WEBVTT

1
00:00:00.120 --> 00:00:03.799
<v Speaker 1>Welcome to the deep dive. In a world just overflowing

2
00:00:03.839 --> 00:00:06.960
<v Speaker 1>with information, wouldn't it be incredible to cut through all

3
00:00:07.000 --> 00:00:10.279
<v Speaker 1>that noise and get straight to those you know, aha

4
00:00:10.599 --> 00:00:14.119
<v Speaker 1>moments on topics that really matter. Absolutely, Today we're diving

5
00:00:14.199 --> 00:00:18.399
<v Speaker 1>headfirst into a realm that's both fascinating and frankly critical

6
00:00:18.480 --> 00:00:20.920
<v Speaker 1>for our digital safety. Ethical hacking.

7
00:00:21.079 --> 00:00:25.199
<v Speaker 2>Yeah, it's true. The word hacking often conjures up images

8
00:00:25.199 --> 00:00:28.440
<v Speaker 2>of malicious activity, right, dark rooms, hoodies, right exactly, But

9
00:00:28.519 --> 00:00:33.719
<v Speaker 2>ethical hacking, sometimes called penetration testing, completely flips that perception

10
00:00:33.759 --> 00:00:37.560
<v Speaker 2>on its head. It's really about strategically simulating those very attacks,

11
00:00:37.640 --> 00:00:39.799
<v Speaker 2>but not to cause harm, No, not at all. It's

12
00:00:39.840 --> 00:00:43.880
<v Speaker 2>to proactively uncover vulnerabilities before the real bad actors ever

13
00:00:43.920 --> 00:00:45.920
<v Speaker 2>find them. When you zoom out and look at the

14
00:00:45.920 --> 00:00:50.119
<v Speaker 2>bigger picture. It's an indispensable part of modern cybersecurity exactly.

15
00:00:50.280 --> 00:00:52.640
<v Speaker 1>So this deep dive is custom tailored for you, and

16
00:00:52.679 --> 00:00:55.679
<v Speaker 1>we're drawing from a really insightful source ethical hacking with

17
00:00:55.759 --> 00:00:58.759
<v Speaker 1>Koalie Linux Learn Fast How to Hack Like a Pro

18
00:00:58.920 --> 00:01:00.560
<v Speaker 1>by Hugo Hoffman, good book.

19
00:01:00.679 --> 00:01:00.960
<v Speaker 2>Yeah.

20
00:01:01.039 --> 00:01:05.200
<v Speaker 1>Our mission to basically arm you with the essential concepts,

21
00:01:05.640 --> 00:01:09.719
<v Speaker 1>the UH systematic methodologies and to peek into the powerful

22
00:01:09.760 --> 00:01:11.719
<v Speaker 1>tools ethical hackers.

23
00:01:11.599 --> 00:01:14.640
<v Speaker 2>Use, but always, always with that white hat perspective.

24
00:01:15.159 --> 00:01:17.560
<v Speaker 1>That's the key, and you might be surprised at how

25
00:01:17.599 --> 00:01:20.280
<v Speaker 1>accessible some of these fundamental ideas can be even if

26
00:01:20.319 --> 00:01:23.120
<v Speaker 1>you don't have like a super deep technical background.

27
00:01:23.280 --> 00:01:26.079
<v Speaker 2>Well, that white hat distinction is truly paramount. It's, you know,

28
00:01:26.120 --> 00:01:28.959
<v Speaker 2>the cornerstone of everything we'll talk about. Yeah, the information

29
00:01:29.000 --> 00:01:31.920
<v Speaker 2>we're sharing is strictly for educational purposes. It's designed to

30
00:01:31.920 --> 00:01:36.680
<v Speaker 2>improve security posture, improve understanding. Any actions we describe here

31
00:01:36.719 --> 00:01:41.799
<v Speaker 2>must be undertaken with explicit written authorization and only in

32
00:01:41.879 --> 00:01:45.200
<v Speaker 2>carefully controlled, isolated environments. Think of it like your own

33
00:01:45.239 --> 00:01:46.200
<v Speaker 2>personal home lab.

34
00:01:46.400 --> 00:01:47.519
<v Speaker 1>Cannot stress that enough.

35
00:01:47.680 --> 00:01:51.359
<v Speaker 2>Seriously, we really can't stress enough the severe legal and

36
00:01:51.400 --> 00:01:55.719
<v Speaker 2>ethical implications of unauthorized use of these kinds of powerful techniques.

37
00:01:56.000 --> 00:01:59.480
<v Speaker 1>Okay, So to properly set the stage for understanding ethical hacking,

38
00:02:00.040 --> 00:02:02.200
<v Speaker 1>we kind of need to start with a Linux. If

39
00:02:02.200 --> 00:02:04.879
<v Speaker 1>you're thinking about an IT career, especially in this field.

40
00:02:05.280 --> 00:02:08.719
<v Speaker 1>Why is Linux so foundational? I mean we see it dominating.

41
00:02:08.240 --> 00:02:13.599
<v Speaker 2>Everywhere, right, Oh, absolutely, cloud environments, IoT devices, DevOps, pipelines,

42
00:02:14.000 --> 00:02:16.879
<v Speaker 2>massive enterprise servers, it's everywhere.

43
00:02:16.919 --> 00:02:17.800
<v Speaker 1>So what's the magic.

44
00:02:18.680 --> 00:02:21.560
<v Speaker 2>The real insight I think lies in understanding the core

45
00:02:21.599 --> 00:02:26.400
<v Speaker 2>philosophy behind Linux's open nature. It's just fundamentally different from

46
00:02:26.400 --> 00:02:29.960
<v Speaker 2>proprietary software. So well, we generally talk about three main

47
00:02:30.039 --> 00:02:33.120
<v Speaker 2>licensing models that sort of underpin this freedom. First, you

48
00:02:33.159 --> 00:02:36.759
<v Speaker 2>get the Free Software Foundation, the FSF, the Champion, the

49
00:02:36.800 --> 00:02:40.520
<v Speaker 2>g and U General Public License or GPL. This license

50
00:02:40.560 --> 00:02:44.719
<v Speaker 2>gives users incredible freedom, freedom to use, modify, even redistribute

51
00:02:44.759 --> 00:02:46.879
<v Speaker 2>the software, maybe even sell it as long as the

52
00:02:46.919 --> 00:02:50.599
<v Speaker 2>original conditions like those for the Linux kernel itself aren't changed.

53
00:02:50.639 --> 00:02:53.000
<v Speaker 1>And that's free, as in freedom, not free beer.

54
00:02:53.039 --> 00:02:56.120
<v Speaker 2>Exactly, not necessarily free of charge. Then you have the

55
00:02:56.120 --> 00:02:59.919
<v Speaker 2>Open Source Initiative OSI. They tend to favor more flex

56
00:03:00.280 --> 00:03:04.240
<v Speaker 2>licenses like BSD, MIT Apache. These are often easier for

57
00:03:04.280 --> 00:03:08.479
<v Speaker 2>commercial use because they have fewer complex restrictions. And finally,

58
00:03:08.800 --> 00:03:10.120
<v Speaker 2>there's creative comments.

59
00:03:10.520 --> 00:03:12.240
<v Speaker 1>Ah yeah, I've seen those icons.

60
00:03:12.319 --> 00:03:15.840
<v Speaker 2>Right. Let's creators pick exactly which rights they want to reserve,

61
00:03:15.960 --> 00:03:20.159
<v Speaker 2>like requiring attribution or only allowing non commercial use, or

62
00:03:20.159 --> 00:03:21.520
<v Speaker 2>even making it public domain.

63
00:03:21.719 --> 00:03:25.800
<v Speaker 1>So what does this open philosophy practically mean for you know,

64
00:03:25.960 --> 00:03:28.439
<v Speaker 1>someone wanting to get into ethical hacking.

65
00:03:28.439 --> 00:03:33.240
<v Speaker 2>Well, it translates to incredible flexibility, just massive flexibility. You

66
00:03:33.280 --> 00:03:36.960
<v Speaker 2>can install multiple Linux versions on tons of devices without

67
00:03:36.960 --> 00:03:38.159
<v Speaker 2>commercial limits.

68
00:03:38.000 --> 00:03:40.039
<v Speaker 1>Which makes experimenting super easy.

69
00:03:40.159 --> 00:03:43.319
<v Speaker 2>Totally spin up, test deployments, try things out, bitch them

70
00:03:43.319 --> 00:03:46.120
<v Speaker 2>if they don't work, no big deal. Plus it's remarkably

71
00:03:46.159 --> 00:03:47.039
<v Speaker 2>cost effective, right.

72
00:03:47.080 --> 00:03:49.599
<v Speaker 1>You can run complex stuff on pretty cheap hardware.

73
00:03:49.360 --> 00:03:52.280
<v Speaker 2>Exactly, run complex processes on a you know, sub three

74
00:03:52.319 --> 00:03:55.599
<v Speaker 2>hundred dollars PC, whereas you might need really expensive systems

75
00:03:55.599 --> 00:03:58.719
<v Speaker 2>for Windows or Mac, especially for heavy tasks like say

76
00:03:59.120 --> 00:04:03.080
<v Speaker 2>video editing or complex simulations. Okay, And this inherent flexibility

77
00:04:03.120 --> 00:04:05.919
<v Speaker 2>gives rise to what we call Linux distributions or.

78
00:04:05.840 --> 00:04:08.159
<v Speaker 1>Distros, right, like Obuntu or Mint.

79
00:04:08.639 --> 00:04:11.360
<v Speaker 2>Yeah, those are popular ones. Think of Linux itself as

80
00:04:11.360 --> 00:04:14.560
<v Speaker 2>the engine and chassis of a car. A distro is

81
00:04:14.599 --> 00:04:17.920
<v Speaker 2>like the fully assembled vehicle customized for a specific.

82
00:04:17.480 --> 00:04:19.319
<v Speaker 1>Purpose, like Android for phones.

83
00:04:19.680 --> 00:04:24.360
<v Speaker 2>Perfect example, Android is a Linux distro optimized for mobile,

84
00:04:24.879 --> 00:04:28.319
<v Speaker 2>or scientific Linux for scientific computing, and for what we're

85
00:04:28.360 --> 00:04:32.160
<v Speaker 2>talking about today, network security testing. Kali Linux is a

86
00:04:32.160 --> 00:04:33.279
<v Speaker 2>prime example.

87
00:04:32.959 --> 00:04:34.600
<v Speaker 1>Because it comes with all the tools pre.

88
00:04:34.519 --> 00:04:39.079
<v Speaker 2>Installed, exactly, prepackaged with hundreds of tools, saves you immense

89
00:04:39.120 --> 00:04:41.759
<v Speaker 2>setup time. Let's you focus on the strategy you know not.

90
00:04:41.959 --> 00:04:44.279
<v Speaker 2>Just fiddling with configurations makes sense.

91
00:04:44.399 --> 00:04:46.680
<v Speaker 1>And there are families of these distros, right yeah.

92
00:04:46.680 --> 00:04:49.399
<v Speaker 2>The big ones are Debian, which includes a Buntu Mint

93
00:04:49.439 --> 00:04:52.600
<v Speaker 2>and Collie itself, then red Hat with Sentos and Fedora,

94
00:04:52.800 --> 00:04:55.120
<v Speaker 2>SUS and Arch. Lots of flavors.

95
00:04:55.160 --> 00:04:57.040
<v Speaker 1>So when you install Linux you usually get a choice,

96
00:04:57.079 --> 00:04:58.920
<v Speaker 1>right do you I or command line yep?

97
00:04:59.360 --> 00:05:02.600
<v Speaker 2>Graphically use interface GUI that's the point click most people know,

98
00:05:02.959 --> 00:05:06.439
<v Speaker 2>or the command line interface CLI, which is text based.

99
00:05:06.519 --> 00:05:09.240
<v Speaker 1>And for security, probably best not to live as the

100
00:05:09.319 --> 00:05:10.519
<v Speaker 1>root user all the time.

101
00:05:10.759 --> 00:05:13.720
<v Speaker 2>Oh definitely not for normal operations. Better to harden your

102
00:05:13.720 --> 00:05:17.240
<v Speaker 2>system use standard user accounts. And for storage, there are

103
00:05:17.240 --> 00:05:20.199
<v Speaker 2>cool options like Logical Volume Manager LVM.

104
00:05:20.399 --> 00:05:21.000
<v Speaker 1>What does that do?

105
00:05:21.439 --> 00:05:25.240
<v Speaker 2>It offers really flexible disc manipulation. Imagine you have like

106
00:05:25.680 --> 00:05:28.360
<v Speaker 2>three hard drives. LVM lets you pull them together into

107
00:05:28.360 --> 00:05:30.360
<v Speaker 2>one big dynamic storage.

108
00:05:29.959 --> 00:05:32.199
<v Speaker 1>Space so you can resize things easily.

109
00:05:32.120 --> 00:05:34.959
<v Speaker 2>Exactly, resize virtual discs, create new ones on the fly.

110
00:05:35.920 --> 00:05:39.680
<v Speaker 2>Or Another common setup is combining a fast SSD for

111
00:05:39.759 --> 00:05:43.680
<v Speaker 2>your system files with slower, bigger hard drives for data storage.

112
00:05:44.079 --> 00:05:45.199
<v Speaker 2>LVM can manage that too.

113
00:05:45.399 --> 00:05:48.199
<v Speaker 1>Okay, cool, so we've got the OS down. What about

114
00:05:48.240 --> 00:05:50.920
<v Speaker 1>the specific gear the software.

115
00:05:50.399 --> 00:05:53.360
<v Speaker 2>And hardware right the toolkit. The source mentions a lot

116
00:05:53.360 --> 00:05:57.279
<v Speaker 2>of essential software tools network sniffers and analyzers like tcpdump,

117
00:05:57.519 --> 00:06:03.000
<v Speaker 2>Microsoft netmond Land Detective Channelizer, utter Cap, Network Minor, Fiddler

118
00:06:03.399 --> 00:06:04.240
<v Speaker 2>and the big one.

119
00:06:04.079 --> 00:06:07.560
<v Speaker 1>Wire Shark and Collie Linux itself obviously, plus virtualization stuff

120
00:06:07.560 --> 00:06:09.399
<v Speaker 1>like VMware or virtual box.

121
00:06:09.240 --> 00:06:11.519
<v Speaker 2>Yep for running your labs. But on the hardware side,

122
00:06:11.600 --> 00:06:14.720
<v Speaker 2>one area that's often overlooked but really really important for

123
00:06:14.800 --> 00:06:16.720
<v Speaker 2>pen testing is your wireless adapter.

124
00:06:16.959 --> 00:06:19.959
<v Speaker 1>Why isn't the one in my laptop good enough?

125
00:06:20.040 --> 00:06:23.319
<v Speaker 2>Probably not? Actually, most built in Wi Fi cards just

126
00:06:23.360 --> 00:06:25.720
<v Speaker 2>aren't up to the task for serious pen testing.

127
00:06:25.800 --> 00:06:26.399
<v Speaker 1>Okay. Why not?

128
00:06:26.639 --> 00:06:30.920
<v Speaker 2>Well, mainly because they typically lack two key capabilities, monitor

129
00:06:30.959 --> 00:06:32.480
<v Speaker 2>mode and packet injection.

130
00:06:32.680 --> 00:06:35.399
<v Speaker 1>Right. Monitor mode lets you listen to everything, not just

131
00:06:35.439 --> 00:06:36.879
<v Speaker 1>stuff addressed to you.

132
00:06:36.639 --> 00:06:39.800
<v Speaker 2>Exactly passively listen to all the traffic flying around. And

133
00:06:39.959 --> 00:06:43.839
<v Speaker 2>packet injection lets you actually craft and send specific packets

134
00:06:43.920 --> 00:06:45.240
<v Speaker 2>onto the network.

135
00:06:45.120 --> 00:06:47.480
<v Speaker 1>Which you need for a lot of Wi Fi attacks.

136
00:06:47.480 --> 00:06:50.959
<v Speaker 2>Absolutely essential. Plus, virtual machines often have trouble accessing those

137
00:06:50.959 --> 00:06:53.399
<v Speaker 2>built in cards directly anyway, so it's less.

138
00:06:53.240 --> 00:06:55.199
<v Speaker 1>About the brand name on the adapter and more about

139
00:06:55.199 --> 00:06:58.120
<v Speaker 1>what's inside the chip set precisely.

140
00:06:58.319 --> 00:07:00.639
<v Speaker 2>It's all about the chipset. For instance, it's the atheros

141
00:07:00.839 --> 00:07:02.439
<v Speaker 2>AR nine two to seven to one chipset is a

142
00:07:02.519 --> 00:07:03.240
<v Speaker 2>huge favorite.

143
00:07:03.240 --> 00:07:03.800
<v Speaker 1>Why that one?

144
00:07:03.839 --> 00:07:07.519
<v Speaker 2>It fully supports monitor mode, packet injection, even creating fake

145
00:07:07.600 --> 00:07:11.439
<v Speaker 2>access points. Super versatile for tons of calie Linux attacks.

146
00:07:11.480 --> 00:07:13.639
<v Speaker 1>But only two point four geta Hurts Right, that's the catch.

147
00:07:13.720 --> 00:07:16.360
<v Speaker 2>Yeah, if your target network is only on five gigahertz,

148
00:07:16.399 --> 00:07:19.079
<v Speaker 2>you won't even see it. Then there's the real Tech

149
00:07:19.199 --> 00:07:22.000
<v Speaker 2>RTL eight eight one two AU chipset.

150
00:07:22.160 --> 00:07:23.319
<v Speaker 1>What's the deal with that one?

151
00:07:23.480 --> 00:07:25.720
<v Speaker 2>Well, the big advantage is it supports both two point

152
00:07:25.759 --> 00:07:28.519
<v Speaker 2>four geta Hurts and five geta HURTZ. Sure, plus monitor

153
00:07:28.560 --> 00:07:32.720
<v Speaker 2>mode and packet injection. Sounds perfect almost. The book does

154
00:07:32.800 --> 00:07:35.879
<v Speaker 2>note it can sometimes be a bit less reliable for

155
00:07:35.920 --> 00:07:38.959
<v Speaker 2>certain attacks, might occasionally need you to like replug the

156
00:07:39.000 --> 00:07:40.800
<v Speaker 2>card or just retry the attack.

157
00:07:41.000 --> 00:07:41.920
<v Speaker 1>So there's a trade off.

158
00:07:42.079 --> 00:07:46.800
<v Speaker 2>Definitely. You can find really cheap unbranded adapters with these chipsets.

159
00:07:46.839 --> 00:07:48.959
<v Speaker 2>They're small, discrete, which can be.

160
00:07:48.920 --> 00:07:51.079
<v Speaker 1>Handy, or you go for the bigger guns, right.

161
00:07:50.920 --> 00:07:53.680
<v Speaker 2>You can opt for the more robust all for brand adapters.

162
00:07:53.680 --> 00:07:57.279
<v Speaker 2>They're usually larger, maybe less subtle, but they tend to

163
00:07:57.279 --> 00:08:01.160
<v Speaker 2>offer better build quality, better range, and just overall reliability.

164
00:08:01.240 --> 00:08:03.480
<v Speaker 1>So the takeaway is check the chip set.

165
00:08:03.639 --> 00:08:07.920
<v Speaker 2>Absolutely. Compatibility for serious pen testing almost entirely boils down

166
00:08:07.920 --> 00:08:10.120
<v Speaker 2>to getting an adapter with the right chipset inside it,

167
00:08:10.199 --> 00:08:12.480
<v Speaker 2>not just a popular brand, got it?

168
00:08:13.160 --> 00:08:16.839
<v Speaker 1>So hardware sorted, Let's get this ethical hacking lab actually

169
00:08:16.920 --> 00:08:18.560
<v Speaker 1>up and running. You mentioned virtual Box.

170
00:08:18.720 --> 00:08:21.680
<v Speaker 2>Yeah, virtual Box is fantastic for this. It's free, works

171
00:08:21.680 --> 00:08:25.120
<v Speaker 2>on Windows, Mac, Linux, cross platform, lets you run multiple

172
00:08:25.199 --> 00:08:28.000
<v Speaker 2>virtual machines on your computer. Highly recommended for setting up

173
00:08:28.000 --> 00:08:28.519
<v Speaker 2>Collie and.

174
00:08:28.519 --> 00:08:31.800
<v Speaker 1>Collie Linux itself is like the Swiss Army Knife exactly.

175
00:08:31.839 --> 00:08:35.600
<v Speaker 2>It's a really user friendly distribution, but it's specifically built

176
00:08:35.639 --> 00:08:38.960
<v Speaker 2>for pen testing, packed with hundreds of built in tools

177
00:08:38.960 --> 00:08:39.840
<v Speaker 2>for everything you can.

178
00:08:39.759 --> 00:08:43.639
<v Speaker 1>Imagine, like information gathering, forensics.

179
00:08:43.039 --> 00:08:48.320
<v Speaker 2>Reverse engineering, stress testing, vulnerability assessment, you name it. It's

180
00:08:48.360 --> 00:08:52.279
<v Speaker 2>designed to be a comprehensive toolkit for finding weaknesses and

181
00:08:52.480 --> 00:08:54.480
<v Speaker 2>ultimately helping improve security.

182
00:08:54.639 --> 00:08:57.440
<v Speaker 1>So setting it up in virtual Box, what are the

183
00:08:57.519 --> 00:08:58.120
<v Speaker 1>key steps?

184
00:08:58.440 --> 00:09:01.120
<v Speaker 2>The source recommends giving it at least four gigs a RAM,

185
00:09:01.240 --> 00:09:04.200
<v Speaker 2>maybe twenty gigs for the virtual hard drive, enough space

186
00:09:04.279 --> 00:09:07.679
<v Speaker 2>to work and networking. Crucial step bridge the VM to

187
00:09:07.720 --> 00:09:10.559
<v Speaker 2>your router. That makes it act like any other device

188
00:09:10.600 --> 00:09:12.279
<v Speaker 2>on your home network. Gets it online.

189
00:09:12.320 --> 00:09:13.919
<v Speaker 1>Okay, Then you boot it up yep.

190
00:09:14.000 --> 00:09:16.000
<v Speaker 2>After the initial boot, if you're at the command line,

191
00:09:16.039 --> 00:09:19.120
<v Speaker 2>just type start EGGX to get the graphical interface.

192
00:09:18.720 --> 00:09:20.000
<v Speaker 1>And the default login.

193
00:09:19.919 --> 00:09:22.879
<v Speaker 2>For the command line. It's usually a username, route password

194
00:09:22.960 --> 00:09:25.279
<v Speaker 2>tour but you'll want to change that.

195
00:09:25.320 --> 00:09:28.639
<v Speaker 1>Good point and network canfig static IP?

196
00:09:29.159 --> 00:09:31.279
<v Speaker 2>Yeah, assign it a static IP address, like giving it

197
00:09:31.279 --> 00:09:34.159
<v Speaker 2>a permanent address on your network. Then set the default

198
00:09:34.159 --> 00:09:36.000
<v Speaker 2>gateway so it knows how to reach the internet.

199
00:09:36.080 --> 00:09:38.799
<v Speaker 1>Then test it ping the router, ping Google.

200
00:09:38.559 --> 00:09:41.919
<v Speaker 2>Exactly, ping ten dot ten, dot Deal dot one or

201
00:09:41.919 --> 00:09:46.039
<v Speaker 2>whatever your router is than ping www dot Google dot com.

202
00:09:46.080 --> 00:09:47.080
<v Speaker 2>Just make sure it's all work.

203
00:09:47.480 --> 00:09:50.519
<v Speaker 1>Okay, Collie is installed. What's the absolute first thing you

204
00:09:50.519 --> 00:09:50.919
<v Speaker 1>should do?

205
00:09:51.200 --> 00:09:54.480
<v Speaker 2>Update it? This is the single most critical task after

206
00:09:54.519 --> 00:09:58.320
<v Speaker 2>a clean install. Seriously, think of it like tuning up

207
00:09:58.320 --> 00:09:59.720
<v Speaker 2>a race card before you hit the track.

208
00:10:00.039 --> 00:10:01.879
<v Speaker 1>Right, get all the latest patches and tool.

209
00:10:01.720 --> 00:10:06.120
<v Speaker 2>Version Precisely, Collie uses advanced packaging tools APT to manage

210
00:10:06.159 --> 00:10:08.360
<v Speaker 2>it software. You'll run a sequence of commands.

211
00:10:08.399 --> 00:10:09.200
<v Speaker 1>Okay, what are they?

212
00:10:09.559 --> 00:10:12.879
<v Speaker 2>First? App get update. That's like refreshing your app store catalog,

213
00:10:12.919 --> 00:10:15.799
<v Speaker 2>so Collie knows about all the newest software and security patches.

214
00:10:15.879 --> 00:10:16.440
<v Speaker 1>Makes sense.

215
00:10:16.559 --> 00:10:20.399
<v Speaker 2>Then app Get Upgrade I the why just answers yes automatically.

216
00:10:20.480 --> 00:10:22.440
<v Speaker 2>It actually installs the newest versions of the stuff you

217
00:10:22.480 --> 00:10:25.879
<v Speaker 2>already have got it and finally app to get disted upgrade.

218
00:10:26.279 --> 00:10:29.240
<v Speaker 2>This one handles more complex upgrades, make sure all the

219
00:10:29.240 --> 00:10:33.519
<v Speaker 2>dependencies work together, and removes any old obsolete.

220
00:10:32.879 --> 00:10:34.679
<v Speaker 1>Packages and reboot after all that.

221
00:10:34.919 --> 00:10:38.440
<v Speaker 2>Always best practice. Reboot after that sequence to make sure

222
00:10:38.480 --> 00:10:41.000
<v Speaker 2>everything is fresh and clean and running correctly.

223
00:10:41.120 --> 00:10:45.200
<v Speaker 1>And for just managing packages day to day, listing removing Yeah.

224
00:10:45.039 --> 00:10:47.960
<v Speaker 2>Basic commands let you list installed packages, maybe filter With

225
00:10:48.000 --> 00:10:51.679
<v Speaker 2>GP you can show a package's description and dependencies, or

226
00:10:51.679 --> 00:10:54.519
<v Speaker 2>remove something you don't need anymore with Pseudo app Get Removed.

227
00:10:54.559 --> 00:10:57.600
<v Speaker 1>The book also mentions some useful extras to install.

228
00:10:57.759 --> 00:11:01.480
<v Speaker 2>It does things like preload for potentially faster app access,

229
00:11:01.720 --> 00:11:04.360
<v Speaker 2>bleach bit to free up disk base and help with privacy,

230
00:11:04.679 --> 00:11:07.440
<v Speaker 2>boot up manager to disabled services you don't need running.

231
00:11:07.480 --> 00:11:10.000
<v Speaker 1>Also Nome do for keyboard launching, Yeah.

232
00:11:09.799 --> 00:11:12.919
<v Speaker 2>App file to search inside packages, scrub for more secure

233
00:11:12.960 --> 00:11:16.399
<v Speaker 2>file deletion, Shutter for taking screenshots, and figle it for

234
00:11:16.480 --> 00:11:20.039
<v Speaker 2>fun custom console messages. Little quality of life improvements.

235
00:11:20.080 --> 00:11:22.360
<v Speaker 1>What about SSH secure shell?

236
00:11:22.639 --> 00:11:25.840
<v Speaker 2>Ah, good point. A smart step is to harden your

237
00:11:25.879 --> 00:11:30.159
<v Speaker 2>SSH setup. Collie comes with default SSH keys, right well,

238
00:11:30.440 --> 00:11:34.360
<v Speaker 2>fundamental security practice is disable those and generate unique ones

239
00:11:34.480 --> 00:11:39.039
<v Speaker 2>just for your machine. Use DPKG, reconfigure open server so.

240
00:11:39.080 --> 00:11:41.240
<v Speaker 1>Your lab isn't using predictable keys.

241
00:11:41.159 --> 00:11:44.600
<v Speaker 2>Exactly verify the new key hashes, then start the SSH

242
00:11:44.679 --> 00:11:47.960
<v Speaker 2>service that lets you securely connect to your COLLIVM from

243
00:11:47.960 --> 00:11:51.200
<v Speaker 2>another computer, which is often really convenient. It's a small

244
00:11:51.240 --> 00:11:55.080
<v Speaker 2>step but significantly improves your security posture right off the bat.

245
00:11:55.200 --> 00:12:00.559
<v Speaker 1>Okay, foundations laid Linux, Collie, basic Setuple's get into the

246
00:12:00.559 --> 00:12:04.559
<v Speaker 1>actual process, the penetration testing life cycle. Why even do

247
00:12:04.600 --> 00:12:05.240
<v Speaker 1>a pen test?

248
00:12:05.519 --> 00:12:08.600
<v Speaker 2>Yeah? The fundamental question right beyond just finding bugs, it's

249
00:12:08.600 --> 00:12:13.600
<v Speaker 2>about evaluating an organization's actual security posture by actively simulating

250
00:12:13.600 --> 00:12:14.840
<v Speaker 2>real world attacks, so.

251
00:12:14.759 --> 00:12:17.120
<v Speaker 1>You find the specific holes a hacker could use.

252
00:12:17.320 --> 00:12:21.080
<v Speaker 2>Exactly find those specific vulnerabilities, and then crucially use those

253
00:12:21.120 --> 00:12:24.519
<v Speaker 2>findings to help create and redesign more robust security measures.

254
00:12:24.639 --> 00:12:27.320
<v Speaker 1>And the reports are key to Absolutely.

255
00:12:26.919 --> 00:12:30.879
<v Speaker 2>A good pen test delivers comprehensive reports detailing everything found.

256
00:12:31.279 --> 00:12:34.919
<v Speaker 2>Plus it really aids in disaster recovery and business continuity

257
00:12:34.960 --> 00:12:38.480
<v Speaker 2>planning because you're anticipating how at tax might actually happen.

258
00:12:38.720 --> 00:12:41.440
<v Speaker 1>What makes a PEN test actually successful, though.

259
00:12:41.600 --> 00:12:45.279
<v Speaker 2>Well, several critical factors. You absolutely need to follow a

260
00:12:45.320 --> 00:12:49.679
<v Speaker 2>well defined methodology, Meticulous documentation is non.

261
00:12:49.440 --> 00:12:51.519
<v Speaker 1>Negotiable, and the right tools.

262
00:12:51.279 --> 00:12:54.840
<v Speaker 2>Yep, using the right mix of proprietary and open source tools.

263
00:12:55.399 --> 00:13:00.639
<v Speaker 2>Also ensuring legitimate ethical individuals conduct the tests, and maybe most.

264
00:13:00.519 --> 00:13:02.679
<v Speaker 1>Importantly, giving actionable recommendation.

265
00:13:02.840 --> 00:13:06.720
<v Speaker 2>Precisely providing actionable recommendations for fixing the issues. It's not

266
00:13:06.799 --> 00:13:10.360
<v Speaker 2>just about finding flaws, it's about offering clear paths to

267
00:13:10.440 --> 00:13:11.440
<v Speaker 2>stronger defenses.

268
00:13:11.519 --> 00:13:13.600
<v Speaker 1>And the benefits go beyond just fixing holes.

269
00:13:13.679 --> 00:13:17.440
<v Speaker 2>Oh yeah, much broader. It helps identify needed infrastructure changes,

270
00:13:17.639 --> 00:13:20.759
<v Speaker 2>prepares the org to prevent future exploits, evaluates how well

271
00:13:20.840 --> 00:13:23.159
<v Speaker 2>security devices like firewalls are actually.

272
00:13:22.840 --> 00:13:25.679
<v Speaker 1>Working, confirms defenses, maybe trains the security team.

273
00:13:25.960 --> 00:13:29.200
<v Speaker 2>Definitely trains the team by exposing them to realistic scenarios.

274
00:13:29.799 --> 00:13:33.720
<v Speaker 2>It helps identify specific threats relevant to that organization or industry,

275
00:13:34.159 --> 00:13:38.720
<v Speaker 2>optimizes security spending for better ROI, helps create solid policies

276
00:13:39.120 --> 00:13:43.039
<v Speaker 2>and ensures compliance with regulations to avoid breaches and lawsuits.

277
00:13:43.519 --> 00:13:44.320
<v Speaker 2>Lots of benefits.

278
00:13:44.559 --> 00:13:48.519
<v Speaker 1>How does a PEN test differ from say, a security audit.

279
00:13:48.799 --> 00:13:52.240
<v Speaker 2>Good question, think of a security audit more like a checklist.

280
00:13:52.639 --> 00:13:55.320
<v Speaker 2>Does the company follow its own policies and procedures? Yes

281
00:13:55.440 --> 00:13:56.159
<v Speaker 2>or no? Okay?

282
00:13:56.399 --> 00:13:58.799
<v Speaker 1>And a vulnerability assessment that goes a step further.

283
00:13:58.879 --> 00:14:02.879
<v Speaker 2>It discovers vulnerability, finds potential weaknesses, but it doesn't necessarily

284
00:14:02.879 --> 00:14:05.759
<v Speaker 2>confirm if they're actually exploitable or what the real damage

285
00:14:05.799 --> 00:14:06.120
<v Speaker 2>could be.

286
00:14:06.279 --> 00:14:08.240
<v Speaker 1>So the pen test is the one that actually tries

287
00:14:08.279 --> 00:14:09.480
<v Speaker 1>to break in exactly.

288
00:14:09.679 --> 00:14:12.480
<v Speaker 2>A penetration test is a systematic assessment that includes an

289
00:14:12.519 --> 00:14:17.039
<v Speaker 2>audit component, but also demonstrates successful exploitation of weaknesses. It

290
00:14:17.080 --> 00:14:20.600
<v Speaker 2>gives a much clearer, more impactful picture of the actual

291
00:14:20.679 --> 00:14:21.600
<v Speaker 2>real world risk.

292
00:14:21.759 --> 00:14:25.799
<v Speaker 1>Gotcha. The book also talks about teams Red Team, Blue Team.

293
00:14:25.960 --> 00:14:28.840
<v Speaker 2>Right, it's a helpful analogy. The Red team acts as

294
00:14:28.840 --> 00:14:33.240
<v Speaker 2>the aggressor the ethical hackers. They often have limited internal access,

295
00:14:33.320 --> 00:14:36.879
<v Speaker 2>maybe attack with or without warning. Sometimes it even includes

296
00:14:37.080 --> 00:14:40.399
<v Speaker 2>sissemins from other departments to simulate insider.

297
00:14:40.039 --> 00:14:42.879
<v Speaker 1>Threats, and the Blue team is defense yep.

298
00:14:43.279 --> 00:14:45.679
<v Speaker 2>The Blue Team is the defensive force. They have full

299
00:14:45.720 --> 00:14:48.759
<v Speaker 2>access to resources and their main job is to detect

300
00:14:48.799 --> 00:14:52.240
<v Speaker 2>and mitigate the Red team's activities. Basically anticipating how a

301
00:14:52.279 --> 00:14:55.919
<v Speaker 2>real attack might unfold. Usually includes the company's IT staff,

302
00:14:56.240 --> 00:14:59.000
<v Speaker 2>often involved in the less expensive, more frequent assessments.

303
00:14:59.120 --> 00:15:01.440
<v Speaker 1>Okay, and the type of tests depends on how much

304
00:15:01.480 --> 00:15:05.360
<v Speaker 1>info the tester gets upfront. White box black box exactly.

305
00:15:05.639 --> 00:15:08.759
<v Speaker 2>A white box test means the tester gets complete knowledge

306
00:15:08.759 --> 00:15:13.080
<v Speaker 2>network maps, asset lists, diagrams ideal for a really thorough

307
00:15:13.080 --> 00:15:13.799
<v Speaker 2>security audit.

308
00:15:13.840 --> 00:15:14.960
<v Speaker 1>Black box is the opposite.

309
00:15:15.000 --> 00:15:19.159
<v Speaker 2>Tester knows nothing pretty much simulates a real external attacker.

310
00:15:19.480 --> 00:15:21.960
<v Speaker 2>In a blind test version, the tester knows nothing, but

311
00:15:22.000 --> 00:15:23.960
<v Speaker 2>the target company is told about the test.

312
00:15:23.720 --> 00:15:24.799
<v Speaker 1>Scope and double blind.

313
00:15:24.960 --> 00:15:27.799
<v Speaker 2>That's where neither the tester nor the target company knows

314
00:15:27.799 --> 00:15:32.679
<v Speaker 2>the scope beforehand. Really tests everyone's alertness. Very popular approach.

315
00:15:32.759 --> 00:15:33.759
<v Speaker 1>What about gray box?

316
00:15:34.120 --> 00:15:37.240
<v Speaker 2>Green box is somewhere in the middle, partial knowledge maybe

317
00:15:37.279 --> 00:15:39.960
<v Speaker 2>just a domain name. Saves time compared to black box,

318
00:15:40.120 --> 00:15:43.720
<v Speaker 2>but still offers perspectives from both a developer and an attacker, and.

319
00:15:43.679 --> 00:15:46.279
<v Speaker 1>The overall strategy can be announced or unannounced.

320
00:15:46.440 --> 00:15:50.840
<v Speaker 2>Right announced strategy, tester gets the full tour physical access,

321
00:15:51.519 --> 00:15:55.039
<v Speaker 2>less network impact usually since the company is ready unannounced.

322
00:15:55.120 --> 00:15:56.480
<v Speaker 1>Is style mode.

323
00:15:56.200 --> 00:16:00.519
<v Speaker 2>Pretty much only top management knows. Really tests security personnel

324
00:16:00.519 --> 00:16:03.320
<v Speaker 2>alertness social engineering defenses, but it tends to have a

325
00:16:03.360 --> 00:16:06.480
<v Speaker 2>higher potential impact and needs a super strict process.

326
00:16:06.720 --> 00:16:11.120
<v Speaker 1>Okay, let's dive into the first stage, pre engagement information gathering.

327
00:16:11.279 --> 00:16:13.960
<v Speaker 2>This is foundational. The whole focus here is gathering as

328
00:16:14.000 --> 00:16:17.080
<v Speaker 2>much information as possible about the target, often through scanning

329
00:16:17.120 --> 00:16:20.279
<v Speaker 2>or footprinting techniques. It sets the stage for everything else,

330
00:16:20.600 --> 00:16:22.159
<v Speaker 2>like a detective building their case.

331
00:16:22.320 --> 00:16:25.639
<v Speaker 1>And this is where the rules of engagement or ROE

332
00:16:25.639 --> 00:16:27.759
<v Speaker 1>come in. The permission slip.

333
00:16:27.759 --> 00:16:31.320
<v Speaker 2>Exactly, it's the formal permission document. Yeah. It spells out everything,

334
00:16:31.679 --> 00:16:35.000
<v Speaker 2>what activities are allowed, the specific IP ranges you can test,

335
00:16:35.320 --> 00:16:37.360
<v Speaker 2>and critically what's off limits.

336
00:16:37.519 --> 00:16:41.279
<v Speaker 1>Testing times too, business hours versus after hours.

337
00:16:41.080 --> 00:16:46.440
<v Speaker 2>Yep, acceptable methods is social engineering? Okay, Denial of service

338
00:16:47.440 --> 00:16:51.919
<v Speaker 2>specific tools like n MAP, aggressive scans, the duration of

339
00:16:51.960 --> 00:16:53.240
<v Speaker 2>the test which can be months.

340
00:16:53.440 --> 00:16:56.080
<v Speaker 1>Sometimes emergency contact is crucial too, I.

341
00:16:55.960 --> 00:16:59.320
<v Speaker 2>Bet absolutely vital. And measures to prevent calling the cops

342
00:16:59.320 --> 00:17:00.720
<v Speaker 2>because of a fall alarm.

343
00:17:00.480 --> 00:17:02.919
<v Speaker 1>From the test, ah, yeah, that would be awkward.

344
00:17:03.000 --> 00:17:05.799
<v Speaker 2>A critical insight here, stressed in the source is how

345
00:17:05.839 --> 00:17:09.759
<v Speaker 2>you handle the information you gather. Best practice use laptops

346
00:17:09.759 --> 00:17:12.359
<v Speaker 2>provided by the client for the test and reporting.

347
00:17:12.000 --> 00:17:13.799
<v Speaker 1>Then return them immediately after.

348
00:17:13.839 --> 00:17:16.839
<v Speaker 2>Exactly prevents any accusations of the test holding on to

349
00:17:16.920 --> 00:17:20.519
<v Speaker 2>sensitive data vital for data security. The book even suggests

350
00:17:20.519 --> 00:17:23.319
<v Speaker 2>pulling the hard drives for secure storage later since tech

351
00:17:23.359 --> 00:17:24.160
<v Speaker 2>gets old fast.

352
00:17:24.279 --> 00:17:28.680
<v Speaker 1>So this pre engagement involves checklists too, defining what gets tested.

353
00:17:28.559 --> 00:17:36.720
<v Speaker 2>Meticulous checklists, reviewing what the customer actually needs tested servers, workstations, routers, firewalls, databases, apps,

354
00:17:36.960 --> 00:17:42.640
<v Speaker 2>physical security, loip, mobile devices, even printers and cameras, sometimes.

355
00:17:42.279 --> 00:17:45.480
<v Speaker 1>Mapping the Internet presence, what's visible from outside.

356
00:17:45.079 --> 00:17:49.400
<v Speaker 2>YEP, identifying oz's on the network, assessing wireless analog systems,

357
00:17:49.440 --> 00:17:54.680
<v Speaker 2>mobile worker devices, scrutinizing web apps, front facing sites, redirects,

358
00:17:54.960 --> 00:17:58.599
<v Speaker 2>even checking ad networks as potential malware vectors.

359
00:17:58.720 --> 00:18:00.920
<v Speaker 1>And defining the scope clearly.

360
00:18:00.680 --> 00:18:04.559
<v Speaker 2>Absolutely key. What are the deliverables? What reports? Defining data,

361
00:18:04.759 --> 00:18:08.880
<v Speaker 2>verifying functionality, outlining the technical structure with flow diagrams. It

362
00:18:08.960 --> 00:18:10.519
<v Speaker 2>ensures everyone's on the same page.

363
00:18:10.599 --> 00:18:13.880
<v Speaker 1>What if things change during the test, client updates.

364
00:18:13.440 --> 00:18:16.880
<v Speaker 2>Something that's a great point The source highlights client changes,

365
00:18:16.880 --> 00:18:20.440
<v Speaker 2>business processes. Tech apps can definitely impact the test. It's

366
00:18:20.480 --> 00:18:22.519
<v Speaker 2>crucial to the's a review to the engagement lead.

367
00:18:22.400 --> 00:18:24.960
<v Speaker 1>Before they happen, so the testers know what they're dealing with,

368
00:18:25.160 --> 00:18:27.000
<v Speaker 1>what specific areas should they focus on?

369
00:18:27.279 --> 00:18:31.759
<v Speaker 2>The advice is broad system software security, network security, especially

370
00:18:31.799 --> 00:18:35.799
<v Speaker 2>default canfigs, client side apps, and the whole client to

371
00:18:35.880 --> 00:18:40.119
<v Speaker 2>server and server side communication chain. Aim for comprehensive coverage.

372
00:18:40.160 --> 00:18:43.480
<v Speaker 1>This also includes social engineering if it's in scope.

373
00:18:43.319 --> 00:18:47.920
<v Speaker 2>Right, gathering passwords or project details through human interaction, documenting

374
00:18:48.000 --> 00:18:52.400
<v Speaker 2>existing security measures, checking secure document destruction like literally checking

375
00:18:52.400 --> 00:18:53.799
<v Speaker 2>the trash sometimes wow.

376
00:18:53.559 --> 00:18:56.240
<v Speaker 1>Assessing application comms, physical security.

377
00:18:55.839 --> 00:18:57.640
<v Speaker 2>All of it. Can you intercept comms? Can you get

378
00:18:57.680 --> 00:19:00.200
<v Speaker 2>into the building? Test honeypots?

379
00:19:00.200 --> 00:19:04.160
<v Speaker 1>Thorough and contracts are obviously huge here NDAs.

380
00:19:04.559 --> 00:19:08.319
<v Speaker 2>Non disclosure agreements are standard clear terms on fees, schedules,

381
00:19:08.559 --> 00:19:13.200
<v Speaker 2>sensitive information documents covering assets, confidentiality contracts for trade secrets,

382
00:19:13.359 --> 00:19:17.079
<v Speaker 2>customer lata and critically and indemnification.

383
00:19:16.400 --> 00:19:19.640
<v Speaker 1>Claus to protect the tester legally exactly.

384
00:19:19.240 --> 00:19:22.079
<v Speaker 2>Protects the pen tester from legal or financial liabilities if

385
00:19:22.079 --> 00:19:25.960
<v Speaker 2>something goes wrong despite following the rowe and the reporting

386
00:19:26.000 --> 00:19:29.480
<v Speaker 2>section needs to clearly outline the methodology and promise constructive,

387
00:19:29.519 --> 00:19:30.480
<v Speaker 2>actionable reporting.

388
00:19:30.720 --> 00:19:34.680
<v Speaker 1>So summing up stage one. It's time consuming, but essential

389
00:19:34.720 --> 00:19:38.720
<v Speaker 1>for setting expectations and protecting everyone. Methods range from passive

390
00:19:38.720 --> 00:19:41.720
<v Speaker 1>Google searching to active surveillance.

391
00:19:41.319 --> 00:19:46.359
<v Speaker 2>Right passive recon aggressive active surveillance, web profiling to map

392
00:19:46.359 --> 00:19:49.839
<v Speaker 2>out sites. It takes time because it lays the groundwork

393
00:19:49.920 --> 00:19:51.480
<v Speaker 2>for a safe and effective test.

394
00:19:51.599 --> 00:19:56.160
<v Speaker 1>Okay, Stage one done. Now Stage two the attack stage.

395
00:19:56.440 --> 00:19:59.359
<v Speaker 2>This is where the ethical hacker actively tries to compromise

396
00:19:59.440 --> 00:20:03.680
<v Speaker 2>the target using all that intel gathered before the critical insight.

397
00:20:04.279 --> 00:20:05.920
<v Speaker 2>An attacker only needs one.

398
00:20:05.759 --> 00:20:08.160
<v Speaker 1>Way in, while the company has to defend everything.

399
00:20:08.279 --> 00:20:09.960
<v Speaker 2>Exactly a tough position to be in.

400
00:20:10.119 --> 00:20:13.519
<v Speaker 1>So what are the steps here? Perimeter penetration, testing.

401
00:20:13.200 --> 00:20:17.799
<v Speaker 2>Firewalls, right sending crafted packets, fragmented overlapping floods to see

402
00:20:17.799 --> 00:20:21.599
<v Speaker 2>if you can bypass ACL's filtering, triggered off thresholds, testing

403
00:20:21.640 --> 00:20:23.759
<v Speaker 2>web services to how they handled different requests.

404
00:20:23.839 --> 00:20:26.759
<v Speaker 1>Then enumerting machines, finding out what's on the network.

405
00:20:26.440 --> 00:20:32.119
<v Speaker 2>YEP, discovering machine IDs, descriptions, locations, network accessibility, systematically mapping

406
00:20:32.119 --> 00:20:33.119
<v Speaker 2>the internal landscape.

407
00:20:33.160 --> 00:20:35.440
<v Speaker 1>Acquiring the target. That sounds serious.

408
00:20:35.799 --> 00:20:40.960
<v Speaker 2>It means launching probing assaults like vulnerability scans or maybe

409
00:20:41.039 --> 00:20:45.920
<v Speaker 2>using info gain from social engineering about trusted systems, getting

410
00:20:46.000 --> 00:20:47.799
<v Speaker 2>that initial foothold.

411
00:20:47.279 --> 00:20:50.279
<v Speaker 1>And once you're in, escalating privileges that's.

412
00:20:50.079 --> 00:20:54.720
<v Speaker 2>The goal, taking advantage of OS or app bugs, misconfigurations,

413
00:20:54.799 --> 00:20:58.759
<v Speaker 2>or somehow elevating a normal user's permissions to admin level.

414
00:20:58.599 --> 00:21:01.960
<v Speaker 1>Which lets you to do what files, install.

415
00:21:01.680 --> 00:21:06.759
<v Speaker 2>Backdoors, all of that access sensitive info, installed trojans or viruses,

416
00:21:06.960 --> 00:21:11.720
<v Speaker 2>often possible due to weak policies, untested code route force attacks,

417
00:21:11.960 --> 00:21:13.759
<v Speaker 2>or again social engineering.

418
00:21:13.799 --> 00:21:18.119
<v Speaker 1>Then execution implantation retraction sounds like a spy movie.

419
00:21:18.279 --> 00:21:21.680
<v Speaker 2>Huh. Yeah. It means establishing your presence, maybe with root

420
00:21:21.720 --> 00:21:25.759
<v Speaker 2>kits or trojans there, meticulously covering your tracks, erasing logs,

421
00:21:25.839 --> 00:21:27.799
<v Speaker 2>hiding modifications.

422
00:21:27.079 --> 00:21:28.839
<v Speaker 1>Changing settings to stay hidden.

423
00:21:28.559 --> 00:21:31.519
<v Speaker 2>Right, and finally verifying your back door still works and

424
00:21:31.599 --> 00:21:33.400
<v Speaker 2>checking if any alert systems were triggered.

425
00:21:33.400 --> 00:21:35.599
<v Speaker 1>Okay, attack complete, seems like the job's done.

426
00:21:35.680 --> 00:21:38.880
<v Speaker 2>Not even close. Stage three post attack cleanup. I'd argue

427
00:21:38.880 --> 00:21:41.039
<v Speaker 2>this is actually the most critical stage of the whole thing, really,

428
00:21:41.519 --> 00:21:46.160
<v Speaker 2>because it's the ethical pen tester's absolute responsibility to meticulously

429
00:21:46.200 --> 00:21:50.640
<v Speaker 2>clean up everything, return all systems to their exact pretest state.

430
00:21:51.119 --> 00:21:53.960
<v Speaker 2>It's about trust, professionalism, leaving no trace.

431
00:21:54.079 --> 00:21:57.680
<v Speaker 1>So what does that involve? Removing uploaded files YEP.

432
00:21:57.799 --> 00:22:02.000
<v Speaker 2>Removing files, restoring any modified data or settings, undoing privileged

433
00:22:02.079 --> 00:22:06.799
<v Speaker 2>escalations resetting user settings, reverting network changes like DNS.

434
00:22:06.519 --> 00:22:10.119
<v Speaker 1>Rips, and doing registry changes, shares, connections, everything.

435
00:22:10.119 --> 00:22:12.200
<v Speaker 2>You have to put it back exactly as you found it.

436
00:22:12.240 --> 00:22:14.359
<v Speaker 1>And documentation is key here too.

437
00:22:14.480 --> 00:22:19.400
<v Speaker 2>Absolutely paramount. Documenting all captured logs and every single modified

438
00:22:19.519 --> 00:22:22.759
<v Speaker 2>entry during the attack and the cleanup. This record is

439
00:22:22.880 --> 00:22:26.319
<v Speaker 2>vital for the final report improves precisely what happened and

440
00:22:26.359 --> 00:22:28.000
<v Speaker 2>that the system was restored correctly.

441
00:22:28.319 --> 00:22:30.599
<v Speaker 1>So what's the final interaction with the client?

442
00:22:30.799 --> 00:22:34.240
<v Speaker 2>Like? You analyze all the results, then develop actual solutions,

443
00:22:34.319 --> 00:22:37.200
<v Speaker 2>not just pointing out problems but giving concrete advice on

444
00:22:37.240 --> 00:22:37.960
<v Speaker 2>how to fix them.

445
00:22:38.000 --> 00:22:41.240
<v Speaker 1>Presenting the documentation constructively.

446
00:22:40.880 --> 00:22:45.480
<v Speaker 2>Exactly clearly identifying the critical risks, providing a prioritized list

447
00:22:45.559 --> 00:22:49.279
<v Speaker 2>of needed changes. The whole tone needs to be helpful, constructive,

448
00:22:49.640 --> 00:22:53.039
<v Speaker 2>not accusatory or mocking. It's about helping them improve this.

449
00:22:53.160 --> 00:22:56.599
<v Speaker 1>What process sounds complex? Are there standards to guide it?

450
00:22:56.720 --> 00:23:00.039
<v Speaker 2>Oh? Yes? Following established standards is essential. It ensures the

451
00:23:00.079 --> 00:23:03.960
<v Speaker 2>pen test is comprehensive, systematic, covers all the bases consistently.

452
00:23:04.319 --> 00:23:05.759
<v Speaker 2>It's the blueprint for success.

453
00:23:06.440 --> 00:23:08.599
<v Speaker 1>What are some examples? Open source ones.

454
00:23:08.480 --> 00:23:12.759
<v Speaker 2>Several prominent ones OSTMM the Open source Security Testing methodology

455
00:23:12.799 --> 00:23:16.400
<v Speaker 2>manual is great for high security matrix testing. OWASS, the

456
00:23:16.559 --> 00:23:20.519
<v Speaker 2>Openweb Application Security Project, focuses on web app security and

457
00:23:20.519 --> 00:23:23.759
<v Speaker 2>they have tools like ZP the Zatack proxy project for

458
00:23:23.799 --> 00:23:28.000
<v Speaker 2>finding webvolns any others. There's ISAF, the Information System Security

459
00:23:28.039 --> 00:23:30.880
<v Speaker 2>Assessment Framework and other open source guide and of course

460
00:23:31.240 --> 00:23:34.359
<v Speaker 2>NIST the National Institute of Standards and Technology in the US.

461
00:23:34.519 --> 00:23:36.440
<v Speaker 2>Their standards are widely adopted everywhere.

462
00:23:36.519 --> 00:23:37.880
<v Speaker 1>Are their proprietary ones too.

463
00:23:38.359 --> 00:23:43.240
<v Speaker 2>Paid methodologies sure EC Council has its LPT license Penetration

464
00:23:43.400 --> 00:23:48.440
<v Speaker 2>testor certification, which requires a course, application fee and submitting

465
00:23:48.480 --> 00:23:51.680
<v Speaker 2>a report from a test environment. Historically there were things

466
00:23:51.720 --> 00:23:56.000
<v Speaker 2>like McAfee, Foundstone now owned by Intel and IBMISS, though

467
00:23:56.039 --> 00:23:59.480
<v Speaker 2>that's discontinued. They often come with their own specific tools

468
00:23:59.480 --> 00:24:00.000
<v Speaker 2>and structures.

469
00:24:00.319 --> 00:24:03.799
<v Speaker 1>But across all these common phases emerge absolutely.

470
00:24:03.920 --> 00:24:06.880
<v Speaker 2>They almost all follow a similar pattern. Starts with information

471
00:24:06.920 --> 00:24:10.839
<v Speaker 2>gathering from public sources, then an external pen test looking

472
00:24:10.839 --> 00:24:14.880
<v Speaker 2>for outside vulnerabilities, followed by vulnerability analysis finding.

473
00:24:14.599 --> 00:24:16.680
<v Speaker 1>Weak points, then moving inside right.

474
00:24:16.640 --> 00:24:20.839
<v Speaker 2>An internal network pen test testing firewalls and DMZs ideas.

475
00:24:20.960 --> 00:24:25.279
<v Speaker 2>Verification can use sneak past alarms, password cracking against various attack.

476
00:24:25.079 --> 00:24:28.680
<v Speaker 1>Types social engineering tests, web AP tests definitely social engineering,

477
00:24:28.759 --> 00:24:32.440
<v Speaker 1>human or computer based web application tests looking for code flaws.

478
00:24:32.759 --> 00:24:36.200
<v Speaker 1>SQL injection still a huge one. Testing routers, internal nexter.

479
00:24:36.160 --> 00:24:40.839
<v Speaker 2>Wireless networks too, yep, wireless network pen testing, checking accessibility, encryption,

480
00:24:41.079 --> 00:24:45.039
<v Speaker 2>signal leakage, denial of service, tests to find breaking points,

481
00:24:45.200 --> 00:24:48.720
<v Speaker 2>even tests for stolen machines, offline attacks on tisk contents.

482
00:24:48.480 --> 00:24:51.319
<v Speaker 1>Source code review, physical security.

483
00:24:50.920 --> 00:24:53.880
<v Speaker 2>Source code pen tests for in house apps, physical security,

484
00:24:53.920 --> 00:24:56.839
<v Speaker 2>trying to get into the building, lock picking, drone surveillance,

485
00:24:57.079 --> 00:25:01.000
<v Speaker 2>database pen tests for direct data access or SEQL in data.

486
00:25:00.799 --> 00:25:04.039
<v Speaker 1>Leakage, SAP VPNs. This list is huge.

487
00:25:04.119 --> 00:25:08.519
<v Speaker 2>It really is comprehensive data leakage tests, SAP, platform vulnerability checks,

488
00:25:08.680 --> 00:25:12.960
<v Speaker 2>VPN pen tests, VOYIP pen test, recording calls, DOUYS cloud

489
00:25:13.000 --> 00:25:16.480
<v Speaker 2>security assessments. Virtual devices vms can have vulns.

490
00:25:16.200 --> 00:25:18.480
<v Speaker 1>Too, Malware logs, mobile.

491
00:25:18.279 --> 00:25:23.000
<v Speaker 2>Malware, ransomware checks, log management security mobile devices, especially with

492
00:25:23.039 --> 00:25:27.440
<v Speaker 2>the YD Telecom broadband tests, and crucial email security. Since

493
00:25:27.440 --> 00:25:30.680
<v Speaker 2>it's such a common attack vector, especially targeting execs, it

494
00:25:30.720 --> 00:25:31.960
<v Speaker 2>covers pretty much every angle.

495
00:25:32.039 --> 00:25:35.400
<v Speaker 1>Okay, wow, that's the theory and structure. Now for the

496
00:25:35.480 --> 00:25:38.319
<v Speaker 1>really compelling part, let's look at how ethical hackers actually

497
00:25:38.319 --> 00:25:41.559
<v Speaker 1>get their hands dirty, starting with practical information gathering or

498
00:25:41.559 --> 00:25:42.200
<v Speaker 1>foot printing.

499
00:25:42.559 --> 00:25:45.599
<v Speaker 2>Right foot printing, it's all about finding publicly available info

500
00:25:45.680 --> 00:25:51.519
<v Speaker 2>about your target network layout, PCs, apps users mostly passive research.

501
00:25:51.559 --> 00:25:53.640
<v Speaker 2>You're not actively poking their systems.

502
00:25:53.359 --> 00:25:55.440
<v Speaker 1>Yet, like a digital detective.

503
00:25:55.079 --> 00:25:58.640
<v Speaker 2>Exactly and a critical point. If you find something really

504
00:25:58.640 --> 00:26:02.559
<v Speaker 2>sensitive during this phase, report it to your emergency contact immediately,

505
00:26:03.000 --> 00:26:05.799
<v Speaker 2>don't wait for the final report helps prevent leaks.

506
00:26:05.960 --> 00:26:09.559
<v Speaker 1>What kinds of methods are you? Search engines, social media.

507
00:26:09.400 --> 00:26:14.240
<v Speaker 2>All of the above, Google being Yahoo obviously, but also Facebook, Twitter,

508
00:26:14.279 --> 00:26:17.279
<v Speaker 2>LinkedIn for employee info. People share a lot. There's even

509
00:26:17.319 --> 00:26:21.359
<v Speaker 2>Google hacking using specific search terms to find exposed printers, cameras,

510
00:26:21.400 --> 00:26:23.279
<v Speaker 2>sensitive documents. Companies don't realize our.

511
00:26:23.160 --> 00:26:24.640
<v Speaker 1>Public website footprinting too.

512
00:26:25.079 --> 00:26:28.079
<v Speaker 2>Downloading sites, Yeah, Tools like black widow or website copier

513
00:26:28.319 --> 00:26:31.359
<v Speaker 2>can download entire sites for offline analysis. You look for

514
00:26:31.400 --> 00:26:35.039
<v Speaker 2>hidden folders, admin pages, comments in the code. Email footprinting

515
00:26:35.079 --> 00:26:38.359
<v Speaker 2>uses tools like enslokup to find mail servers, encryption details,

516
00:26:38.680 --> 00:26:43.720
<v Speaker 2>whis lookups, find domain owners, ip ranges, DNS reconnaissance maps,

517
00:26:43.720 --> 00:26:46.759
<v Speaker 2>out keyservers, network recon maps, packet.

518
00:26:46.440 --> 00:26:50.160
<v Speaker 1>Paths, and don't forget low tech social engineering. Shoulder surfing,

519
00:26:50.880 --> 00:26:52.039
<v Speaker 1>dumpster diving.

520
00:26:51.960 --> 00:26:56.920
<v Speaker 2>Still relevant, shoulder serving for passwords, dumpster diving for discarded documents,

521
00:26:56.960 --> 00:27:01.920
<v Speaker 2>eavesdropping all can yield valuable clues about security products, network layout,

522
00:27:01.960 --> 00:27:02.359
<v Speaker 2>et cetera.

523
00:27:02.680 --> 00:27:06.160
<v Speaker 1>And throughout this meticulous documentation is key. Right building that.

524
00:27:06.119 --> 00:27:09.519
<v Speaker 2>Map absolutely vital. You're building that comprehensive map of the

525
00:27:09.559 --> 00:27:13.240
<v Speaker 2>target's security posture. Every piece of data matters for later

526
00:27:13.279 --> 00:27:16.359
<v Speaker 2>analysis and for showing the client exactly what's exposed.

527
00:27:16.480 --> 00:27:20.400
<v Speaker 1>Okay, footprinting done. Next up host discovery with port scanning,

528
00:27:20.759 --> 00:27:22.440
<v Speaker 1>finding live systems exactly.

529
00:27:22.599 --> 00:27:26.759
<v Speaker 2>Now we start actively probing carefully find live systems, see

530
00:27:26.759 --> 00:27:30.799
<v Speaker 2>which ports are open, identify running services, maybe grab banners

531
00:27:30.839 --> 00:27:32.319
<v Speaker 2>for OS fingerprinting, and.

532
00:27:32.279 --> 00:27:33.640
<v Speaker 1>The main tool here is enmap.

533
00:27:33.880 --> 00:27:37.720
<v Speaker 2>Dmap is the workhorse often used with its Gui zen map.

534
00:27:38.240 --> 00:27:41.440
<v Speaker 2>It's incredibly versible for finding live hosts and determining port

535
00:27:41.480 --> 00:27:44.839
<v Speaker 2>states open closed or filtered by a firewall. Is like

536
00:27:44.839 --> 00:27:46.359
<v Speaker 2>your network Flashlight.

537
00:27:46.039 --> 00:27:48.799
<v Speaker 1>Can use simpler tools like telnet for banner grabbing too.

538
00:27:48.960 --> 00:27:51.319
<v Speaker 2>You can yeah connect to a port, see what welcome

539
00:27:51.319 --> 00:27:54.079
<v Speaker 2>message it gives back, can offer clues about the service

540
00:27:54.160 --> 00:27:54.680
<v Speaker 2>or OS.

541
00:27:55.000 --> 00:27:59.599
<v Speaker 1>Then vulnerability scanning tools like Retina nessus right once you know.

542
00:27:59.559 --> 00:28:01.720
<v Speaker 2>What's a lot and what services are running. Tools like

543
00:28:01.799 --> 00:28:06.079
<v Speaker 2>core Impact, Retina, MBSA, GFI, languord or nessus is another

544
00:28:06.119 --> 00:28:09.839
<v Speaker 2>popular one help identify known security weaknesses in those systems

545
00:28:09.880 --> 00:28:10.480
<v Speaker 2>and services.

546
00:28:10.519 --> 00:28:13.039
<v Speaker 1>And network diagramming tools help visualize all this.

547
00:28:13.359 --> 00:28:16.880
<v Speaker 2>Yeah, Tools like solar Winds Network Topology Manager turn that

548
00:28:17.000 --> 00:28:20.400
<v Speaker 2>raw data into understandable maps. Makes it much easier to

549
00:28:20.400 --> 00:28:21.720
<v Speaker 2>grasp the network structure.

550
00:28:21.839 --> 00:28:23.880
<v Speaker 1>What about proxies hiding your tracks?

551
00:28:24.160 --> 00:28:28.519
<v Speaker 2>Proxies like proxy, workbench, TOR or proxifier are crucial for

552
00:28:28.599 --> 00:28:32.519
<v Speaker 2>masking the attacker's source IP makes attribution much harder. It's

553
00:28:32.519 --> 00:28:35.039
<v Speaker 2>an essential part of operational security for a pen tester,

554
00:28:35.359 --> 00:28:37.640
<v Speaker 2>and their use must be documented.

555
00:28:37.279 --> 00:28:41.319
<v Speaker 1>Beyond just finding hosts. An eumeration digs deeper, user accounts,

556
00:28:41.680 --> 00:28:42.720
<v Speaker 1>shares exactly.

557
00:28:42.880 --> 00:28:46.559
<v Speaker 2>Enumeration goes beyond basic recon. You're trying to identify specific

558
00:28:46.640 --> 00:28:51.079
<v Speaker 2>user groups, service accounts, network shares, installed apps, specific network

559
00:28:51.079 --> 00:28:56.359
<v Speaker 2>devices like routers, switches, idsps, firewalls, Getting granular details.

560
00:28:56.160 --> 00:28:57.599
<v Speaker 1>Using what kinds of tools are commands?

561
00:28:57.799 --> 00:29:02.240
<v Speaker 2>Specific tools for specific protocols, Who's for network ranges, NMAPT

562
00:29:02.519 --> 00:29:06.200
<v Speaker 2>SP or angry IP scanner for ping sweeps though angry

563
00:29:06.240 --> 00:29:10.119
<v Speaker 2>IP is often detectable. Detailed en map port scans, net

564
00:29:10.119 --> 00:29:14.599
<v Speaker 2>BIOS enumeration tools for Windows Shares users, maybe passwords, SNMP

565
00:29:14.799 --> 00:29:18.400
<v Speaker 2>enumeration tools like solar ins, op pudles for network device details,

566
00:29:18.799 --> 00:29:22.960
<v Speaker 2>LDAP enumeration for user info names department's great for social engineering,

567
00:29:23.240 --> 00:29:27.279
<v Speaker 2>NTP numeration for time servers, SMTP numeration for email addresses,

568
00:29:27.559 --> 00:29:31.519
<v Speaker 2>DNS enumeration for mapping names to IPCE systematically pulling info

569
00:29:31.559 --> 00:29:32.839
<v Speaker 2>from every available service.

570
00:29:32.920 --> 00:29:36.079
<v Speaker 1>Okay, let's unpack this. We're seeing how an attacker methodically

571
00:29:36.079 --> 00:29:39.720
<v Speaker 1>builds this incredibly detailed picture piece by piece. Now let's

572
00:29:39.720 --> 00:29:42.000
<v Speaker 1>get into actually executing some external tests.

573
00:29:42.160 --> 00:29:44.519
<v Speaker 2>Right. So, doing an external pen test often starts with

574
00:29:44.599 --> 00:29:48.160
<v Speaker 2>drawing visual diagrams, mapping routes, using trace rode with different

575
00:29:48.160 --> 00:29:51.319
<v Speaker 2>protocols like ICMB or TCP, and doing those ping sweeps.

576
00:29:51.680 --> 00:29:54.400
<v Speaker 2>Understanding the TCP three way handshake is critical here.

577
00:29:54.559 --> 00:29:57.720
<v Speaker 1>The s yn CYANAC ack sequence exactly.

578
00:29:57.880 --> 00:30:00.880
<v Speaker 2>Syn scans leverage this to s YN. If you get

579
00:30:00.880 --> 00:30:03.160
<v Speaker 2>a SUNAC back, the cord is open. If you get

580
00:30:03.160 --> 00:30:05.799
<v Speaker 2>a reset RST, it's closed. If you get nothing or

581
00:30:05.839 --> 00:30:08.920
<v Speaker 2>maybe an ICMP error, it's likely filtered by a firewall.

582
00:30:09.559 --> 00:30:11.799
<v Speaker 2>N MAP interprets these responses.

583
00:30:11.559 --> 00:30:13.799
<v Speaker 1>And NMP has tons of options for different scans.

584
00:30:13.839 --> 00:30:15.880
<v Speaker 2>Oh yeah, the book gives examples, but basically you can

585
00:30:15.920 --> 00:30:19.279
<v Speaker 2>do simple host discovery and map dash SP comprehensive scans

586
00:30:19.359 --> 00:30:23.039
<v Speaker 2>checking all ports, service versions, OS detection, and map tashed

587
00:30:23.079 --> 00:30:26.720
<v Speaker 2>P one six, Y five, five three five sv SST

588
00:30:26.759 --> 00:30:30.839
<v Speaker 2>four target or even more aggressive scans A for OS

589
00:30:30.960 --> 00:30:34.519
<v Speaker 2>version detection scripts h T five for faster timing. You

590
00:30:34.559 --> 00:30:37.079
<v Speaker 2>tailor the scan to your needs and the rules of engagement.

591
00:30:37.200 --> 00:30:39.279
<v Speaker 1>What about HING three sounds powerful?

592
00:30:39.319 --> 00:30:42.160
<v Speaker 2>It is extremely powerful, great for device discovery because it

593
00:30:42.160 --> 00:30:46.720
<v Speaker 2>can use TCPUDP to bypass icmplocks. It can manipulate source ips,

594
00:30:46.920 --> 00:30:50.440
<v Speaker 2>craft almost any packet, and yes, create denial of service attack,

595
00:30:50.519 --> 00:30:55.079
<v Speaker 2>which means it's dangerous, hugely dangerous. The source explicitly warns

596
00:30:55.400 --> 00:30:58.799
<v Speaker 2>Aging three commands, especially flood attacks like Hing three s

597
00:30:58.839 --> 00:31:03.799
<v Speaker 2>target at PA, spoofed ep port flood can absolutely recondivice

598
00:31:03.839 --> 00:31:08.640
<v Speaker 2>the CPU very quickly. This demands immense responsibility. Practice only

599
00:31:08.680 --> 00:31:11.960
<v Speaker 2>with written permission in your isolated home lab avoids severe

600
00:31:12.039 --> 00:31:13.519
<v Speaker 2>damage and serious legal trouble.

601
00:31:13.599 --> 00:31:19.119
<v Speaker 1>Okay, message received, Now for something really interesting infiltrating communications

602
00:31:19.559 --> 00:31:21.039
<v Speaker 1>man in the middle attacks right.

603
00:31:21.119 --> 00:31:24.400
<v Speaker 2>Like ARP poisoning, often done using ettercap, it has a

604
00:31:24.440 --> 00:31:27.599
<v Speaker 2>graphical mode edercap G, which makes it easier.

605
00:31:27.640 --> 00:31:29.119
<v Speaker 1>How does it work? Conceptually?

606
00:31:29.200 --> 00:31:31.720
<v Speaker 2>It basically tricks devices on a local network. It sends

607
00:31:31.759 --> 00:31:35.440
<v Speaker 2>out fake ARP messages telling computer A that THEMEC address

608
00:31:35.480 --> 00:31:38.599
<v Speaker 2>for computer B, like the router, is actually the ATTACKERSMEC

609
00:31:38.680 --> 00:31:40.079
<v Speaker 2>address and vice versa.

610
00:31:39.920 --> 00:31:42.319
<v Speaker 1>So all traffic flows through the attacker exactly.

611
00:31:42.359 --> 00:31:45.039
<v Speaker 2>All traffic between the source and destination gets intercepted. You

612
00:31:45.079 --> 00:31:47.359
<v Speaker 2>start atter caps, sniff the network, scan for hosts, pick

613
00:31:47.359 --> 00:31:50.000
<v Speaker 2>your targets like a specific PC in the router, and

614
00:31:50.079 --> 00:31:54.119
<v Speaker 2>hit start ARP poisoning. The victim usually has no idea.

615
00:31:53.759 --> 00:31:56.279
<v Speaker 1>But again huge warning supply crystal clear.

616
00:31:56.880 --> 00:31:59.880
<v Speaker 2>Never use this in a live or production environment without

617
00:31:59.880 --> 00:32:06.559
<v Speaker 2>a explicit written authorization. Extremely dangerous, serious legal repercussions. Practice

618
00:32:06.559 --> 00:32:08.119
<v Speaker 2>only in your isolated home, LAMB.

619
00:32:08.359 --> 00:32:11.920
<v Speaker 1>Are there other ways to capture traffic? Network taps YEP.

620
00:32:12.440 --> 00:32:14.920
<v Speaker 2>A network tap is a physical hardware device you insert

621
00:32:14.960 --> 00:32:17.839
<v Speaker 2>between two points like a computer in a switch that

622
00:32:17.920 --> 00:32:21.319
<v Speaker 2>copies the traffic or port mirroring also called port spanning

623
00:32:21.559 --> 00:32:22.599
<v Speaker 2>on a managed.

624
00:32:22.200 --> 00:32:24.920
<v Speaker 1>Switch, where you configure the switch to copy traffic right

625
00:32:25.000 --> 00:32:25.440
<v Speaker 1>you tell.

626
00:32:25.319 --> 00:32:27.880
<v Speaker 2>The switch copy all traffic going to from port one

627
00:32:27.920 --> 00:32:30.680
<v Speaker 2>over to port ten where your monitoring machine is plugged in.

628
00:32:31.240 --> 00:32:33.799
<v Speaker 2>Requires access to configure the switch obviously, what.

629
00:32:33.799 --> 00:32:35.599
<v Speaker 1>About passively listening to Wi Fi?

630
00:32:35.880 --> 00:32:39.240
<v Speaker 2>That's passive reconnaissance. With Collie and wire Shark, you put

631
00:32:39.279 --> 00:32:42.400
<v Speaker 2>your compatible wireless adapter into monitor mode. Commands like Airman

632
00:32:42.519 --> 00:32:45.160
<v Speaker 2>check kill and Airman start. Wall and zero often do.

633
00:32:45.160 --> 00:32:47.920
<v Speaker 1>This, turning your adapter into just an ear pretty much.

634
00:32:48.200 --> 00:32:49.839
<v Speaker 2>Then you fire up wire Shark and tell it to

635
00:32:49.880 --> 00:32:52.880
<v Speaker 2>listen on that monitor interface often named wall on zero

636
00:32:52.960 --> 00:32:55.519
<v Speaker 2>mone you'll see all the raw eight oh two point

637
00:32:55.559 --> 00:32:59.400
<v Speaker 2>on frames flying around beacons, pro requests user data if

638
00:32:59.400 --> 00:33:01.880
<v Speaker 2>it's un encrypt did digital eavesdropping?

639
00:33:02.160 --> 00:33:04.759
<v Speaker 1>Can you use wire Shark to analyze attacks too? Like

640
00:33:04.759 --> 00:33:05.759
<v Speaker 1>those syn.

641
00:33:05.519 --> 00:33:09.400
<v Speaker 2>Scans absolutely After running an n MAP syn scan you

642
00:33:09.400 --> 00:33:12.559
<v Speaker 2>can capture the traffic and wire Shark by understanding that

643
00:33:12.599 --> 00:33:16.039
<v Speaker 2>three way handshake logic and using wire sharks conversations window,

644
00:33:16.400 --> 00:33:19.079
<v Speaker 2>you can quickly see the sun knots for open ports,

645
00:33:19.480 --> 00:33:22.839
<v Speaker 2>the rsts for closed ports, or the lack of response

646
00:33:22.880 --> 00:33:25.880
<v Speaker 2>for filtered ports. It visualizes the scan results.

647
00:33:26.079 --> 00:33:28.680
<v Speaker 1>The book mentions Explico is another tool Yeah.

648
00:33:28.480 --> 00:33:31.200
<v Speaker 2>Experts interesting it's an alternative for data analysis. It can

649
00:33:31.240 --> 00:33:34.000
<v Speaker 2>take wire shark capture files, or even a direct feed.

650
00:33:34.440 --> 00:33:36.680
<v Speaker 2>Its strength is its web based gooi.

651
00:33:36.759 --> 00:33:37.440
<v Speaker 1>What does it show you?

652
00:33:37.640 --> 00:33:40.200
<v Speaker 2>It does a great job of extracting and presenting things

653
00:33:40.519 --> 00:33:45.839
<v Speaker 2>clearly visited websites, images, videos, even reconstructing VoIP calls from

654
00:33:45.880 --> 00:33:48.279
<v Speaker 2>the captured data makes it really easy to see what

655
00:33:48.359 --> 00:33:50.960
<v Speaker 2>was going on. The source calls it a powerful hacking

656
00:33:51.039 --> 00:33:53.759
<v Speaker 2>tool because it simplifies that analysis so much so.

657
00:33:53.799 --> 00:33:55.960
<v Speaker 1>The takeaway for an ethical hacker is having this whole

658
00:33:56.079 --> 00:33:57.559
<v Speaker 1>arsenal of specialized tools.

659
00:33:57.559 --> 00:34:00.279
<v Speaker 2>Definitely, each tool has its purpose, its niche. Like the

660
00:34:00.359 --> 00:34:02.920
<v Speaker 2>MITM attack with SSL strip, How does that one work?

661
00:34:03.079 --> 00:34:04.119
<v Speaker 1>Creating a fake AP?

662
00:34:04.559 --> 00:34:07.440
<v Speaker 2>Right, You need a USB adapter that supports monitor and

663
00:34:07.519 --> 00:34:10.719
<v Speaker 2>master modes to create a fake access point on COLLI.

664
00:34:10.960 --> 00:34:12.920
<v Speaker 1>So victims connect to your fake Wi.

665
00:34:12.719 --> 00:34:15.800
<v Speaker 2>Fi Exactly, they connect to your seemingly legit fake AP

666
00:34:16.360 --> 00:34:19.639
<v Speaker 2>their traffic routes that you're calling machine. SSL strip then

667
00:34:19.679 --> 00:34:22.960
<v Speaker 2>intercepts any HTTPS connections and tries to force them down

668
00:34:23.039 --> 00:34:24.639
<v Speaker 2>to plane HTTP.

669
00:34:24.320 --> 00:34:26.639
<v Speaker 1>So you can capture logins that would normally be encrypted.

670
00:34:26.760 --> 00:34:29.119
<v Speaker 2>That's the goal, capture credentials in clear text.

671
00:34:29.480 --> 00:34:31.199
<v Speaker 1>Setting that up sounds complicated, It.

672
00:34:31.239 --> 00:34:34.119
<v Speaker 2>Is quite involved. Share your host internet, set up a

673
00:34:34.199 --> 00:34:37.840
<v Speaker 2>DHCP server on TALI to give IPS to victims. Find

674
00:34:37.840 --> 00:34:41.159
<v Speaker 2>your adapter names with air moaning, start monitor mode, create

675
00:34:41.199 --> 00:34:44.440
<v Speaker 2>the fake ap with air basing, configure the tunnel interface,

676
00:34:44.679 --> 00:34:47.960
<v Speaker 2>add routing tables, enable IP forwarding in the kernel.

677
00:34:47.719 --> 00:34:48.920
<v Speaker 1>IP tables rules too.

678
00:34:49.039 --> 00:34:52.119
<v Speaker 2>Crucially, an IP table's rule to redirect web traffic port

679
00:34:52.119 --> 00:34:54.960
<v Speaker 2>eighty to the port SSL strip is listening on like

680
00:34:55.039 --> 00:34:58.960
<v Speaker 2>ten thousand, Then start DHDP, start SSL strip as phoebash,

681
00:34:59.000 --> 00:35:01.599
<v Speaker 2>make one one thousand, and finally start ttercap to watch

682
00:35:01.599 --> 00:35:02.079
<v Speaker 2>the traffic.

683
00:35:02.199 --> 00:35:04.519
<v Speaker 1>So the victim connects to free Wi Fi, tries to

684
00:35:04.559 --> 00:35:06.079
<v Speaker 1>log into Facebook.

685
00:35:05.639 --> 00:35:08.760
<v Speaker 2>And they might notice the URL changes from Https to

686
00:35:08.920 --> 00:35:11.199
<v Speaker 2>HTTP if they enter their credentials anyway.

687
00:35:11.280 --> 00:35:14.280
<v Speaker 1>You see them in utter cap or the sslstrip, dot log.

688
00:35:14.159 --> 00:35:18.559
<v Speaker 2>YEP clear text. This is an extremely dangerous attack with

689
00:35:18.719 --> 00:35:24.119
<v Speaker 2>huge legal implications. Requires authorization practice only in isolated labs.

690
00:35:24.360 --> 00:35:27.360
<v Speaker 1>Seriously, what about skape for packet manipulation.

691
00:35:27.519 --> 00:35:29.800
<v Speaker 2>Skapey is super advanced. It's a Python tool that lets

692
00:35:29.840 --> 00:35:33.920
<v Speaker 2>you craft basically any network packet you can imagine, total control.

693
00:35:33.679 --> 00:35:37.840
<v Speaker 1>Specify source destination, protocols, ports, headers.

694
00:35:37.360 --> 00:35:40.400
<v Speaker 2>Everything you build a packet layer by layer and Python code.

695
00:35:40.559 --> 00:35:45.960
<v Speaker 2>It can also capture replay packets, scan discovered devices incredibly flexible. Example,

696
00:35:46.039 --> 00:35:49.039
<v Speaker 2>launch it with skapey, send a crafted ICMP packet like

697
00:35:49.119 --> 00:35:51.800
<v Speaker 2>sent oldsrc ten ten put ten, jote off a two

698
00:35:51.840 --> 00:35:55.960
<v Speaker 2>ten typing two ICP, sniff traffic with sniffixs sniff traffic

699
00:35:56.000 --> 00:35:58.360
<v Speaker 2>with sniff telm pair on lamba.

700
00:35:58.360 --> 00:36:01.000
<v Speaker 1>Xxshew sounds powerful, well and dangerous.

701
00:36:01.039 --> 00:36:03.760
<v Speaker 2>The source calls it a rule breaker and highly dangerous.

702
00:36:04.159 --> 00:36:06.920
<v Speaker 2>Needs authorization for any live use practice in isolation.

703
00:36:07.159 --> 00:36:10.840
<v Speaker 1>What about authentication attacks against rogue aps using a WLC.

704
00:36:11.039 --> 00:36:13.159
<v Speaker 2>Right, This is more of a defensive or control measure,

705
00:36:13.199 --> 00:36:16.840
<v Speaker 2>but uses attack techniques. A wireless land controller WLC can

706
00:36:16.880 --> 00:36:20.199
<v Speaker 2>identify unauthorized rogue access points on your network.

707
00:36:19.920 --> 00:36:21.159
<v Speaker 1>And then kick client's office.

708
00:36:21.280 --> 00:36:25.400
<v Speaker 2>Essentially, yes, it sends spoofed deauthentication frames pretending to be

709
00:36:25.440 --> 00:36:28.119
<v Speaker 2>the rogue AP telling clients to disconnect, or pretending to

710
00:36:28.159 --> 00:36:31.280
<v Speaker 2>be the clients telling the AP they're disconnecting. Creates a

711
00:36:31.280 --> 00:36:33.960
<v Speaker 2>localized doss against the rogue AP to contain it.

712
00:36:34.519 --> 00:36:36.000
<v Speaker 1>How does the WLC do that?

713
00:36:36.280 --> 00:36:40.559
<v Speaker 2>It identifies rogues like an open SSID in a secure environment.

714
00:36:40.920 --> 00:36:44.280
<v Speaker 2>You classify it as malicious and then use the wlc's

715
00:36:44.320 --> 00:36:48.199
<v Speaker 2>contained feature. But the source warms. Doing this against the

716
00:36:48.280 --> 00:36:52.519
<v Speaker 2>legitimate network you don't own is illegal, needs authorization.

717
00:36:52.760 --> 00:36:56.079
<v Speaker 1>Then there's the Evil Twin authentication attack with MDK three

718
00:36:56.159 --> 00:36:57.599
<v Speaker 1>That sounds offensive it is.

719
00:36:58.199 --> 00:37:01.000
<v Speaker 2>This is creating a cloned AP. It looks identical to

720
00:37:01.039 --> 00:37:03.400
<v Speaker 2>a real one, same name as end. The goal is

721
00:37:03.400 --> 00:37:05.320
<v Speaker 2>to trick users into connecting to your fake.

722
00:37:05.159 --> 00:37:07.519
<v Speaker 1>Twin and then what capture their Wi Fi password.

723
00:37:07.679 --> 00:37:10.519
<v Speaker 2>Often, yeah, you use MDK three to blast the REALAP

724
00:37:10.719 --> 00:37:13.559
<v Speaker 2>with death packets, forcing clients off. They see your identical

725
00:37:13.599 --> 00:37:15.960
<v Speaker 2>evil twin and connect to it instead, then you might

726
00:37:16.000 --> 00:37:18.679
<v Speaker 2>redirect them to a fake captive portal, or, as the

727
00:37:18.679 --> 00:37:22.119
<v Speaker 2>book describes, a fake Rouder security update page that asks

728
00:37:22.159 --> 00:37:24.039
<v Speaker 2>for the WKT two password.

729
00:37:24.119 --> 00:37:25.800
<v Speaker 1>That setup must be even more complex.

730
00:37:26.119 --> 00:37:29.880
<v Speaker 2>Oh yeah, share Internet DHGP server download or create a

731
00:37:29.880 --> 00:37:32.800
<v Speaker 2>fake update web page. Set up a patch in mysequel

732
00:37:32.800 --> 00:37:35.960
<v Speaker 2>to host the page and store captured keys. Find adapter names,

733
00:37:36.039 --> 00:37:39.679
<v Speaker 2>monitor mode, update, aero, dumping OUI database scan for the

734
00:37:39.719 --> 00:37:43.079
<v Speaker 2>target AP, create a blacklist file with its BSSAD.

735
00:37:42.679 --> 00:37:45.159
<v Speaker 1>Then start the Evil Twin AP itself.

736
00:37:44.800 --> 00:37:47.320
<v Speaker 2>Right airbasing to create the Evil Twin on the same channel,

737
00:37:47.559 --> 00:37:51.599
<v Speaker 2>configure it's tunnel interface, routing, IP forwarding, IP tables rules

738
00:37:51.639 --> 00:37:55.000
<v Speaker 2>to redirect webdraft to your fake page, start DHGP.

739
00:37:54.760 --> 00:37:57.599
<v Speaker 1>And finally the MDK three death attack exactly.

740
00:37:57.760 --> 00:38:00.360
<v Speaker 2>MDK three one is e black last peat channel number

741
00:38:00.360 --> 00:38:03.559
<v Speaker 2>to deauthenticate clients from the real AP using the blacklist,

742
00:38:03.920 --> 00:38:08.559
<v Speaker 2>and maybe MDK three monitorate AMI BSSID for authentication dots

743
00:38:08.639 --> 00:38:10.000
<v Speaker 2>two force them over to.

744
00:38:09.960 --> 00:38:11.880
<v Speaker 1>Your twin so the victim gets kicked off wi Fi

745
00:38:12.000 --> 00:38:14.360
<v Speaker 1>connects to the twin, gets a fake update page, enters

746
00:38:14.360 --> 00:38:14.519
<v Speaker 1>to the.

747
00:38:14.480 --> 00:38:16.519
<v Speaker 2>Password, and you check your my sucl database to see

748
00:38:16.519 --> 00:38:20.960
<v Speaker 2>if you capture again. Extremely dangerous illegal without permission, authorization

749
00:38:21.079 --> 00:38:22.639
<v Speaker 2>needed isolated labs only.

750
00:38:22.960 --> 00:38:25.159
<v Speaker 1>MDK three can also just do denial of service.

751
00:38:25.280 --> 00:38:28.599
<v Speaker 2>Yes, a simpler DOSATAC just flood an AP with useless

752
00:38:28.599 --> 00:38:31.880
<v Speaker 2>traffic or generate noise to prevent legitimate users from connecting

753
00:38:31.920 --> 00:38:34.679
<v Speaker 2>or using the network. Overwhelm it steps with attached after

754
00:38:34.800 --> 00:38:38.119
<v Speaker 2>find interface if canfig scan aps I list trait lends

755
00:38:38.159 --> 00:38:42.239
<v Speaker 2>zero scan, create blacklist file with target BSSID, monitor mode

756
00:38:42.400 --> 00:38:45.920
<v Speaker 2>er marcostarbuln zero, then run the MDK three d disassociation

757
00:38:46.159 --> 00:38:50.280
<v Speaker 2>or authentication dos attacks MDK three moment zero, DP blacklist,

758
00:38:50.320 --> 00:38:54.440
<v Speaker 2>dot C channel MDK three money on ami BSSID. Same

759
00:38:54.480 --> 00:38:58.480
<v Speaker 2>warnings apply, severe legal consequences, need authorization.

760
00:38:58.039 --> 00:39:01.880
<v Speaker 1>Okay, shifting gear slightly brute force at with hydra right TCP.

761
00:39:01.960 --> 00:39:04.440
<v Speaker 2>Hydrate is a classic tool for boot forcing logins. You

762
00:39:04.480 --> 00:39:06.639
<v Speaker 2>give it a list of usernames or just one, and

763
00:39:06.679 --> 00:39:08.199
<v Speaker 2>a dictionary of passwords and it just.

764
00:39:08.159 --> 00:39:10.599
<v Speaker 1>Tries them all against a service like telnet or SSH.

765
00:39:10.800 --> 00:39:14.000
<v Speaker 2>YEP systematically tries commodations until it finds one that works,

766
00:39:14.199 --> 00:39:19.400
<v Speaker 2>like hydrate, dash feed dashel username, pactopasswords, dot TXTST sixteen,

767
00:39:19.440 --> 00:39:22.960
<v Speaker 2>target tip tellin the options control verbosity, username, password, file,

768
00:39:23.079 --> 00:39:28.119
<v Speaker 2>number of parallel tasks, target IP and the service likes sash, FTP.

769
00:39:27.920 --> 00:39:30.440
<v Speaker 1>Tell neet and if it succeeds, the hacker logs in.

770
00:39:30.679 --> 00:39:32.119
<v Speaker 1>How does the pent tester analyze this?

771
00:39:32.360 --> 00:39:36.239
<v Speaker 2>In wire shark capture the traffic during the brute force attempt.

772
00:39:36.719 --> 00:39:40.119
<v Speaker 2>If the protocol is unencrypted like telnet or FTP, you

773
00:39:40.159 --> 00:39:42.079
<v Speaker 2>can use follow TCP.

774
00:39:41.880 --> 00:39:43.559
<v Speaker 1>Stream and see the failed attempts.

775
00:39:43.679 --> 00:39:46.119
<v Speaker 2>You'll see all the failed log in attempts and then bam,

776
00:39:46.280 --> 00:39:48.679
<v Speaker 2>the successful log in with the username and password in

777
00:39:48.719 --> 00:39:52.639
<v Speaker 2>clear text. It's a glaring demonstration of why clear text

778
00:39:52.639 --> 00:39:57.599
<v Speaker 2>protocols HTTP, FTP, pop im s, MTP, telnet VIP are

779
00:39:57.639 --> 00:40:01.960
<v Speaker 2>so dangerous and need replacing with secure VERSI, HTTPS, SFTP,

780
00:40:02.119 --> 00:40:02.679
<v Speaker 2>SP etc.

781
00:40:03.079 --> 00:40:05.320
<v Speaker 1>What about Armitage that's related to metasploit.

782
00:40:05.480 --> 00:40:08.760
<v Speaker 2>Yeah. Armitage is a graphical front end for the metasploit framework.

783
00:40:09.159 --> 00:40:14.079
<v Speaker 2>Makes metasploiits powerful capabilities more visual and arguably easier to manage,

784
00:40:14.320 --> 00:40:18.000
<v Speaker 2>especially for beginners or for managing multiple targets. Helps understand

785
00:40:18.039 --> 00:40:18.960
<v Speaker 2>how attacks are deployed.

786
00:40:19.000 --> 00:40:19.519
<v Speaker 1>What can it do?

787
00:40:19.760 --> 00:40:22.159
<v Speaker 2>You launch it Armitage. It connects to metasplits back end.

788
00:40:22.360 --> 00:40:25.559
<v Speaker 2>You get panels from modules, targets, tabs showing console output.

789
00:40:25.760 --> 00:40:28.960
<v Speaker 2>You can run scans MSF scans to find open port services,

790
00:40:29.239 --> 00:40:32.559
<v Speaker 2>use fine attacks to see relevant exploits, configure and launch them.

791
00:40:32.599 --> 00:40:33.840
<v Speaker 1>What's the hail Mary option?

792
00:40:34.159 --> 00:40:37.239
<v Speaker 2>Huh Yeah, if you're stuck, hail Mary throws a bunch

793
00:40:37.239 --> 00:40:40.079
<v Speaker 2>of likely exploits at the target, automatically hoping one sticks.

794
00:40:40.320 --> 00:40:43.559
<v Speaker 2>Less precise, but sometimes effective if you get a shell

795
00:40:43.840 --> 00:40:47.199
<v Speaker 2>like interpret different windows. Armitage gives you graphical ways to

796
00:40:47.239 --> 00:40:51.199
<v Speaker 2>interact browse files, etc. But again needs authorization and.

797
00:40:51.239 --> 00:40:55.039
<v Speaker 1>Metasploit Framework MSF itself the engine behind armitage.

798
00:40:55.199 --> 00:40:58.920
<v Speaker 2>MSF is the open source powerhouse ROVIE based. Its strength

799
00:40:59.000 --> 00:41:01.639
<v Speaker 2>is its modularity. You have different module.

800
00:41:01.320 --> 00:41:03.039
<v Speaker 1>Types like exports and payloads.

801
00:41:03.119 --> 00:41:06.639
<v Speaker 2>Right. Exploit modules target specific volons. Payloads are the code

802
00:41:06.639 --> 00:41:10.719
<v Speaker 2>delivered by the exploit eg A command shell, metipreter. Auxiliary

803
00:41:10.719 --> 00:41:14.599
<v Speaker 2>modules do other things like scanning, fuzzing, sniffing. Post modules

804
00:41:14.599 --> 00:41:17.800
<v Speaker 2>are for post exploitation gathering info after you compromise a system.

805
00:41:18.239 --> 00:41:23.280
<v Speaker 2>Encoders try to bypass avnops. No operations help with buffer overflows.

806
00:41:23.480 --> 00:41:25.800
<v Speaker 1>So how do you use MSF to exploit something?

807
00:41:26.119 --> 00:41:30.119
<v Speaker 2>So process, start the database, post criscal, launch the console

808
00:41:30.440 --> 00:41:34.199
<v Speaker 2>and missif console. Maybe create a workspace search for an exploit.

809
00:41:34.400 --> 00:41:38.440
<v Speaker 2>Search unreal extrty get info info exploit with blotenix, circon

810
00:41:38.480 --> 00:41:40.960
<v Speaker 2>reelers D three two eight one back door select it,

811
00:41:41.400 --> 00:41:45.159
<v Speaker 2>show options, show options, set the target IP, set rho's

812
00:41:45.239 --> 00:41:48.440
<v Speaker 2>target tip, show available payloads, choose one, set payloads the

813
00:41:48.480 --> 00:41:52.559
<v Speaker 2>end of us, reverse set your listening IP, set LA showsterrip.

814
00:41:52.639 --> 00:41:55.639
<v Speaker 1>Then exploit and if it works you get a shell.

815
00:41:55.480 --> 00:41:58.320
<v Speaker 2>Hopefully yeah, a command prompt or meterpreter session on the

816
00:41:58.320 --> 00:41:59.000
<v Speaker 2>target machine.

817
00:41:59.039 --> 00:42:01.320
<v Speaker 1>Then post exploitation gathering more info.

818
00:42:01.679 --> 00:42:05.599
<v Speaker 2>Right assess the environment quickly, find sensitive files, create new accounts,

819
00:42:05.599 --> 00:42:09.719
<v Speaker 2>maybe escalate privileges, vertical movement, pivot to attack other systems,

820
00:42:09.719 --> 00:42:13.159
<v Speaker 2>horizontal movement, install backdoors and crucially cover your tracks.

821
00:42:13.199 --> 00:42:14.639
<v Speaker 1>Metasploit has modules for that too.

822
00:42:14.760 --> 00:42:18.440
<v Speaker 2>Tons of them sessions to list active shells, hashtump to

823
00:42:18.440 --> 00:42:21.679
<v Speaker 2>get password hashes in them configs and m networks, and

824
00:42:21.719 --> 00:42:26.039
<v Speaker 2>in protections find av firewalls in msystem users packages, services

825
00:42:26.119 --> 00:42:29.000
<v Speaker 2>in amuser's history. All require authorization, of course.

826
00:42:29.199 --> 00:42:31.800
<v Speaker 1>Lastly, the social engineering Toolkit asset.

827
00:42:31.639 --> 00:42:35.440
<v Speaker 2>Set is another open source framework, Python based specifically for

828
00:42:35.519 --> 00:42:39.559
<v Speaker 2>social engineering attacks. It integrates tightly with metasploit for payloads

829
00:42:39.599 --> 00:42:42.800
<v Speaker 2>and listeners. Is it easy to use, deceptively easy launch

830
00:42:42.840 --> 00:42:46.119
<v Speaker 2>it set toolkit and its menu driven just pick numbers?

831
00:42:46.119 --> 00:42:47.440
<v Speaker 1>What kinds of attacks are in there?

832
00:42:47.559 --> 00:42:51.760
<v Speaker 2>Lots Under social engineering attacks you have spear phishing, crafting,

833
00:42:51.760 --> 00:42:55.239
<v Speaker 2>targeted emails with exploits. Website attack vectors has things like

834
00:42:55.320 --> 00:43:00.320
<v Speaker 2>Java applet attacks, metasploit browser exploits, The Credential Harvester owans

835
00:43:00.320 --> 00:43:04.760
<v Speaker 2>a website like Facebook or Gmail to steal logins, tab nabbing, webjacking.

836
00:43:04.880 --> 00:43:06.119
<v Speaker 1>Other modules do yeah.

837
00:43:06.119 --> 00:43:11.199
<v Speaker 2>Infectious Media Generator makes malicious autoorun files for USBs payload

838
00:43:11.199 --> 00:43:14.920
<v Speaker 2>and listener setup, mass mailer or ADNO based attacks. Similarly

839
00:43:14.960 --> 00:43:18.400
<v Speaker 2>to keyboard view USB wireless access point attack creates a

840
00:43:18.400 --> 00:43:21.840
<v Speaker 2>fake AP with the HCPD and S redirection QR code

841
00:43:21.840 --> 00:43:25.400
<v Speaker 2>generator for malicious links powershow attacks. It greates third party

842
00:43:25.480 --> 00:43:26.079
<v Speaker 2>tools too.

843
00:43:26.000 --> 00:43:28.000
<v Speaker 1>So it makes complex attacks.

844
00:43:27.559 --> 00:43:32.119
<v Speaker 2>Accessible dangerously accessible. Almost anyone can launch really sophisticated attacks

845
00:43:32.159 --> 00:43:35.480
<v Speaker 2>just by following the menus, which makes it incredibly powerful

846
00:43:35.599 --> 00:43:37.639
<v Speaker 2>but also incredibly risky if misused.

847
00:43:38.000 --> 00:43:39.239
<v Speaker 1>Final warning time.

848
00:43:39.199 --> 00:43:44.519
<v Speaker 2>Absolutely set requires explicit written authorization for any use practice

849
00:43:44.559 --> 00:43:48.360
<v Speaker 2>only in isolated home labs. The potential for real world

850
00:43:48.400 --> 00:43:50.360
<v Speaker 2>harm and legal trouble is immense.

851
00:43:50.760 --> 00:43:54.199
<v Speaker 1>Wow. Okay, and just like that we've covered a ton

852
00:43:54.239 --> 00:43:56.760
<v Speaker 1>of ground. You've really taken a deep dive into the

853
00:43:56.840 --> 00:43:59.159
<v Speaker 1>world of ethical hacking and pen testing.

854
00:43:59.360 --> 00:43:59.840
<v Speaker 2>We sure have.

855
00:44:00.159 --> 00:44:02.880
<v Speaker 1>From the basics of Linux and open source, through all

856
00:44:02.960 --> 00:44:05.880
<v Speaker 1>those stages of a pen test, and into the nitty

857
00:44:05.920 --> 00:44:10.360
<v Speaker 1>gritty of tools like end map, ettercap metasploy CESC. You

858
00:44:10.400 --> 00:44:13.239
<v Speaker 1>should now have a much better picture of what goes

859
00:44:13.239 --> 00:44:14.639
<v Speaker 1>on behind that digital curtain.

860
00:44:14.760 --> 00:44:17.559
<v Speaker 2>Yeah, and hopefully this journey highlights that ethical hacking isn't

861
00:44:17.679 --> 00:44:21.440
<v Speaker 2>just about finding flaws. It's about understanding how things can

862
00:44:21.480 --> 00:44:23.880
<v Speaker 2>be broken so you can ultimately strengthen the defenses.

863
00:44:24.039 --> 00:44:25.599
<v Speaker 1>Knowledge is power, It really.

864
00:44:25.400 --> 00:44:28.079
<v Speaker 2>Is knowledge when you understand it and apply it responsibly,

865
00:44:28.280 --> 00:44:31.519
<v Speaker 2>is your best tool against cyber threats. Critical thinking is

866
00:44:31.639 --> 00:44:34.559
<v Speaker 2>just so vital with all the information overload today, and

867
00:44:34.599 --> 00:44:36.800
<v Speaker 2>hopefully this deep dive gives you a framework for that.

868
00:44:37.039 --> 00:44:40.000
<v Speaker 1>So what does all this mean for you listening right now?

869
00:44:40.599 --> 00:44:42.920
<v Speaker 1>It means you're better equipped to think like a security pro,

870
00:44:43.480 --> 00:44:47.199
<v Speaker 1>to ask the right questions about system vulnerabilities, and to

871
00:44:47.280 --> 00:44:50.639
<v Speaker 1>appreciate that constant back and forth, that dance between attack

872
00:44:50.719 --> 00:44:51.320
<v Speaker 1>and defense.

873
00:44:51.599 --> 00:44:54.880
<v Speaker 2>And the key takeaway something Hugo Hoffmann really emphasizes in

874
00:44:54.920 --> 00:44:59.480
<v Speaker 2>the source is practice, constant practice, but always in a

875
00:44:59.480 --> 00:45:03.360
<v Speaker 2>controlled and environment, and always always for white hat purposes.

876
00:45:03.400 --> 00:45:06.920
<v Speaker 1>Only thinking about the tools we discussed, Knowing how a

877
00:45:07.000 --> 00:45:09.679
<v Speaker 1>depth attack or an evil twin works helps you defend

878
00:45:09.719 --> 00:45:10.199
<v Speaker 1>against it.

879
00:45:10.199 --> 00:45:14.599
<v Speaker 2>Right exactly Understanding the offense informs the defense, which actually

880
00:45:14.639 --> 00:45:17.360
<v Speaker 2>brings up an interesting question to ponder. Yeah, thinking about

881
00:45:17.400 --> 00:45:20.400
<v Speaker 2>everything we covered, all those vulnerabilities, those attack methods, those

882
00:45:20.440 --> 00:45:25.280
<v Speaker 2>defensive postures, what specific vulnerability or maybe what specific defense

883
00:45:25.320 --> 00:45:28.679
<v Speaker 2>mechanism will you choose to explore further in your own learning,

884
00:45:28.960 --> 00:45:32.320
<v Speaker 2>maybe even starting safely, carefully in your own isolated home

885
00:45:32.400 --> 00:45:33.119
<v Speaker 2>lab environment.

886
00:45:33.400 --> 00:45:36.280
<v Speaker 1>Ooh, that's a great provocative thought. To leave everyone with

887
00:45:36.400 --> 00:45:39.880
<v Speaker 1>an excellent challenge. This deep dive was designed to be

888
00:45:40.000 --> 00:45:43.400
<v Speaker 1>your shortcut to being well informed, hopefully with some surprising

889
00:45:43.440 --> 00:45:46.280
<v Speaker 1>facts and maybe just enough humor to keep you hooked.

890
00:45:46.360 --> 00:45:47.239
<v Speaker 2>Hope it was useful.

891
00:45:47.360 --> 00:45:51.559
<v Speaker 1>Absolutely until our next deep dive, Keep learning, keep questioning,

892
00:45:51.639 --> 00:45:53.280
<v Speaker 1>and definitely stay curious.