So it's good.
Then not all.
Let's go to the next challenge.
So joining fourth.
You can go in.
Still no need it.
So we thought that we would need it, but not so.
Yeah.
Okay.
Challenge of.
Right.
Well, okay.
So as you.
Sure.
Let's.
Try to view vintage stores.
Oh, it is a two minute run, instant is dusk.
So let's check it out first.
So we are going to do a read.
So let's do a read.
Gandara
to go to B or C and Conjola, me and No.
So that jagged.
There are some files.
So.
Kim.
We need to go.
You know, it's.
You know, all this page, so it's.
Well, it's all about.
Inspect and.
It's it had been reported that this change is really flying.
But let's play a while on its way out well on before you quit.
Yeah.
Used the road to see what the were to refer to Desalegn and.
Equal, equal.
Zwar.
Okay.
Tourist thing first thing for us.
Let's go.
The.
So I want to shoot.
Nanex.
Let's check for a beach we finally saw.
It's only one.
So we do it on one double click.
Come on.
And so key is so let's let's check autoimmune on to see what kind of stuff we got to endure.
There will be.
Having.
Completely nothing.
Cell phones, zero.
Okay.
So, yeah.
This I.D. probably crying.
So let's go to this.
We don't need these anymore.
So, Kay.
Kid seems that this site is really your friends or we can't do anything with it, so.
Yeah.
OK, so that's good.
And the next challenge, let's call it.
Path.
Twenty five.
That's OpenNet.
Here we go.
This includes work site Borsos.
And this challenge, Djuric School employed some new tech guys to head up to help block bad Web sites
such as the deputy Debre.
You had bone hackers that come.
He told me, that is fine.
Chorded up some thing in.
See you.
I'll see you.
Get to get the page and displayed.
He also mentioned that it uses numbers to bypass these sites.
Okay.
Interesting.
And can you try and work out what he means, if anything?
Okay.
As usual, Joes.
All right, click and view page source and just analyze something if you have some good data.
OK, it's all.
Yeah.
And what we got and we are going to just try to eat.
Let's go to kale.
Okay, we will sawy DWB was able to get Horst WWT, head of Bone Harker's.
OK, OK.
So what do we can do?
Let's go back following the information that he put some numbers to by bus, two by bus.
This Web site or some buy or some other Web sites, it it tells us a lot because instead of sometimes
instead of typing a particular Web site techs, you can take the Web site IP address.
So there is nothing on inside.
If you want, you can just try to go to specific Web sites and into the target Web site that you want
to know out the IP address.
And you just get it or you can just use your terminology and try to pin it out.
One very common tool that it's it's it's very needed.
But I don't require you to do it on your own thing because I know that it's just it would all yours
or I'm not going to do anything long inside this or a I scan this Web site.
This Web site is nothing done.
They have about Harker's dot org, because I can figure it out.
This is the IP address that I that I have found.
So IP neat first thing first.
I just typed in my terminal being the route every day where you were born.
How is that okay.
And then, yes, it works.
So therefore I can end my feet to scanning to find many services that it has.
It has DCP, which is import 80 and has it like a lot of stuff.
Its GDP is a lot.
A lot.
So you can just try to read some information.
DCP SSL attitude.
Yes.
On 443 insulin's or.
Yeah.
So.
But the thing you need for this task, for this challenge is that tried to pin her bone back with that
all first and then after, after being in need then you will get the IP address.
So this is the IP address that we get.
So let's let let me click it and copy the IP address.
Now, it says that E told me that his friends coding or something in C were to get the pigeon displayed.
And he also mentioned that he used it to use these numbers.
So we can just try to parse the number.
Let's say control, read it to see who find it or get nothing.
So we are going to try to calculate these numbers for these things.
We can open a new tab and then we go to this Web site and calculate rose and cool arrows that come.
And it wasn't a.
A computer would get heat, so let's close this stuff first.
It's closed and it's going to do it was.
Yeah, you can go here so you can just type digital competitions and you choose this IP address.
Just enter.
And then scroll down.
Slow down.
You can choose anything.
You do what you want.
But it depends on the task that you have to sort of.
So we could hear the IP address and then you were going to bust the IP address of of all Adam Bowen
Hacker.
Is this one of us?
Come on.
OK, so we just said it all and.
Copy.
Will go eat it and then we'll come back here.
And then we just passed it here and it's posted here.
So the beginning was one hundred four.
All right.
So now we can just click on calculate, but before it's changed the code first again.
So it is gun related.
What we need.
So we we don't need the binary, but if you want, you can just test them.
It's just a matter of testing, you know.
So this number, does it include any later?
So we eat dirt and go back here and we pass it like that.
We get side weed.
So he and stuff like that.
Kim.
It's not working.
So let's try to go back and see what work what's what.
Come on.
Case or let's do it again.
We've been at a bone ackers being developed to really bone upgrades.
It was a physical hocker and bone at.
In just the gut and.
Can you just be.
Copy.
And come back here.
Oh, we just open a neutrino, see what's what.
Be here.
Go on.
Guess so.
So let's be neat.
And then conjoin shift would be.
Oh, kid, no kids, is that OGX?
Let's try to see Key.
So it's the IP address, so we can go back.
We can try a specific Web site just to detect exactly if it's the public IP address we get.
So we type who.
He's got domain tools that come within.
All.
Let's close it.
We will go to all to you into the brave box, because this will consume a lot of stuff for us.
So you don't need.
No, you can go easy.
OK.
Let's go to Wolf Blitzer.
He's been in Newtown.
And then we die.
Always.
Ease, ease, Dodd domain tours, dot com and our.
And then here we are going to Taibe, the domain name one, which is head of Bone IKAROS, or we just
go in.
We just blessed the deal.
Yeah.
And search.
So let's wait.
It gives or say his old.
Q So we need the IP address of it.
Where it is located.
It's too close to it's too.
The same the same IP address which we had earlier, when we need 100 forces.
Twenty seven one three six, three, two, three, four.
So good luck.
Yes, exactly.
So let's go this calculation.
It is for the added bonus hackers IP address.
So.
It could be it could be that.
One.
Just copy it.
OK.
We'll come to you.
Let's say they do get side to see Congress usually, so we get this point.
This time is when you when you convert your.
Your IP address check.
If you didn't have some kind of mistakes.
Let's just try to be calculated to see what kind of numbers, if a deal will give or ones have been
for six weeks.
Let's come back to one, two in four.
Six weeks to be four nine eight six three four nine six.
Yes.
So, no, it's OK.
So cute.
Always be careful if you add some mistakes.
Just supervise again the IP address that you get in your local.
And when you bring it here as well.
And then before you get a pass, go to this Web site and calculate dappy address so that you find the
decimal number.
This is very well known way to find the decimal numbers of an IP address.
So we don't need this anymore.
We can close it.
If we can just close this right now and get day six hundred planes, we don't need it anymore.
What is the next challenge?
Twenty six.
So let's go to the next challenge is now to be 26.
What, Scott?
Okay, so I can close it.
Yeah.
Of Lane.
This Web site.
This change, again, seems to be overriding nothing inside.
If you want, you can just read your page source or inspect what?
There is no desk.
No, we are not going to twist all time here.
So let's go to the next boss.
So challenge.
Twenty seven.
Let's go.
You okay?
Ice breaker.
I decided to wait.
Ace were really all in clean function for BHP.
Again, BHP involved.
So he has opened it up to anyone for penetration testing.
Your goal is to display the text script.
I wrote one script simulating X in access this injection.
So first thing first before study we have we need a very, very deep to Toriyama and um.
And of course, I don't remember exactly if you do report one or report tools or let me check it first.
Go to wave.
Gay.
So, Gail, let me check it.
Part one, we own but one.
Let me check.
Excesses, excesses, excesses.
Then let me just.
They control this.
This one exists, but it is real.
OK, here.
So it is to be on patrol the day before.
You check it here.
Doo doo doo doo doo doo doo doo doo.
OK.
Excesses, firing range in humiliation and exploitation.
There we go.
We explained very well, guys, how it works.
So you ask what we are going to do.
We are going to find a way to bypass the SSX in nation and act.
So let's try to replace this creep.
Like they say to all this.
We just copy, copy and paste it here.
Let's try.
Artillery assault.
It January read something here.
So let's check something.
The same thing.
But let's try to see the problem with this, because it's serious.
It seems to have some kind of some kind of filters.
It isn't generating interest on it's a screen.
And the posted.
Nothing gained.
So what we can do, we see very clearly that it has some restriction, some printers, because when
we enter this comment, let's pass this to you.
So we get you as posted only Route one.
So that means we did see this crude stuff.
And when we tried to do stuff like that and we posted it, we just see it comes here.
And so let's do it.
Blah, blah.
OK.
So that's because you put it in strings or does it matter to put an integer?
So it comes here.
We can try to find a way to force the freed jurors saw this, the words excrete this because it is filtering
that this day's script cannot be posted.
So and we want to use or JavaScript stocks so that we can inject opaquely.
So what are you going gonna do?
Can try to foolish the system.
I mean, we can try to.
We can try to bypass it, OK, by typing screen.
And let's say a word or two or three, four, five and oh.
Just could be decided.
So dissimilar in script again.
And do don't like that.
So before that scenes discrete will not be able to do be injected.
So we are going to type again.
Let's see.
We take the screen.
So, okay, and then let's take you again.
So it doesn't matter the place you take this again, it's group or game.
What it does is that different groups inside this one all get rejected by by the filters.
And this one as well, because they see this system.
Can we read linearly?
That means it will reject the first script.
I mean, this could end the middle, but it will not be.
Understand is this one is C because after is C, R, it's not A, it's s c r again.
So let's try to clip post to see if we get it.
So it's there, you see?
Now, everything now and get busted.
OK, so we're done.
As we detect that we might as we detect that we have bypassed it.
So therefore, we have to just copy this again.
We just call UPS, copy like cleaned and busted heel, busted halo, because now we need the plane.
But what we have done here is OK, but we just need to follow what what they said you saw script and
we have to get a script, scuba gear and squid scripting it now.
So we place it because we need to find a point.
Congrats.
40 win plans has been at see.
Six hundred forty points now.
OK, so we did this challenge so let's go to the next one.
So let's close this tab first and it will be 28.
Thank you.
So let's check it out.
So let's go for it.
Check here, okay?
The H, b, h hellbound hackers staff have been getting a lot of personal messages.
We're going to use a different things.
So they decided to set up a contact form for users to contact them by.
The only problem is that the contact form has a big security hole in it.
See if you can find you who are not.
And to accept it may surge as some sensitive data is being sent along with the e-mail.
Kids or my name is really D Dickin and and managers and age kids.
There's a big security hole in it.
OK, so what we can do?
We can try to use a fairly well known tool, guys, which is fairly important for penetration tester
or for an artist.
It is the Bourbon Street.
If you don't have it, we will require you to go and buy it.
If the purpose fish or not, I mean the Asian community.
So if you have them, if you want, you can go and check it out.
Bite.
Or if you want, you can just contact cause.
And then we will provide you.
Okay.
So what we can do.
We can just try to open all.
We need to sort of go to totally normal and and let's put it, you know, put too many Termine 22 to
we're not together on.
And we hope to start over it.
We should not.
Or care?
No.
Obesity started so we can click next and Sternbergh.
I right.
Okay, so Ortberg suit now is damaged.
So what we want and are we going to try to go to proxy and intercept is already on this or we can go
back to Firefox and try to try to go to settings.
This is Google Chrome.
For this challenge, let's try to use Firefox, Firefox instead of Google Chrome, because in Firefox
we have already set up a proxy so that it can match on their books, books, books.
So we don't need to to configure the Google Chrome for that.
So we let it here.
So to surfing the web and then now let's try to go and open or Firefox.
So let's click here.
Case or Firefox now is open.
So let's go to go call one.
Let's minimize this.
So I get to log in as anything.
And the password.
You
never know where.
And so you go back, you could you.
So it was a.
So, yeah.
So we are there.
So what we can do, we can just go and settings preferences and search for something like advanced or
net oil so it doesn't matter.
Advanced.
Networks.
So let's supervise a gain a brochure so that we can configure or Firefox posture toward properly wheat
Bourbon Street.
So to do so, equal work here.
And then we click on the settings and then we choose the mind, more proxy configurations.
And then we have to make sure that these pook see is and this board, they are in Bourke Street talk
see auctions as food thereafter.
So we can go back here and the Internet intercept is still off.
So we come back here.
And then one very important thing is that we have to make sure that this box is checked.
So we check it and then we have to make sure as well that you delete everything, everything from here.
So we delete them ABSs.
So we we delete them.
Everything and then we think, OK, so let's try to go down one.
OK.
Nothing so Greek.
OK, we can just check and verify if it's here before, OK?
Now, what we can do, we will go back to burb street like that and then make it into it is on.
But before that we are going to dispatch first and let's return.
Okay.
So now before clicking send on send.
We have to make sure that intercept is on.
So therefore we can get a little bit below.
Below, below, below, below.
We need to intercept.
OK.
And then now we click on send.
Now, we have to add this certificate because it says that the owner of the villa, her bow and her
Glassman figure went to the website improperly to particular information from being stolen for a forecast
and connected to this website.
So DECIDE uses HTP Street transport security, this one to specify that Firefox may only connect to
its security as it was.
It is not possible to extend an exception for this certificate.
Since the coalition was failed.
Let me turn this on so thick or tall, good Firefox.
Okay.
Well, first thing first, after you have configured your post really well so that it can lead to dippie
is while you have clicked on the.
Use this proxy server for all protocols, of course, while you delete all that up moves and no proxy
for.
So you you might face some problem.
Bye bye.
Go into your browser and try to weed some entity to be S5.
So let me tell you, when you have configure it to your browser, you need to test that.
It is working properly within Broadstreet warning in your post.
Good to Amy.
It's GTP you avoid.
Don't go yet to.
It is for this moment.
Then your browser should sit waiting for the request to complete in Bearup.
Go to the proxy tab and then through the end set some time.
These terms should be highlighted and there should be any should be an HDTV request showing in the main
panel.
So therefore you have to click on The Intercept is on but on so that it says intercept is off.
Likewise, if you want your intercept to be off or to be only, so you click it again.
So go back then to your browser and you shall shortly see that you are aware of what you requested being
loaded in the normal way.
If things are working and the way you described so you can just try to do we view it again.
Now, finally, you need to configure your browser to be able to send HD to be s request to purchase
it without any problem.
So in the previous tutorial, we have shown you how you how you can configure your Bourbon Street so
that it matches the.
S communication.
So exactly.
That's where we are.
Now we are explaining to you how it works.
So this step is it strictly needs to show it to use brooks it in a basic way or only for a non HTP as
well.
But it is only needs to be what it is, but it only needs to be done once it is necessary to get the
most out of perhaps it when testing applications.
And that used to be s protocol that we use.
And for the requirement is that a burp boik the T.
S connection, which browser and the destination web servers in order to view it, modified a plane.
The contents of it DTP is besieges.
DNS is designed to prevent this happening.
And so by default, your bossio will show security ahwahnee when you visit a HDTV as you were using
Brooke.
So to ensure that application which are using DDT, it is protocol function properly.
Quickly, you need to install birth certificate or do you?
So that's how that's why we showed you earlier how to install it.
But never mind.
So we are going to walk you through it.
And this video as well.
So do you realize that if so, you need to install a birth certificate or 3D tearless certificate in
your Borse just stole.
Okay.
When you have done that, you can confirm teams are working for purity by closing all your books or
windows, opening a new browser into visiting any HTP.
You are well, the process should not display any security warnings and debate should erode.
And I my way.
So you need to turn off interception again and EPOXI intercept.
If you have we inabilities.
Okay.
OK, so let me show you the security warning.
We will we have talked earlier.
So the security warning is that after you you have checked in your phone, folks.
Let me go back a little bit from network and settings and then you check this and then you watch everything.
Then, you know, you would do it.
It is.
So after that, when you come back here in the studio, you want to finish it.
You would just click on sentiment's.
They send.
Well before the state something normal.
So a lot.
So what's up, man?
OK.
And then you click on send.
Exactly.
This is the security warning that we were talking about, what it says, that it says that the order,
her bone umbrella as configured to website improperly.
So we click on Advance and therefore we might see do cert if we click here on this score.
So this is the certificate they have, which is invalid as as they said.
So what we can do, we have to import the burbs certificate so to do so.
We have showed you two two ways that you can do it and the previous video.
So but now we are going to use it.
The quickest one.
So since we are already on Bourbon Street, since we are all since or Brusic is already opened.
So we don't need to to go for external information.
Let's let's just open a new tab and type, let's say burp, burp and then whatever.
So we click on this certificate.
And we save it.
It will save us concert dirt.
So what, we just change the name.
So it's already downloaded.
Now let's click here.
And we name it.
Let's say instead of this, John is John Burke.
C e.
O n.
We only name eat a dead.
King.
So now we can.
Go and imported here.
So let's go to certificate first thing first.
My computer is that 18 to RMI.
OK, so now less imported so we can use it to free trade and we are on.
Let's join it for a little bit.
Okay, so we click on or Tweedy's.
So we are going to import it.
So it is provided by post Shrieker.
So let's go all this.
What's reproposing here is not a euro.
So I'm betting it is not OK.
So when I put it here.
Oh well we have put it down.
Yes.
Don't know.
So we can just click here.
Or Ben and Joyce chose just OK.
So we assume that it's here, you know.
Will be.
That's OK.
Now it is down, so you can just click, OK?
So let's begin in just a very, very.
It should be here.
He.
OK.
It seemed so perfect.
Now let's try to turn this off and close.
Oh, Boser.
Let's close this and we still need this.
Let me go.
Back so that January to December information that again, so and then I can close on water all day.
Whatsoever.
I mean for the folks because I'm working with our folks and then we'll be in it.
So I'll close it later.
Now I'm going to open it back.
So.
Or he go into what he did to me.
It's already here.
Excelente.
Paladin, that includes or it's never mine.
OK, so I know it when I just checked the information again, so.
Oh, Bruce Reed is is now on all four and or Firefox is very aware of several.
It is set up on.
Lets me check again.
Again.
Or or cert is installed or birth certificate is installed on opposer and an O network is for all the
protocols.
Okay, good.
So now we can test it so that we get the communication.
So let's drag it here.
Okay.
Now we come back to you wanted to draw your own or are we still looking.
So we hope with.
We think so.
Let's let's just refer you to tweet.
Yes, look, look, we are here before.
Now, when I go down and into something better.
Or I or it's entered information that we want and now you can try it.
How you doing?
And before blessing Sen.
Let's turn or burb street intercept.
We all know it is on.
So now let's try.
So we should not get any e mail message if everything works properly so we can air.
Excellent.
Look, weak case to HD DP s you see.
That's perfect.
Now we can proceed to task.
Exactly.
This is the way that the Bourke Street will work with the H to Typic.
S communication first thing first visually imperative crucial thing that you hear on your browser and
your network.
You should make sure that we check this box.
Use this proxy server for all the protocols and you click, okay.
And then it's not enough if you don't import the Bourbon Street certificate into your browser.
Because without which, while you check where you work with it, you're going to get a new message,
as we have showed you earlier.
Okay, so now let's force it to dust and then because we have to finish with this challenge.
Look what we can do now.
We we we have to send the parameters kept in the Indesit page to until we beta so that we can work with
the we beta and then we can forward.
Oh, we can send that message to to a valid email address.
So to do so, let's go for a script we beta's or it is blank so we like click.
And then we say we will of course and we beta and then so it is highlighted in red color.
So we think he'll know what we can see that.
We have the email address, which we have sent from abroad, sir.
And now we need to have something to do.
So we are going to to try to send this message to a valid email address.
Or you can use your two man or your your email address, your Hotmail.
It doesn't matter.
But for the sake of this video, we are going to show you how you can create a temporary e-mail address
so that you can so that you don't want to use your specific or your Palfry Sean or your will e-mail
address to avoid spam.
OK.
So we go back to all to all wave borsa.
So we click here.
And so we can refresh it just to get a new manageress.
This is so and now we have a new race and therefore we can copy.
And then we'd come back here.
So we have to.
Would you find these right after the e-mail address that you have used in your phone, folks here?
So what we're going to do, we going away, Cleek and Suneet to we beer or you can join us, go to it's
GTP, his story, and then you go you'll find your last story or else he still is Civil Wars and Google
Body.
Of course it's not.
So what we need, it's this one.
And it's it's not either this one because we have to see exactly the same thing that we have seen in
the Indesit here.
So this is anything blah.
This one.
This one is one.
So we get to come here if you want.
And then here we are, the weakest pages.
So we go back to our topic and then you just right.
Click and send to Peter.
So we send it now to Peter.
So there now we're going to try to modify it so that we can get it to a new managers.
So if you want, you can put your G.M. address or Yahoo!
It doesn't matter.
Yep.
Or you can or we can use a temporary e-mail address, as we have seen earlier.
So we are going to use it.
So, yeah, this part is related to the S m dippie server.
How to beat out the be B5 is communicated with a server.
So we, we have a name in it being an Indian managers and a message.
How BHB both pass the information to an S&P.
So we have to force the D email address and the content, everything to an e-mail address, which we
have access to so that we can get any kind of information or data which she's send to this specific
e-mail address.
So so we will need to include a new email actuary's.
All right, after the email address that we have sent this message to do so, we are going to use the
header of the is a B so that we can forward this email us to do so as a weekly we white percent and
Zwar D.
So and then zwar A and B, C, C laid.
And then now we're gonna go back to all to Autum Pourri email address and objected and copied and pasted
here.
And woodies should be present again against woodies.
That's right.
So.
So now we can copy E like dirt and so the content.
Still your inbox is still your inbox is empty.
Still.
OK, so now we come back here.
And then we just busted Hato.
So now we can just click on Go.
OK, so so we can go on on Winder.
OK, so therefore we can try to go back to day to day manageress.
And see what kind of content we get.
So we get something.
I'll go on to form.
Sindarius, ZEW.
On.
What do you get?
Okay, perfectly.
We get something that is that is the password is lower main tax.
So we just click on my computer and get AIDS whenever mine and I copy it.
Then I come back to dis.
And let me again just stop the process.
No.
So let me put this version out to be.
Of this, it is of because I.
We don't need it anymore.
So you can just come back here.
And now trying to sell me the password to a CEO.
Let's check it once again, then we try to find a way Congress 14. friends has been added.
So this is excellent.
This is very excellent, guys.
So now we have passed this challenge so we can cause that.
We think that.
And so we can just let them let this fail.
OK.
And then we are going to the next challenge.
That's why I keep an open new.