 00:35:15.000
<v Speaker 1>We've moved from those high level concepts right down to

672
00:35:15.039 --> 00:35:18.039
<v Speaker 1>specific tools and the very methodical techniques they employ.

673
00:35:18.239 --> 00:35:20.360
<v Speaker 2>From recon all the way to reporting exactly.

674
00:35:20.639 --> 00:35:23.000
<v Speaker 1>Our mission today was really to give you our listener

675
00:35:23.079 --> 00:35:26.079
<v Speaker 1>a shortcut, a way to be truly well informed about

676
00:35:26.079 --> 00:35:30.519
<v Speaker 1>the systematic, often complex nature of securing digital systems. From

677
00:35:30.559 --> 00:35:34.440
<v Speaker 1>that initial passive reconnaissance, through active scanning and exploitation that

678
00:35:34.519 --> 00:35:38.880
<v Speaker 1>may be maintaining persistent access, and finally that absolutely crucial

679
00:35:38.880 --> 00:35:41.320
<v Speaker 1>step of clear, actionable reporting.

680
00:35:41.440 --> 00:35:44.239
<v Speaker 2>It's definitely a detailed, strategic process.

681
00:35:43.920 --> 00:35:45.880
<v Speaker 1>Far beyond what you typically see in the movies, that's

682
00:35:45.920 --> 00:35:49.760
<v Speaker 1>for sure, miles away. And as you reflect on the

683
00:35:49.800 --> 00:35:54.280
<v Speaker 1>incredible depth and frankly sophistication of these tools and techniques,

684
00:35:54.599 --> 00:35:57.920
<v Speaker 1>and the fact that technology is just constantly evolving, maybe

685
00:35:57.920 --> 00:36:02.199
<v Speaker 1>consider this, what does true digital security even look like,

686
00:36:02.639 --> 00:36:08.639
<v Speaker 1>especially in a world where we're constantly connecting new smart devices, watches, fridges, cars,

687
00:36:08.679 --> 00:36:12.280
<v Speaker 1>expanding our digital footprint in ways we're only just beginning

688
00:36:12.320 --> 00:36:13.079
<v Speaker 1>to fully grasp.

689
00:36:13.119 --> 00:36:14.559
<v Speaker 2>That's a big question, it is.

690
00:36:14.599 --> 00:36:17.679
<v Speaker 1>And how might you apply this newfound understanding, even just

691
00:36:17.719 --> 00:36:19.679
<v Speaker 1>a little bit to protect your own corner of that

692
00:36:19.719 --> 00:36:20.320
<v Speaker 1>digital world.