All right, folks, welcome back to another video from section 10 will
level the Audits. And this video, as you can see, we are
going to talk about detecting one level Windows systems in section 10.
And lastly, actually, from section 10
of this video, 10.5.
We was always honest. Answer some questions. Okay, what do
we know about liabilities and section? One example from
it because the previous videos, we compile scanners
and actually going to show you one of them, make
sure you talk about winner, one of these famous things. Clear
to have an overview on it. Let's
go. All right. This is the Sparkle. So,
as I mentioned, the previous video, we can use any one of the scanner,
Dan Ones based on your will. And
just try to find area.
That you like and this is your decision. So
I'm using this one now. So for example to see
how this works. So this is kind of like these environments also
have the same here when you can count on you.
I'm going to give new address for to scale
and practice that click on, start a scanning waiting
to retrieval allocated.
Make sure that to get whoops. I gave you trying to analyze it,
it can I have some of the like so
make sure that you didn't get cracking or a political control
to think or analyzing because the owner can, you
know, seal you for analyzing websites? If it's harm
the files and website actually.
So, let's score scanning.
We'll wait for the packets.
Okay, the start sending packets.
We're going to give him, sometimes it's take a lot of time as
you can see, here's trying to crawl in the website. First
now, we have some character from
the website and its trying to using
a get mirror.
And against a Target and permits and current activities, trying to
get among blood of information from it, try to understand what's happening, the
web, attacking the I directories and here
if you find anything. So, let's take a look here.
Here, we can choose security test that we want is
try to analyze the most
famous silences s could be available on
the website.
There's details from directory of
targets each character. We can see the website.
Matthew. Here's something
we would like we call it. Now. I
want ability doesn't really count.
So, we can see the jewels. If you find anything. It's going to show that
the red flag and you're going to be a limited details
impact Rudy, and the consultation.
and the Euro, and after Collision,
So it's a very important tool as well. All over the scanners,
have it and report and
make a report actually by j.a. Click
on it, and actually should customize your report for sure.
Put your employer or your supervisor.
But for now, let's talk a bit about the top 10
Windows 10. One level it is. So the
first one is at the end. So
I'm just going to start with the number 10
and we go down.
Is Windows 10, Mounds manager, while Mt. It's called
a cve does of game and
can see the serial if you type it
into Google, you can see to exploit websites is
from the routine was within shoulder scalation by privilege
by inserting a USB device into Target
system to dismantle an attacker. Could write a mulish
binary to disk and execute this code. So
an update is available now. So you can just
search for the silly.
Probably, you can have the update if you increase
of up to date every time as I said,
very important X1 is Microsoft
Visual levity, stage browsers, including
Internet Explorer was not the highest rating deterministic
routing protocol. We know that when I can just enjoy that but
you know, the truth to say the least
and H seems to be also getting of a rough
start security wise and wary scrimmage could
have division one level these and security feature.
I pass exploring an allergen attackers to
gain control over system more information and
patching. The instructions are rule in this.
I'll link. I'm going to put this on
a PDF as well. Microsoft graph is component.
One of these is a grouping of languages are related to
the various phones and graphic on memory just
to mention it again. If you search it you can see all the details about
it and even exploit if you want to practice, right?
Management flows that could ultimately result in
a remote code execution. If using an untrusted website with
embedded fonts detailed patching confirmation can
be had on the items security Bulletin.
We're starting is Internet. Explorer world is again, the
Microsoft famous knowledge into a browser. Has
a slew of new alliances with the Windows 10. In
most areas of them, is hollowing attacker to gain a system right
after their abuser, clear?
Right? Morph emission of catching channels also available
on Microsoft website.
Microsoft, Windows, General, vulnerability, and against aerial. This
one of the could earlier remote code execution, territories
for user will connect to show the craft to do nail
file. The number five is regard to smb1 abilities.
Actually. Yes. I'm going to go, that's a vulnerabilities, we
can just search for it as you level them.
Another point is this one
level is not mean, the last on vulnerabilities is means their
biggest vulnerabilities. Just released in
during these years. Of course, there's a
Out of all of this is for Windows in the 2019 or
2020. You can just search for
it.
NET Framework resolution privilege, one abilities. Custom
craft can hit that note application can cause
this equation after previous exposure to occur. However, users
must be first and with, or treat, like,
social engineering into running the state application.
Microsoft defunct driver vulnerabilities, Windows
either be type manager, and probably handles a specially crafted
topping types forms, which can easily result in
a remote code execution. A little dizzy. If you work with Adobe, you
can understand what I'm saying. This male is the trackers to gain complete
control of the system installation program.
Number two is kind of weed out, windows, 10 Wi-Fi
sense, contact Sherry, when default Windows 10
will share your Wi-Fi credential to Alpha Skype and
Facebook and text. You may assume that
you make Wi-Fi hotspot, sharing easier is make it
possible for any of these. As I said contact to
hook on to your Wi-Fi network without any authentication
and authorization while not necessary software,
one level has a decent future can lead to
compromise and should be remaini remaining.
Added to the following step fans changer Wi-Fi, network
name, SSID include terms and
underlined no map.
On the line up toout, a
clipboard windows down and pull some
way. Change your windows privacy, setting to disable Wi-Fi sense.
Sharing.
Wind, 32k elevation of the privilege or
level T. This is the cereal. You can share of a
search for that. This one will be involved in the
flow of energy, y component, Windows 10, mainly describe. Oh,
lemons under the treaty character, to gain complete control of
the Windows machine through the privilege, escalation. So
to fix a more vulnerabilities, you need to
identify the require a bit as noted by Windows updates.
Try to take always your Windows updates, try
to take out of Microsoft documents.
I see what's happening there.
Our powerful policy engine can deleted secure configuration for
all the environments and structures and applications tax. In
this case is simple, Windows 10, security policy can be run
or checked any of these about vulnerabilities, as well as a
new level does not yet added to the policy are. Oh
well, back to when I will T detection of mentoring. So sweet. Ensure
that all the windows 10 notes in their environments are
free. As you are free to run levels and security files. So
I put a service here. If you want to continue
running for that tickles as well.
So we talked a little about them windows. One of these scanner show
you an example and will until Windows try to talk
about some famous one and
explaining what's happening. Exactly. There
are, I show you the explode website. You can see in search
for new level teas and exploit that just released.
The next video we're going to be first video from section 11, taking it
to the next level. Good luck.